ljca_gpio_event_cb() ignores the event length and trusts packet->num as
the number of two-byte GPIO records. A device can provide a complete USB
message whose nested count extends beyond the payload, making the callback
read beyond the receive allocation.

Require the payload to contain both the count byte and every record it
declares before iterating over the flexible array.

Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
Assisted-by: Codex:gpt-5.5
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
 drivers/gpio/gpio-ljca.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
index f32d1d237795..cb2b2623ccb1 100644
--- a/drivers/gpio/gpio-ljca.c
+++ b/drivers/gpio/gpio-ljca.c
@@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
 
 	if (cmd != LJCA_GPIO_INT_EVENT)
 		return;
+	if (len < sizeof(*packet) ||
+	    struct_size(packet, item, packet->num) > len)
+		return;
 
 	for (i = 0; i < packet->num; i++) {
 		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,
-- 
2.43.0

Hi David,

Thanks for the patch.

On Mon, Jul 20, 2026 at 05:49:05AM +0000, David Lee wrote:
> ljca_gpio_event_cb() ignores the event length and trusts packet->num as
> the number of two-byte GPIO records. A device can provide a complete USB
> message whose nested count extends beyond the payload, making the callback
> read beyond the receive allocation.
> 
> Require the payload to contain both the count byte and every record it
> declares before iterating over the flexible array.
> 
> Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> ---
>  drivers/gpio/gpio-ljca.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
> index f32d1d237795..cb2b2623ccb1 100644
> --- a/drivers/gpio/gpio-ljca.c
> +++ b/drivers/gpio/gpio-ljca.c
> @@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
>  
>  	if (cmd != LJCA_GPIO_INT_EVENT)
>  		return;
> +	if (len < sizeof(*packet) ||
> +	    struct_size(packet, item, packet->num) > len)
> +		return;

I think this case would require a warning message, maybe using
dev_warn_once().

>  
>  	for (i = 0; i < packet->num; i++) {
>  		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,

-- 
Regards,

Sakari Ailus