From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D51BA1A9F88 for ; Thu, 25 Jun 2026 13:01:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782392466; cv=none; b=YghWz1d0ZwjUmv1CaQCPDT1FxhuzI2jdRnmvZtQZ706ZZMt2M31+fc8Zkxp2/h1EzwV9j1Gs4Z2XVV86TB5Ay/e5DGoA3SGjj2rIwTSZTH8ET94IvsLEdTNFnieHuiIJBMrGuXuMEO3pxBaBuL9bMdN+TeZfurciKVmkjfVJzrM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782392466; c=relaxed/simple; bh=1DoHU2Y2T/dGE4r5M5PYq6CElw0caXU9dLez6zNboDc=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=D6jdFMdrgiH9IrPCMSV47qz5+zA0mOPLAPVUvDHNdbtmAQSU299NzvmpQDKLlM/nPt0/BUWVvTFVNsmX0rcRDGITErrBC1vjUNJCkgbbJwobNkgMQDagq1BCqZs1RhMVUlgK+NYxDSVJrxzl8hhhBp+Dr4hHay+dgxNKld2cB60= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=lazUiCuu; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="lazUiCuu" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-37de8008910so1038165a91.0 for ; Thu, 25 Jun 2026 06:01:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782392464; x=1782997264; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=pQ81Cocrtw2dDH5NGikw9uURRBGajDc7MNQcdofYB2U=; b=lazUiCuuGV04G25qyVfiFk5Ru8cHhgrdQunzzKrvKD92HXIEsEPQ+O1I2E56kUxPo/ k1GrMiE7GrowzVp8g+9EtcGdodL20xebLmMR6Em49juyhu+SFMXFTpKcwhPtllQJMAS9 heKRqnSKvN066NWNHJF6YFeRmvIraxuAU5b7a7x/rL6XqXZik8pwGa5NjjGhavASBRo/ ws7UNEEE841pW7dvtHxkDaCxIhH/dD64DEuudEixefQNuM9kTO1+M8DBlOUFXwn3hc33 54korJ9k01AWc1Np5q/iGfBBCG4LkaAcZPxYUdl8fJjdQTsI2d9Qq4WCrlXtKkRknbTa qmAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782392464; x=1782997264; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=pQ81Cocrtw2dDH5NGikw9uURRBGajDc7MNQcdofYB2U=; b=bMRbb4DwusyQ13ahTro1yi91DXXJImAbdrX0b0Q7P2Sn0wwGQssNRQ75EsQHpVr6Ai au3ZCoLFZo+YicwM4IJqQYbIL0Btu2E9Ec0L+N/tTzsl2ybakDKg/wqcJPi+0dDfnIFq KU3WXmDXzzpfD/lc7v+dwtwWEgnLnD0H3uvQKE2zlPO8kXqUD4K/bbIIKAxWXJZs+ewT 2YmSSFrh1TFOobUHFnamEuNbVdki719URXSF33sAkrYoa0NTGfefqKkHt122QywFXXdv oTo2SOwXFb/X39zy/w4U4eYDaxcHeDDncRAHwKD6BjVnxhiLPdw83hBzVJ7C2/KIeXFN 4U+A== X-Forwarded-Encrypted: i=1; AHgh+RovQDN6WVHWpCEblshV1Ab+Ir0KYjc2bHn24kgUQtzWVBmGnXczVRwWiQ7Oqy6QMSqH5g9pM5/Fm54D5LI=@vger.kernel.org X-Gm-Message-State: AOJu0YykUOUk0z3wgBSbiVSv3j/YkQhJt07J9Ms6FpD4Vyjq6nskde1X ERnUNFBr9rEVlIyQdJ/WPB5sHBot/cVCSOOGmfm1ai3wYT3QG1IO61P8 X-Gm-Gg: AfdE7ckDLSOz7bGGj0jevb26U39ht9MG38tjazRNNCwPurmrewIfTGgNJi5RP/AZo26 0Rr/zEDp89FZtYMI2EJ7fMFh7kH+8OV8HeS+zmc8tyxDX0fsZMlLT0Nbr65ABX8RzvPGXFldoAU /v4wjOh0KrkopUHr6uRPgrqGZZayCZLJYtRqDCQQgIy4r/H0C1QGL7KS8fIi55oKftO0q5YBv65 lLCrvHbINzax0MXmyKLdJZiylEBhO7u6JueoaqX/Y+fcj+lhdKNYnG8+FTjyZa0aup1u7KLhu6G f3txhmGikG2KtijpxMSnw2Ta6Y/EQN87yH4yVQ08+KTHVeFIT7OPR8mQ+LJVEjuIR33+2M67l6k hlmSpqDl9/SAZNyKWDJFyHBJXlrG6mkMzPSq+8utm7We/dSt5T/R/8WRWsKzrXlPosI8eL9hcI0 1MQ1aZr/9vmAduZyjVZC8EUn6MQmWfQ8waccS9BgTcLAgJKkIQ X-Received: by 2002:a17:90a:d005:b0:37d:f6d8:b50e with SMTP id 98e67ed59e1d1-37df9f5a4f3mr2454393a91.9.1782392463741; Thu, 25 Jun 2026 06:01:03 -0700 (PDT) Received: from csl-conti-dell7858.ntu.edu.sg ([155.69.195.57]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-c92bd556e39sm1654223a12.32.2026.06.25.06.01.