* [PATCH] usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
@ 2024-11-04 17:16 Dan Carpenter
2024-11-05 9:32 ` Heikki Krogerus
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2024-11-04 17:16 UTC (permalink / raw)
To: Ajay Gupta
Cc: Heikki Krogerus, Greg Kroah-Hartman, Dmitry Baryshkov,
Uwe Kleine-König, Haotien Hsu, linux-usb, linux-kernel,
kernel-janitors
The "*cmd" variable can be controlled by the user via debugfs. That means
"new_cam" can be as high as 255 while the size of the uc->updated[] array
is UCSI_MAX_ALTMODES (30).
The call tree is:
ucsi_cmd() // val comes from simple_attr_write_xsigned()
-> ucsi_send_command()
-> ucsi_send_command_common()
-> ucsi_run_command() // calls ucsi->ops->sync_control()
-> ucsi_ccg_sync_control()
Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/usb/typec/ucsi/ucsi_ccg.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index ba58d11907bc..bccfc03b5986 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -482,6 +482,8 @@ static void ucsi_ccg_update_set_new_cam_cmd(struct ucsi_ccg *uc,
port = uc->orig;
new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd);
+ if (new_cam >= ARRAY_SIZE(uc->updated))
+ return;
new_port = &uc->updated[new_cam];
cam = new_port->linked_idx;
enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd);
--
2.45.2
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: [PATCH] usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
2024-11-04 17:16 [PATCH] usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() Dan Carpenter
@ 2024-11-05 9:32 ` Heikki Krogerus
0 siblings, 0 replies; 2+ messages in thread
From: Heikki Krogerus @ 2024-11-05 9:32 UTC (permalink / raw)
To: Dan Carpenter
Cc: Ajay Gupta, Greg Kroah-Hartman, Dmitry Baryshkov,
Uwe Kleine-König, Haotien Hsu, linux-usb, linux-kernel,
kernel-janitors
On Mon, Nov 04, 2024 at 08:16:42PM +0300, Dan Carpenter wrote:
> The "*cmd" variable can be controlled by the user via debugfs. That means
> "new_cam" can be as high as 255 while the size of the uc->updated[] array
> is UCSI_MAX_ALTMODES (30).
>
> The call tree is:
> ucsi_cmd() // val comes from simple_attr_write_xsigned()
> -> ucsi_send_command()
> -> ucsi_send_command_common()
> -> ucsi_run_command() // calls ucsi->ops->sync_control()
> -> ucsi_ccg_sync_control()
>
> Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> ---
> drivers/usb/typec/ucsi/ucsi_ccg.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
> index ba58d11907bc..bccfc03b5986 100644
> --- a/drivers/usb/typec/ucsi/ucsi_ccg.c
> +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
> @@ -482,6 +482,8 @@ static void ucsi_ccg_update_set_new_cam_cmd(struct ucsi_ccg *uc,
>
> port = uc->orig;
> new_cam = UCSI_SET_NEW_CAM_GET_AM(*cmd);
> + if (new_cam >= ARRAY_SIZE(uc->updated))
> + return;
> new_port = &uc->updated[new_cam];
> cam = new_port->linked_idx;
> enter_new_mode = UCSI_SET_NEW_CAM_ENTER(*cmd);
> --
> 2.45.2
--
heikki
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2024-11-05 9:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-11-04 17:16 [PATCH] usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() Dan Carpenter
2024-11-05 9:32 ` Heikki Krogerus
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®