diff options
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/platform/chrome/cros_ec_typec.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c index 50a68819ceb7..4427897eb3f5 100644 --- a/drivers/platform/chrome/cros_ec_typec.c +++ b/drivers/platform/chrome/cros_ec_typec.c @@ -7,8 +7,10 @@ */ #include <linux/acpi.h> +#include <linux/array_size.h> #include <linux/module.h> #include <linux/of.h> +#include <linux/overflow.h> #include <linux/platform_data/cros_ec_commands.h> #include <linux/platform_data/cros_usbpd_notify.h> #include <linux/platform_device.h> @@ -894,7 +896,15 @@ static int cros_typec_register_altmodes(struct cros_typec_data *typec, int port_ int ret = 0; int i, j; + if (struct_size(sop_disc, svids, sop_disc->svid_count) > EC_PROTO2_MAX_RESPONSE_SIZE) + return -EINVAL; + for (i = 0; i < sop_disc->svid_count; i++) { + if (sop_disc->svids[i].mode_count > ARRAY_SIZE(sop_disc->svids[i].mode_vdo)) { + ret = -EINVAL; + goto err_cleanup; + } + for (j = 0; j < sop_disc->svids[i].mode_count; j++) { memset(&desc, 0, sizeof(desc)); desc.svid = sop_disc->svids[i].svid; |