]> Gentwo Git Trees - linux/.git/commit
can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
authorSeungjin Bae <eeodqql09@gmail.com>
Thu, 23 Oct 2025 16:27:09 +0000 (12:27 -0400)
committerMarc Kleine-Budde <mkl@pengutronix.de>
Sun, 16 Nov 2025 15:23:04 +0000 (16:23 +0100)
commit0c73772cd2b8cc108d5f5334de89ad648d89b9ec
treef2eb8f23e17d74e72cdf9621d7336e0858ee4e3a
parent5442a9da69789741bfda39f34ee7f69552bf0c56
can: kvaser_usb: leaf: Fix potential infinite loop in command parsers

The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback`
functions contain logic to zero-length commands. These commands are used
to align data to the USB endpoint's wMaxPacketSize boundary.

The driver attempts to skip these placeholders by aligning the buffer
position `pos` to the next packet boundary using `round_up()` function.

However, if zero-length command is found exactly on a packet boundary
(i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up`
function will return the unchanged value of `pos`. This prevents `pos`
to be increased, causing an infinite loop in the parsing logic.

This patch fixes this in the function by using `pos + 1` instead.
This ensures that even if `pos` is on a boundary, the calculation is
based on `pos + 1`, forcing `round_up()` to always return the next
aligned boundary.

Fixes: 7259124eac7d ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
Tested-by: Jimmy Assarsson <extja@kvaser.com>
Link: https://patch.msgid.link/20251023162709.348240-1-eeodqql09@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c