From 317e7abcaf60b79765dcf35c014edac8b9d37a6e Mon Sep 17 00:00:00 2001 From: Bartosz Szpila Date: Thu, 1 Oct 2026 08:57:13 +0000 Subject: platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data cros_typec_register_altmodes() iterates over sop_disc->svid_count and sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response without validating their bounds. port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC returns an out-of-bounds svid_count or mode_count, the loops read past the end of the mode_vdo array or the disc_data buffer. Validate that the discovery response with svid_count entries fits within EC_PROTO2_MAX_RESPONSE_SIZE using struct_size(), and ensure each SVID's mode_count does not exceed ARRAY_SIZE(sop_disc->svids[i].mode_vdo) before registering altmodes. Fixes: de0f49487db3 ("platform/chrome: cros_ec_typec: Register partner altmodes") Signed-off-by: Bartosz Szpila Reviewed-by: Andrei Kuchynski Link: https://lore.kernel.org/r/20261001085714.1086242-1-bszpila@google.com Signed-off-by: Tzung-Bi Shih --- drivers/platform/chrome/cros_ec_typec.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c index 50a68819ceb7..4427897eb3f5 100644 --- a/drivers/platform/chrome/cros_ec_typec.c +++ b/drivers/platform/chrome/cros_ec_typec.c @@ -7,8 +7,10 @@ */ #include +#include #include #include +#include #include #include #include @@ -894,7 +896,15 @@ static int cros_typec_register_altmodes(struct cros_typec_data *typec, int port_ int ret = 0; int i, j; + if (struct_size(sop_disc, svids, sop_disc->svid_count) > EC_PROTO2_MAX_RESPONSE_SIZE) + return -EINVAL; + for (i = 0; i < sop_disc->svid_count; i++) { + if (sop_disc->svids[i].mode_count > ARRAY_SIZE(sop_disc->svids[i].mode_vdo)) { + ret = -EINVAL; + goto err_cleanup; + } + for (j = 0; j < sop_disc->svids[i].mode_count; j++) { memset(&desc, 0, sizeof(desc)); desc.svid = sop_disc->svids[i].svid; -- cgit v1.2.3