diff options
| author | Bartosz Szpila <bszpila@google.com> | 2026-10-01 08:57:13 +0000 |
|---|---|---|
| committer | Tzung-Bi Shih <tzungbi@kernel.org> | 2026-10-02 02:11:44 +0000 |
| commit | 317e7abcaf60b79765dcf35c014edac8b9d37a6e (patch) | |
| tree | 867303f96122fc7b7afa06ac1ffe574022df1dee /include/linux/platform_data | |
| parent | 5859f97c6f404d07e89fe9c0d20a318ebf200bd1 (diff) | |
| download | linux-next-317e7abcaf60b79765dcf35c014edac8b9d37a6e.tar.gz linux-next-317e7abcaf60b79765dcf35c014edac8b9d37a6e.zip | |
platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data
cros_typec_register_altmodes() iterates over sop_disc->svid_count and
sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response
without validating their bounds.
port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE
bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC
returns an out-of-bounds svid_count or mode_count, the loops read past
the end of the mode_vdo array or the disc_data buffer.
Validate that the discovery response with svid_count entries fits within
EC_PROTO2_MAX_RESPONSE_SIZE using struct_size(), and ensure each SVID's
mode_count does not exceed ARRAY_SIZE(sop_disc->svids[i].mode_vdo)
before registering altmodes.
Fixes: de0f49487db3 ("platform/chrome: cros_ec_typec: Register partner altmodes")
Signed-off-by: Bartosz Szpila <bszpila@google.com>
Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>
Link: https://lore.kernel.org/r/20261001085714.1086242-1-bszpila@google.com
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Diffstat (limited to 'include/linux/platform_data')
0 files changed, 0 insertions, 0 deletions