[PATCH v8 12/14] can: peak_usb: pass the dev_num argument of PCAN-USB Pro GETDEVID

[Stéphane Grosjean via B4 Relay]

From: Stéphane Grosjean <s.grosjean@xxxxxxxxxxxxxx>

pcan_usb_pro_get_can_channel_id() builds its GETDEVID record with
pcan_msg_add_rec(), passing only the channel index. However,
pcan_msg_add_rec() handles GETDEVID together with SETBTR and SETDEVID,
and also reads a second argument with va_arg(), to fill the dev_num
field of the record. Reading this missing argument is undefined
behavior: in practice, whatever value is left in the corresponding
register or stack slot is written to the request in dev->cmd_buf.

This value is sent to the device with each GETDEVID request. Moreover,
peak_usb_disconnect() clears PCAN_USB_STATE_CONNECTED before it
unregisters the netdevs, and once it is cleared,
pcan_usb_pro_send_cmd() and pcan_usb_pro_wait_rsp() return success
without any USB transfer. pcan_usb_pro_get_can_channel_id() then
returns the dev_num field of the request as the CAN channel ID, so an
ETHTOOL_GEEPROM request handled in this window makes
peak_usb_get_eeprom() copy that value to userspace, and cache it in
dev->can_channel_id.

Pass 0 as dev_num, so that the request is fully defined, and a null ID
is returned in that case.

Found by Sashiko AI review.

Fixes: d8a199355f8f ("can: usb: PEAK-System Technik PCAN-USB Pro specific part")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Stéphane Grosjean <s.grosjean@xxxxxxxxxxxxxx>
---
 drivers/net/can/usb/peak_usb/pcan_usb_pro.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
index 840658723648..0d014f4c08a7 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_pro.c
@@ -435,7 +435,7 @@ static int pcan_usb_pro_get_can_channel_id(struct peak_usb_device *dev,
 	u8 *pc;
 
 	pc = pcan_msg_init_empty(&um, dev->cmd_buf, PCAN_USB_MAX_CMD_LEN);
-	pcan_msg_add_rec(&um, PCAN_USBPRO_GETDEVID, dev->ctrl_idx);
+	pcan_msg_add_rec(&um, PCAN_USBPRO_GETDEVID, dev->ctrl_idx, 0);
 
 	err =  pcan_usb_pro_send_cmd(dev, &um);
 	if (err)

-- 
2.53.0