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 25 Jun 2026 06:01:03 -0700 (PDT) From: Maoyi Xie To: Benson Leung , Tzung-Bi Shih , Abhishek Pandit-Subedi , Jameson Thies , Andrei Kuchynski , Guenter Roeck Cc: Maoyi Xie , Kaixuan Li , chrome-platform@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH v2] platform/chrome: cros_ec_typec: reject out-of-bounds PD cap count Date: Thu, 25 Jun 2026 21:00:56 +0800 Message-Id: <20260625130056.3378097-1-maoyixie.tju@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit cros_typec_register_partner_pdos() copies the partner PDOs from the EC TYPEC_STATUS response into the fixed caps_desc.pdo[PDO_MAX_OBJECTS] array. memcpy(caps_desc.pdo, resp->source_cap_pdos, sizeof(u32) * resp->source_cap_count); ... memcpy(caps_desc.pdo, resp->sink_cap_pdos, sizeof(u32) * resp->sink_cap_count); PDO_MAX_OBJECTS is 7. source_cap_count and sink_cap_count are u8 fields from the EC. The only check is that they are not both zero. If either is larger than 7, the memcpy writes past the end of the array on the stack. A count of 255 overflows it by about 1 KB. The EC source arrays are only seven entries wide. A larger count reads past them too. The ChromeOS EC firmware caps these counts today, so a compliant setup does not hit this. The kernel should still validate these values rather than trust them. Validate the counts in cros_typec_register_partner_pdos() next to the memcpy. Skip the PDO registration if either count is above PDO_MAX_OBJECTS. The rest of cros_typec_handle_status() still runs so events are handled and cleared. Fixes: 348a2e8c93d3 ("platform/chrome: cros_ec_typec: Register partner PDOs") Suggested-by: Tzung-Bi Shih Suggested-by: Andrei Kuchynski Co-developed-by: Kaixuan Li Signed-off-by: Kaixuan Li Signed-off-by: Maoyi Xie --- v2: Move the check into cros_typec_register_partner_pdos() next to the memcpy it guards. v1 put it at the top of cros_typec_handle_status() and returned early. That skipped the rest of the status handling and left events uncleared. v1: https://lore.kernel.org/r/178229037114.3009621.14045345257767446805@maoyixie.com drivers/platform/chrome/cros_ec_typec.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c index c0806c562bb9..50a68819ceb7 100644 --- a/drivers/platform/chrome/cros_ec_typec.c +++ b/drivers/platform/chrome/cros_ec_typec.c @@ -1119,6 +1119,12 @@ static void cros_typec_register_partner_pdos(struct cros_typec_data *typec, if (!resp->source_cap_count && !resp->sink_cap_count) return; + if (resp->source_cap_count > PDO_MAX_OBJECTS || + resp->sink_cap_count > PDO_MAX_OBJECTS) { + dev_warn(typec->dev, "Invalid PDO count from EC, port: %d\n", port_num); + return; + } + port->partner_pd = typec_partner_usb_power_delivery_register(port->partner, &desc); if (IS_ERR(port->partner_pd)) { dev_warn(typec->dev, "Failed to register partner PD device, port: %d\n", port_num);