From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f44.google.com (mail-pj1-f44.google.com [209.85.216.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8C1B22F39B5 for ; Thu, 18 Jun 2026 06:19:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781763594; cv=none; b=VUbAIAVMs8K0vEG7LLmUAcA0Qbefy15xpldO2cXgalbyPonMKANTUptzGSwL+9cffdQgyb00A/uQoLKS3h+Vcbo6Dwp61cT0ngDIWcU4qLAnD1RaGUR1aU3qhdPWM07vhqTwocz4Ioh6Wic5lIxJfUuW1TILkDL4gbfCAlbrOu4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781763594; c=relaxed/simple; bh=MR2Nm1LmUc4dhFtlCkfzDS2422dNtrlpxROFYdYilic=; h=From:To:Cc:Subject:Date:Message-ID:Content-Type:MIME-Version; b=J7+0HQQUgHR+0wRwqmaDGv+ceahfESTy9rJIhYs1YXyIUnwDewZ5g2qVk0Oygw9XEYD0ND5c/cUp5YWuN6f+sOWzyDCNBsfUq2uHQjE1O48ZC+H27esHK3o/jt7fl2ybZHQSgB0fKKwd0OaCVGzRLMSNB8oSW61PCis8iS1WW3A= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QiSwLRLn; arc=none smtp.client-ip=209.85.216.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QiSwLRLn" Received: by mail-pj1-f44.google.com with SMTP id 98e67ed59e1d1-36b8d414666so248313a91.3 for ; Wed, 17 Jun 2026 23:19:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781763593; x=1782368393; darn=vger.kernel.org; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=ScOr+/vdrOb5bFKQDTI3ANdSYyfxyJ58Srz3IQTKWsw=; b=QiSwLRLn51EdAxG1FHzi81jsXF1Be0OpyGVsZfpcOqA16NSi1zHzK5HdaHXxpwegnr K6wlFc2Dr4UlcHlwvZ6o+Oay7o0vqDxqPsVMcb/mLx/iNTqmu5v97NCrR2fxcObfalr/ Vlgdj8F58j5MHSdk3+UbTCnLa5weYgXb+fBzzfLXkrMB6Jx+ETMFN95bfjh/0p3vzaG/ HW60zdtXsRWU2i28QnhDZCToLvcj1VosItsrSBE1Io6k52WdoovKycpIJHT7LUxZbXYl skDH8E66BpoZqdTNBO0yjz8QF6vTrhMusAJgOj/a9LXAr9oRTm7OQ4gZN/1w11Xr4j3H 6WzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781763593; x=1782368393; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ScOr+/vdrOb5bFKQDTI3ANdSYyfxyJ58Srz3IQTKWsw=; b=RGDPthgfKan3IeIQQrW5e3onNzulYCC5YKBgijgY/3m0gDEUHAgZ11vusbrSldEt2h wJfutoVELsu6E3XrJRalxoMGEhza/uQAjdDI1dWhMO3ieTp4w21czcJjNFO2nRUZ3IUp zXkk9wa3ojyDYmUfryjAZ6KQb3Cuxw1uk16zdUJfr1MElbcGasUPL2rcr0l2cAB18W1m GaHPnciStjcZSPMaaEkKUMSCwzmyp1gHU9eJuuwfXeVxeQJMvQl5eBS1r+CZSo7M6obv 9SUAAHoVy04fNhmNa7l48r3SQ8nhpVv1e81wLWBWW18qRj9BLdItE+mFyfN8ajtiVKys p4lA== X-Forwarded-Encrypted: i=1; AFNElJ+EUQBQnp20wb9fT8oyLIyi8gJFI/X6WdXRrF7wzcncy/LlXBPdAlnRj3ov1KRg4aDiljM/GT1ML6Rli9w=@vger.kernel.org X-Gm-Message-State: AOJu0Yx2m4HOAy0cg7h5T7t8LKQ6ZYjmBJhqupNu/MPR25OxxkR9uXSe k3Lapg722n3waUMiHSwlVgHwAdharWuU4dxfMIVArq0241MgZ2uvp79bRewiEg== X-Gm-Gg: AfdE7ckvJ1RSnnVG66ZduX2kpoJ2bRBfHFMUorx6M5D98gs/terA+0jElskxoHF5EfL