Re: [PATCH v1] greybus: authentication: validate CAP response payload size

[Greg KH]

On Mon, May 04, 2026 at 07:33:28PM -0400, Muhammad Bilal wrote:
> cap_get_ims_certificate() and cap_authenticate() copy variable-length
> response data directly into fixed-size UAPI buffers using the
> untrusted op->response->payload_size value without any bounds checks.
> 
> A malicious or compromised Greybus endpoint can return an oversized
> certificate or signature payload, causing a kernel heap overflow.
> 
> Fix both functions by:
>   - Rejecting responses shorter than sizeof(*response) with -EPROTO.
>   - Rejecting payloads exceeding CAP_CERTIFICATE_MAX_SIZE (1600) or
>     CAP_SIGNATURE_MAX_SIZE (320) with -EMSGSIZE.
>   - Copying only the validated size into the UAPI buffer.
> 
> Fixes: e3eda54d0b5f ("greybus: Add Component Authentication Protocol support")
> Signed-off-by: Muhammad Bilal <meatuni001@xxxxxxxxx>
> ---
>  drivers/staging/greybus/authentication.c | 34 +++++++++++++++++++++---
>  1 file changed, 30 insertions(+), 4 deletions(-)

Was this tested on any real greybus devices?

thanks,

greg k-h