RE: [PATCH] gpio: ljca: validate event payload length

[Zhang, Lixu]

>-----Original Message-----
>From: David Lee <david.lee@xxxxxxxxxxxxxxx>
>Sent: Friday, July 17, 2026 10:58 PM
>To: Zhang, Lixu <lixu.zhang@xxxxxxxxx>
>Cc: David Lee <david.lee@xxxxxxxxxxxxxxx>; Sakari Ailus
><sakari.ailus@xxxxxxxxxxxxxxx>; Linus Walleij <linusw@xxxxxxxxxx>; Bartosz
>Golaszewski <brgl@xxxxxxxxxx>; Dominik 'Disconnect3d' Czarnota
><dominik.czarnota@xxxxxxxxxxxxxxx>; linux-gpio@xxxxxxxxxxxxxxx; linux-
>kernel@xxxxxxxxxxxxxxx
>Subject: [PATCH] gpio: ljca: validate event payload length
>
>ljca_gpio_event_cb() ignores the event length and trusts packet->num as the
>number of two-byte GPIO records. A device can provide a complete USB message
>whose nested count extends beyond the payload, making the callback read
>beyond the receive allocation.
>
>Require the payload to contain both the count byte and every record it declares
>before iterating over the flexible array.
>
>Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
>Assisted-by: Codex:gpt-5.5
>Signed-off-by: David Lee <david.lee@xxxxxxxxxxxxxxx>

Reviewed-by: Zhang Lixu <lixu.zhang@xxxxxxxxx>

>---