CVE-2025-38224: can: kvaser_pciefd: refine error prone echo_skb_max handling logic

In the Linux kernel, the following vulnerability has been resolved:

can: kvaserpciefd: refine error prone echoskbmax handling logic

echoskbmax should define the supported upper limit of echoskb[] allocated inside the netdevice's priv. The corresponding size value provided by this driver to alloccandev() is KVASERPCIEFDCANTXMAXCOUNT which is 17.

But later echoskbmax is rounded up to the nearest power of two (for the max case, that would be 32) and the tx/ack indices calculated further during tx/rx may exceed the upper array boundary. Kasan reported this for the ack case inside kvaserpciefdhandleackpacket(), though the xmit function has actually caught the same thing earlier.

BUG: KASAN: slab-out-of-bounds in kvaserpciefdhandleackpacket+0x2d7/0x92a drivers/net/can/kvaserpciefd.c:1528 Read of size 8 at addr ffff888105e4f078 by task swapper/4/0

CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 6.15.0 #12 PREEMPT(voluntary) Call Trace: <IRQ> dumpstacklvl lib/dumpstack.c:122 printreport mm/kasan/report.c:521 kasanreport mm/kasan/report.c:634 kvaserpciefdhandleackpacket drivers/net/can/kvaserpciefd.c:1528 kvaserpciefdreadpacket drivers/net/can/kvaserpciefd.c:1605 kvaserpciefdreadbuffer drivers/net/can/kvaserpciefd.c:1656 kvaserpciefdreceiveirq drivers/net/can/kvaserpciefd.c:1684 kvaserpciefdirqhandler drivers/net/can/kvaserpciefd.c:1733 handleirqeventpercpu kernel/irq/handle.c:158 handleirqevent kernel/irq/handle.c:210 handleedgeirq kernel/irq/chip.c:833 commoninterrupt arch/x86/kernel/irq.c:296 commoninterrupt arch/x86/kernel/irq.c:286 </IRQ>

Tx max count definitely matters for kvaserpciefdtxavail(), but for seq numbers' generation that's not the case - we're free to calculate them as would be more convenient, not taking tx max count into account. The only downside is that the size of echoskb[] should correspond to the max seq number (not tx max count), so in some situations a bit more memory would be consumed than could be.

Thus make the size of the underlying echoskb[] sufficient for the rounded max tx value.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.