ljca_gpio_event_cb() ignores the event length and trusts packet->num as
the number of two-byte GPIO records. A device can provide a complete USB
message whose nested count extends beyond the payload, making the callback
read beyond the receive allocation.

Require the payload to contain both the count byte and every record it
declares before iterating over the flexible array.

Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
Assisted-by: Codex:gpt-5.5
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
 drivers/gpio/gpio-ljca.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
index f32d1d237795..cb2b2623ccb1 100644
--- a/drivers/gpio/gpio-ljca.c
+++ b/drivers/gpio/gpio-ljca.c
@@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
 
 	if (cmd != LJCA_GPIO_INT_EVENT)
 		return;
+	if (len < sizeof(*packet) ||
+	    struct_size(packet, item, packet->num) > len)
+		return;
 
 	for (i = 0; i < packet->num; i++) {
 		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,
-- 
2.43.0

On Fri, 17 Jul 2026 16:58:26 +0200, David Lee <david.lee@trailofbits.com> said:
> ljca_gpio_event_cb() ignores the event length and trusts packet->num as
> the number of two-byte GPIO records. A device can provide a complete USB
> message whose nested count extends beyond the payload, making the callback
> read beyond the receive allocation.
>
> Require the payload to contain both the count byte and every record it
> declares before iterating over the flexible array.
>
> Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> ---
>  drivers/gpio/gpio-ljca.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
> index f32d1d237795..cb2b2623ccb1 100644
> --- a/drivers/gpio/gpio-ljca.c
> +++ b/drivers/gpio/gpio-ljca.c
> @@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
>
>  	if (cmd != LJCA_GPIO_INT_EVENT)
>  		return;
> +	if (len < sizeof(*packet) ||
> +	    struct_size(packet, item, packet->num) > len)
> +		return;
>
>  	for (i = 0; i < packet->num; i++) {
>  		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,
> --
> 2.43.0
>
>

There are two separate v1 of this, I'm confused.

Bart

>-----Original Message-----
>From: David Lee <david.lee@trailofbits.com>
>Sent: Friday, July 17, 2026 10:58 PM
>To: Zhang, Lixu <lixu.zhang@intel.com>
>Cc: David Lee <david.lee@trailofbits.com>; Sakari Ailus
><sakari.ailus@linux.intel.com>; Linus Walleij <linusw@kernel.org>; Bartosz
>Golaszewski <brgl@kernel.org>; Dominik 'Disconnect3d' Czarnota
><dominik.czarnota@trailofbits.com>; linux-gpio@vger.kernel.org; linux-
>kernel@vger.kernel.org
>Subject: [PATCH] gpio: ljca: validate event payload length
>
>ljca_gpio_event_cb() ignores the event length and trusts packet->num as the
>number of two-byte GPIO records. A device can provide a complete USB message
>whose nested count extends beyond the payload, making the callback read
>beyond the receive allocation.
>
>Require the payload to contain both the count byte and every record it declares
>before iterating over the flexible array.
>
>Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
>Assisted-by: Codex:gpt-5.5
>Signed-off-by: David Lee <david.lee@trailofbits.com>

Reviewed-by: Zhang Lixu <lixu.zhang@intel.com>

>---