Re: [PATCH] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data

[Andrei Kuchynski]

On Thu, Oct 1, 2026 at 8:58 AM Bartosz Szpila <bszpila@xxxxxxxxxx> wrote:
>
> cros_typec_register_altmodes() iterates over sop_disc->svid_count and
> sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response
> without validating their bounds.
>
> port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE
> bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC
> returns an out-of-bounds svid_count or mode_count, the loops read past
> the end of the mode_vdo array or the disc_data buffer.
>
> Validate that the discovery response with svid_count entries fits within
> EC_PROTO2_MAX_RESPONSE_SIZE using struct_size(), and ensure each SVID's
> mode_count does not exceed ARRAY_SIZE(sop_disc->svids[i].mode_vdo)
> before registering altmodes.
>
> Signed-off-by: Bartosz Szpila <bszpila@xxxxxxxxxx>

Reviewed-by: Andrei Kuchynski <akuchynski@xxxxxxxxxxxx>

> ---
>  drivers/platform/chrome/cros_ec_typec.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/drivers/platform/chrome/cros_ec_typec.c b/drivers/platform/chrome/cros_ec_typec.c
> index 50a68819ceb7..4427897eb3f5 100644
> --- a/drivers/platform/chrome/cros_ec_typec.c
> +++ b/drivers/platform/chrome/cros_ec_typec.c
> @@ -7,8 +7,10 @@
>   */
>
>  #include <linux/acpi.h>
> +#include <linux/array_size.h>
>  #include <linux/module.h>
>  #include <linux/of.h>
> +#include <linux/overflow.h>
>  #include <linux/platform_data/cros_ec_commands.h>
>  #include <linux/platform_data/cros_usbpd_notify.h>
>  #include <linux/platform_device.h>
> @@ -894,7 +896,15 @@ static int cros_typec_register_altmodes(struct cros_typec_data *typec, int port_
>         int ret = 0;
>         int i, j;
>
> +       if (struct_size(sop_disc, svids, sop_disc->svid_count) > EC_PROTO2_MAX_RESPONSE_SIZE)
> +               return -EINVAL;
> +
>         for (i = 0; i < sop_disc->svid_count; i++) {
> +               if (sop_disc->svids[i].mode_count > ARRAY_SIZE(sop_disc->svids[i].mode_vdo)) {
> +                       ret = -EINVAL;
> +                       goto err_cleanup;
> +               }
> +
>                 for (j = 0; j < sop_disc->svids[i].mode_count; j++) {
>                         memset(&desc, 0, sizeof(desc));
>                         desc.svid = sop_disc->svids[i].svid;
> --
> 2.56.0.rc1.315.gc6ed9934b7-goog
>