Re: [PATCH] greybus: cap: bound IMS/auth memcpy to ioctl size

[Greg KH]

On Fri, Sep 04, 2026 at 03:46:28AM +0000, Suraj Theekshana wrote:
> cap_get_ims_certificate() and cap_authenticate() derive copy
> lengths from response payload sizes without checking the response
> header size or destination capacity.

How was this found and tested?

And doesn't this info come from the hardware itself?  Is it not trusted
here?

> Reject responses smaller than their headers with -EMSGSIZE. Reject
> certificate and signature data larger than their fixed ioctl buffers
> with -E2BIG.
> 
> Signed-off-by: Suraj Theekshana <surajtheekshana1111@xxxxxxxxx>

Did you forget an Assisted-by: tag?

thanks,

greg k-h