Re: [PATCH v6 08/13] can: peak_usb: reject records for unset channels in PCAN-USB Pro

[Stéphane Grosjean]

On 24/10/2026 05:58, netdev-bot+sashiko@xxxxxxxxxx wrote:
[...]
> [Severity: Medium]
> Should an empty slot be treated as an error here? The commit message
> describes this as an expected window: channel 0's RX is running before
> channel 1 has been initialized.
[...]
> Would it work better to skip just this record and go on to the next one?
> The same applies to the -EINVAL return added to
> pcan_usb_pro_handle_error().
>
> Two later commits in the series seem to resolve this.
[...]
> At this commit, though, the window is still there.

Right, at this commit the rest of the transfer is dropped, as for the
other malformed records, and as patch 6 does for the PCAN-USB FD. I
kept it that way on purpose, as in v6: patch 9 makes this branch
unreachable, so that an empty slot can then only come from a bogus
record, and patch 12 removes the dump in pcan_usb_pro_decode_buf() and
rate limits the other one. Skipping the record would only matter to a
tree that takes this patch without patch 9, and all of them carry a
Fixes: tag.

[...]
> [Severity: High]
> This is a pre-existing issue, but pdev->usb_if is only assigned here,
> after the netdev has already been registered.
[...]
> The later commit "can: peak_usb: register the netdevs only once all
> channels are set up" seems to fix this.
[...]
> [Severity: High]
> This isn't a bug introduced by this patch, but can this kfree() cause a
> use-after-free on the probe error path in peak_usb_create_dev()?
[...]
> The WRITE_ONCE() added here runs before the kfree(), so it is fine by
> itself. The later commit "can: peak_usb: register the netdevs only once
> all channels are set up" removes register_candev() from
> peak_usb_create_dev(), and its commit message names this use-after-free.

Agreed for both: they are pre-existing, and fixed by patch 9 of this
series, whose commit message describes them.

Thanks!

Stéphane