[PATCH 2/2] can: esd_usb: validate the message length in the rx path

[Joas Antonio dos Santos via B4 Relay]

From: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>

esd_usb_read_bulk_callback() walks the messages in a received buffer
using the length byte from each message header:

	pos += msg->hdr.len * sizeof(u32); /* convert to # of bytes */

	if (pos > urb->actual_length) {

The length is supplied by the device and is not checked against zero.
A message with hdr.len == 0 leaves pos unchanged, so the loop never
terminates and keeps handling the same message in the URB completion
handler, which locks up the CPU.

The check that the declared length lies within the received data is
also done only after the message has been handled.

Compute the message length first and reject a message that is empty or
whose declared length does not fit into the remaining data before it is
handled.  The handlers still rely on the fixed layout of the message
they are given; checking the declared length against the layout of each
command is left for a separate change.

Found by LLM-assisted source review.

Fixes: 96d8e90382dc ("can: Add driver for esd CAN-USB/2 device")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>
---
 drivers/net/can/usb/esd_usb.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/net/can/usb/esd_usb.c b/drivers/net/can/usb/esd_usb.c
index f26a8780686f..67dba118ce9e 100644
--- a/drivers/net/can/usb/esd_usb.c
+++ b/drivers/net/can/usb/esd_usb.c
@@ -507,8 +507,15 @@ static void esd_usb_read_bulk_callback(struct urb *urb)
 
 	while (pos < urb->actual_length) {
 		union esd_usb_msg *msg;
+		unsigned int msg_len;
 
 		msg = (union esd_usb_msg *)(urb->transfer_buffer + pos);
+		msg_len = msg->hdr.len * sizeof(u32); /* convert to # of bytes */
+
+		if (!msg_len || msg_len > urb->actual_length - pos) {
+			dev_err(dev->udev->dev.parent, "format error\n");
+			break;
+		}
 
 		switch (msg->hdr.cmd) {
 		case ESD_USB_CMD_CAN_RX:
@@ -531,12 +538,7 @@ static void esd_usb_read_bulk_callback(struct urb *urb)
 			break;
 		}
 
-		pos += msg->hdr.len * sizeof(u32); /* convert to # of bytes */
-
-		if (pos > urb->actual_length) {
-			dev_err(dev->udev->dev.parent, "format error\n");
-			break;
-		}
+		pos += msg_len;
 	}
 
 resubmit_urb:

-- 
2.43.0