CVE-2025-38224

In the Linux kernel, the following vulnerability has been resolved:

can: kvaserpciefd: refine error prone echoskb_max handling logic

echoskbmax should define the supported upper limit of echoskb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloccandev() is KVASERPCIEFDCANTXMAX_COUNT which is 17.

But later echoskbmax is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaserpciefdhandleackpacket(), though the xmit function has actually caught the same thing earlier.

BUG: KASAN: slab-out-of-bounds in kvaserpciefdhandleackpacket+0x2d7/0x92a drivers/net/can/kvaser_pciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0

CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: <IRQ> dumpstacklvl lib/dumpstack.c:122 printreport mm/kasan/report.c:521 kasanreport mm/kasan/report.c:634 kvaserpciefdhandleackpacket drivers/net/can/kvaserpciefd.c:1528 kvaserpciefdreadpacket drivers/net/can/kvaserpciefd.c:1605 kvaserpciefdreadbuffer drivers/net/can/kvaserpciefd.c:1656 kvaserpciefdreceiveirq drivers/net/can/kvaserpciefd.c:1684 kvaserpciefdirqhandler drivers/net/can/kvaserpciefd.c:1733 __handleirqevent_percpu kernel/irq/handle.c:158 handleirqevent kernel/irq/handle.c:210 handleedgeirq kernel/irq/chip.c:833 __commoninterrupt arch/x86/kernel/irq.c:296 commoninterrupt arch/x86/kernel/irq.c:286 </IRQ>

Tx max count definitely matters for kvaserpciefdtxavail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echoskb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be.

Thus make the size of the underlying echo_skb[] sufficient for the rounded max tx value.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.