From nobody Sat Jul 25 04:53:31 2026 Received: from mail-qt1-f180.google.com (mail-qt1-f180.google.com [209.85.160.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 46FFA3F99E6 for ; Fri, 17 Jul 2026 14:58:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.180 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784300314; cv=none; b=iuAhaG+UBjeOLIgCFbBiDSprpCJjzcYEgTTzJ217cIBjtvQEAoUbreFx+iEiLw7LMgpGGtwqubnLKXXVXtYUOtn/OoR5Ls7jaUjPhQYfcmGH6rgE02AmICeg0iR1ZGOaB9zQnwP+f+CfigYQF+GSgqd3a5DglZBDA10FRHOofMg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784300314; c=relaxed/simple; bh=06aTGYdDhkRl6c2UiNUp2s5FUz2ScU73smKKx2loXSM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=LbfUM5rbwS5JLSMwOCJFLUi2siJ4anHleaDSs3GPVIA8AXCT1TuRypwTj9W0mru8tZoUBVzxhifX9XwQejI2xTclUh8Ce1PyDYG3KkSasGfO+S6Z07D9Tyg0sIRRpZDMzKIAABOv6kIeiCw0FQfNQxTBmMMnSe7fsY0Z8gwMEM0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=AsoJ1daj; arc=none smtp.client-ip=209.85.160.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="AsoJ1daj" Received: by mail-qt1-f180.google.com with SMTP id d75a77b69052e-51c2808dbc3so50143511cf.1 for ; Fri, 17 Jul 2026 07:58:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1784300309; x=1784905109; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=kif501Ot1YS2Lrv6j6eKox/KCdIXCI2kxtcLKxuRjK0=; b=AsoJ1dajdLMZkeYqA2vopESMMArgfpHqJ9g6zWe3mC+lNDNt74TGEpTAPvUtAvBlHH E63UJjskenW/TDVWLXmq3Exh89ax7kI2gWDKgIW2KZL2+iyBhjkYEDrm59KQJQMAug0v nk3Oduqix3lV/KDWUaa61DPpNjsZ3S7MWNUrEvcSzQpYSX85OKlPomY2UrM2ilxylNMY bdgt4ftdAhIs8k3pVEUSrUbk1HFv262RiMt+aQyBi+eExaIkNsVS9ds24vWcfnws43T+ q3VT3vjdpTk2K8C6OXf4m8FWCH6QM7plaJ3CCQZsw6M36wpelFXjWaa5MFqbY08WCeJM PGkA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784300309; x=1784905109; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kif501Ot1YS2Lrv6j6eKox/KCdIXCI2kxtcLKxuRjK0=; b=fy4ByTN6s3D4V5V5fWuXQ4tz84q7t7iLKU1b+4KhRQI0LSy7XVNf1XJ/Ygb4gNHA30 qX5ctEZQfzfG45m3qc28XyWbzpyPTQUk/Jv32/QOce4TbcSemjsAw3ppSk70fm1T7JFI OYTLqTSWd42IXY8T+wvICV7/c/yVQEtTpm+IWkSJj3sTVCr1lVEWl5huJAZbJ3dyu0IQ 311ePuxWzvencLgQ4ld7LGtAjovI3HPyl3aR+2m1OZs/OkzlFGR3qlKk/Ga5IeBY++RI 7KsWcULrE7Jm95G3UgGvWMnKm+srPr6QIsf2YW76r0fTbSlz51xR7tXVJ/K7GlerMW18 LjEQ== X-Forwarded-Encrypted: i=1; AHgh+RpTEp/RAiHO6fm2MLtHN5YRznSjRn8143C/m56s97Eh77YU42n+Sw1L93qa0Ax6NtPBD/e0QWG0v7izf0s=@vger.kernel.org X-Gm-Message-State: AOJu0Ywo1mv9t+X6AmT0V0NE0YVl6bQF6r5bt4hvdGg8RHX+0DvuU+I3 hxDxmZCoTxdF2VGhIhK0pMhyZoG8jn9FvIe6Muc74MJpytuPK13vwVc785Yj2CZojpA= X-Gm-Gg: AfdE7clZ4wzQlnwcuqTwF0gw9ny64XWT7SzuPh0APBbLKDKjQX5TP4cLqsz9IDoWrl+ LgFFELfv2kXUuhvVisAiG9k5t11F6bmn9hPUo/U2JjFGmSGWR6z8HDmcE/KvWVLAoKAGRZbSNou TvLbiXJLn726i/WHbbVDxPNwuJvuW1B5N7t93X+6UXrrrC/xCjnPQYW2hUCSxb5MgI8bEQzg0tA K/vR0dA5nJnRwLBxmY/Fo8oTRBoemxhNJ24338oDN/+7TsJ6JYobnVDt8vnX8j+BnaFyfeV5arB yMtSuHiMLcHuNkKK0EdM99GffwCPsG5CXzSDWsBv4+9zIsI77k4cmmTPft60+vq0sqz9K46JNHN JDTzED4Ijfza8qbrVtEihuy3hhnCS4+TxkCvPcHdhqs9/q7+AsLqIBkARmZoaEwtTIHhTohId5R Kt/vyQ5ZI= X-Received: by 2002:ac8:5845:0:b0:51c:1529:2c0 with SMTP id d75a77b69052e-5213e28fc9fmr27128221cf.43.1784300309079; Fri, 17 Jul 2026 07:58:29 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id d75a77b69052e-5214c5cc8d5sm13995541cf.6.2026.07.17.07.58.28 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 17 Jul 2026 07:58:28 -0700 (PDT) From: David Lee To: Lixu Zhang Cc: David Lee , Sakari Ailus , Linus Walleij , Bartosz Golaszewski , Dominik 'Disconnect3d' Czarnota , linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] gpio: ljca: validate event payload length Date: Fri, 17 Jul 2026 14:58:26 +0000 Message-ID: <20260717145827.43889-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ljca_gpio_event_cb() ignores the event length and trusts packet->num as the number of two-byte GPIO records. A device can provide a complete USB message whose nested count extends beyond the payload, making the callback read beyond the receive allocation. Require the payload to contain both the count byte and every record it declares before iterating over the flexible array. Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver") Assisted-by: Codex:gpt-5.5 Signed-off-by: David Lee Reviewed-by: Zhang Lixu --- drivers/gpio/gpio-ljca.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c index f32d1d237795..cb2b2623ccb1 100644 --- a/drivers/gpio/gpio-ljca.c +++ b/drivers/gpio/gpio-ljca.c @@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, c= onst void *evt_data, =20 if (cmd !=3D LJCA_GPIO_INT_EVENT) return; + if (len < sizeof(*packet) || + struct_size(packet, item, packet->num) > len) + return; =20 for (i =3D 0; i < packet->num; i++) { generic_handle_domain_irq(ljca_gpio->gc.irq.domain, --=20 2.43.0