s0goQHAYSdsqxuD04w4ML1vjJAeJV0YS4XxZhHrx4f/2Yd6C/pRG0C/nV33TgsSvpQTwBTSL3eI 6+zoL7olQ6xMIhOQ4tefVY3+XrCK4uS9l4wYl5wXiuE5Mq1Pxg952fQco7J93GytnDbcPwMmgD4 TwOUNC/TCNVoprOUZfU6ghesy+aU3Hpd12gna3Ev0bx5kPqZbVhx0cFIeFQLqrmxgkuXWbnxIP9 2VAw6L1zzsI8NcBRVf/VSTFOOPCxbQrH8/z2YbH+wXxTQXvY9QFSWO4RIrs4H8U3GJtTCSYM+3g ljRpYDRMKs7UpK68TaITe9/U8gvu78QbQ7nkANmQIqWht5R35dE3H1BEeUif0virZxvim3+CPvK +o2p+Tw9q+JeY5mw7FeWLXeFWI22FN2iYpF7PVSw== X-Received: by 2002:a17:90b:3a0c:b0:37c:543f:b83 with SMTP id 98e67ed59e1d1-37ce857afd6mr1402234a91.4.1781763592872; Wed, 17 Jun 2026 23:19:52 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-37c521ae7d1sm7653752a91.3.2026.06.17.23.19.50 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Jun 2026 23:19:52 -0700 (PDT) From: Maoyi Xie To: Lixu Zhang , Sakari Ailus Cc: Greg Kroah-Hartman , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] usb: ljca: bound bank_num in ljca_enumerate_gpio() Date: Thu, 18 Jun 2026 14:19:48 +0800 Message-ID: <178176358875.3352358.6059116660356914900@maoyixie.com> Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 ljca_enumerate_gpio() reads desc->bank_num from the device and loops valid_pin[i] = get_unaligned_le32(...) for i < bank_num. valid_pin[] holds only LJCA_MAX_GPIO_NUM / 32 = 2 entries. Two checks run before the loop. The reply length must match struct_size(desc, bank_desc, bank_num). The product pins_per_bank * bank_num must not exceed LJCA_MAX_GPIO_NUM. Neither one bounds bank_num against the size of valid_pin[]. The reply is capped at LJCA_MAX_PAYLOAD_SIZE (60) bytes, so the struct_size check limits bank_num to 9. A device that reports bank_num 9 with pins_per_bank 7 still passes both checks. gpio_num is 63 and the reply is 56 bytes. The loop then writes nine u32 into the two entry array and overruns valid_pin[] on the stack. A broken or malicious LJCA device can therefore overflow the stack. Reject a bank_num that does not fit valid_pin[]. Fixes: acd6199f195d ("usb: Add support for Intel LJCA device") Cc: stable@vger.kernel.org Signed-off-by: Maoyi Xie --- drivers/usb/misc/usb-ljca.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/usb/misc/usb-ljca.c b/drivers/usb/misc/usb-ljca.c index c60121faa3da..a1876c05b7c2 100644 --- a/drivers/usb/misc/usb-ljca.c +++ b/drivers/usb/misc/usb-ljca.c @@ -596,6 +596,9 @@ static int ljca_enumerate_gpio(struct ljca_adapter *adap) if (gpio_num > LJCA_MAX_GPIO_NUM) return -EINVAL; + if (desc->bank_num > ARRAY_SIZE(valid_pin)) + return -EINVAL; + /* construct platform data */ gpio_info = kzalloc_obj(*gpio_info); if (!gpio_info) -- 2.34.1