Re: [BUG] drivers/net: out-of-bounds in pcan_usb_decode_buf()

On Mon, Sep 7, 2026 at 1:28 AM Geert Uytterhoeven [off-list ref] wrote:

Hi Xiang,

On Mon, 7 Sept 2026 at 00:19, Xiang Mei [off-list ref] wrote:

quoted

On Sat, Sep 5, 2026 at 7:04 AM Geert Uytterhoeven [off-list ref] wrote:

quoted

On Fri, 4 Sept 2026 at 23:17, co [off-list ref] wrote:

quoted

We found a bug reachable in:

    path    drivers/net/can/usb/peak_usb
    crash   out-of-bounds in pcan_usb_decode_buf()
    commit  2f1baf1fc892 ("Merge tag 'trace-v7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: co+5e2bcf11e7027510@bugs.sh

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/5e2bcf11e7027510/patch.diff
        report.md   https://bugs.sh/b/5e2bcf11e7027510/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@bugs.sh

Please read Documentation/process/submitting-patches.rst, especially
https://elixir.bootlin.com/linux/v7.2.2/source/Documentation/process/submitting-patches.rst#L928

I checked the document and the related files, and I apologize for our
mistake. This email should not have been sent to you, as our system
failed to identify the correct maintainers for this submodule.

Thank you!

quoted

We have fixed the issue. Thank you for bringing it to our attention.
If you meant other issues, please let us know.

There are other issues, like not sending patches inline, so they
cannot be reviewed easily.
Thanks again!

Thanks for the feedback.

The patch is entirely LLM-generated, and we don't want to “DoS”
maintainers' time by asking them to review LLM-generated patches. We
believe sending LLM-generated patches without human review is
irresponsible. We'll make this clearer in future reports and clarify
that these are bug reports and that the generated patches have
limitations.

Thanks again!

Xiang

Gr{oetje,eeting}s,

                        Geert

--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds