[PATCH] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data

[PATCH] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data

[Bartosz Szpila]

cros_typec_register_altmodes() iterates over sop_disc->svid_count and
sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response
without validating their bounds.

port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE
bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC
returns an out-of-bounds svid_count or mode_count, the loops read past
the end of the mode_vdo array or the disc_data buffer.

Validate that the discovery response with svid_count entries fits within
EC_PROTO2_MAX_RESPONSE_SIZE using struct_size(), and ensure each SVID's
mode_count does not exceed ARRAY_SIZE(sop_disc->svids[i].mode_vdo)
before registering altmodes.

Signed-off-by: Bartosz Szpila <bszpila@google.com>
---
 drivers/platform/chrome/cros_ec_typec.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c
index 50a68819ceb7..4427897eb3f5 100644
--- a/drivers/platform/chrome/cros_ec_typec.c
+++ b/drivers/platform/chrome/cros_ec_typec.c
@@ -7,8 +7,10 @@
  */
 
 #include <linux/acpi.h>
+#include <linux/array_size.h>
 #include <linux/module.h>
 #include <linux/of.h>
+#include <linux/overflow.h>
 #include <linux/platform_data/cros_ec_commands.h>
 #include <linux/platform_data/cros_usbpd_notify.h>
 #include <linux/platform_device.h>
@@ -894,7 +896,15 @@ static int cros_typec_register_altmodes(struct cros_typec_data *typec, int port_
 	int ret = 0;
 	int i, j;
 
+	if (struct_size(sop_disc, svids, sop_disc->svid_count) > EC_PROTO2_MAX_RESPONSE_SIZE)
+		return -EINVAL;
+
 	for (i = 0; i < sop_disc->svid_count; i++) {
+		if (sop_disc->svids[i].mode_count > ARRAY_SIZE(sop_disc->svids[i].mode_vdo)) {
+			ret = -EINVAL;
+			goto err_cleanup;
+		}
+
 		for (j = 0; j < sop_disc->svids[i].mode_count; j++) {
 			memset(&desc, 0, sizeof(desc));
 			desc.svid = sop_disc->svids[i].svid;
-- 
2.56.0.rc1.315.gc6ed9934b7-goog

Re: [PATCH] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data

[Andrei Kuchynski]

On Thu, Oct 1, 2026 at 8:58 AM Bartosz Szpila <bszpila@google.com> wrote:
>
> cros_typec_register_altmodes() iterates over sop_disc->svid_count and
> sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response
> without validating their bounds.
>
> port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE
> bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC
> returns an out-of-bounds svid_count or mode_count, the loops read past
> the end of the mode_vdo array or the disc_data buffer.
>
> Validate that the discovery response with svid_count entries fits within
> EC_PROTO2_MAX_RESPONSE_SIZE using struct_size(), and ensure each SVID's
> mode_count does not exceed ARRAY_SIZE(sop_disc->svids[i].mode_vdo)
> before registering altmodes.
>
> Signed-off-by: Bartosz Szpila <bszpila@google.com>

Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>

> ---
>  drivers/platform/chrome/cros_ec_typec.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c
> index 50a68819ceb7..4427897eb3f5 100644
> --- a/drivers/platform/chrome/cros_ec_typec.c
> +++ b/drivers/platform/chrome/cros_ec_typec.c
> @@ -7,8 +7,10 @@
>   */
>
>  #include <linux/acpi.h>
> +#include <linux/array_size.h>
>  #include <linux/module.h>
>  #include <linux/of.h>
> +#include <linux/overflow.h>
>  #include <linux/platform_data/cros_ec_commands.h>
>  #include <linux/platform_data/cros_usbpd_notify.h>
>  #include <linux/platform_device.h>
> @@ -894,7 +896,15 @@ static int cros_typec_register_altmodes(struct cros_typec_data *typec, int port_
>         int ret = 0;
>         int i, j;
>
> +       if (struct_size(sop_disc, svids, sop_disc->svid_count) > EC_PROTO2_MAX_RESPONSE_SIZE)
> +               return -EINVAL;
> +
>         for (i = 0; i < sop_disc->svid_count; i++) {
> +               if (sop_disc->svids[i].mode_count > ARRAY_SIZE(sop_disc->svids[i].mode_vdo)) {
> +                       ret = -EINVAL;
> +                       goto err_cleanup;
> +               }
> +
>                 for (j = 0; j < sop_disc->svids[i].mode_count; j++) {
>                         memset(&desc, 0, sizeof(desc));
>                         desc.svid = sop_disc->svids[i].svid;
> --
> 2.56.0.rc1.315.gc6ed9934b7-goog
>

Re: [PATCH] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data

[Tzung-Bi Shih]

On Thu, Oct 01, 2026 at 08:57:13AM +0000, Bartosz Szpila wrote:
> cros_typec_register_altmodes() iterates over sop_disc->svid_count and
> sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response
> without validating their bounds.
> 
> port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE
> bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC
> returns an out-of-bounds svid_count or mode_count, the loops read past
> the end of the mode_vdo array or the disc_data buffer.
> 
> [...]

Applied to

    https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next

[1/1] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data
      commit: 317e7abcaf60b79765dcf35c014edac8b9d37a6e

Thanks!