From nobody Sat Jul 25 03:20:02 2026 Received: from mail-qt1-f181.google.com (mail-qt1-f181.google.com [209.85.160.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4380C3ACF1D for ; Mon, 20 Jul 2026 05:49:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.181 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784526555; cv=none; b=pPjQF2euTFwUkfY+oNUJtV7x3WdUFJYNgoI/uRPUl+w+EGKoCfCTJq9sLdV3oWp5cmoa9QUuEXAdYNUsA71ZRHdCC0LwFru80uPXG/ZJMsITzMD41T3rNKUVrOp+gG5B5acl518csiA93zgBnQPLuygFqMDXQ+aaw4oA5/aJTA4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784526555; c=relaxed/simple; bh=06aTGYdDhkRl6c2UiNUp2s5FUz2ScU73smKKx2loXSM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Z8GMuyZGi80+NRBZ+RDi1r4wNKYP/R0mJVOkLo1b/4J7E/xIq9ZgDSk64MpAmrr2G9jYLyOzMbhGc3jHx3GI5RUC+UwS8WAM0VItUglIfl3gXYJOUtku+1y23QcfZIDn2SOvwUCXOIApd4SJBixGyComntLeiCwOWBcG8xNTokU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com; spf=pass smtp.mailfrom=trailofbits.com; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b=Q46NY+PO; arc=none smtp.client-ip=209.85.160.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=trailofbits.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=trailofbits.com header.i=@trailofbits.com header.b="Q46NY+PO" Received: by mail-qt1-f181.google.com with SMTP id d75a77b69052e-51c5382806fso54013431cf.2 for ; Sun, 19 Jul 2026 22:49:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=trailofbits.com; s=google; t=1784526547; x=1785131347; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=kif501Ot1YS2Lrv6j6eKox/KCdIXCI2kxtcLKxuRjK0=; b=Q46NY+POpM+FGcU9hqqOFlM9P9OZHe8e9UWcD13XKSVB+f6AjETfobLyrJe92DKDW7 AM2tGwu941UQygbKUSJGChvE+0b1OKD06yooeuy/PpK1gWozOUxf/HVstUrbiii0TskN 0LiuWRwxpUTe4zDewQZG1Z1kQk+q3Jx1mue3uJAV25azUoWGiDxB9XX90oVekD5Sv2iE yc10+naLUDuQCmP5XHSolCV/J8A9LPzdsvPA/HG4tncfe2gsSrooVS86rGboBXRE0Xz1 qcy/Auxzfs2EDy61xhfiAL6iUYbw/Ewn7YmEQRv0u1zrqZot2g4soZ6WW7Fs+pOrrtjM QePw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784526547; x=1785131347; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kif501Ot1YS2Lrv6j6eKox/KCdIXCI2kxtcLKxuRjK0=; b=Lp1sYITWVk/OrFgxOsbH4mF3AycND3FeSj2mlTS2ObPjNkGNrJUt/984kX47FjmIPv cDX3X80k1eqcZPRzjJZa3RMeOzcSXkP+OtNdrqPo45Fbvhsz8jLx6zTPlBMOqNRfiy1U TKN7aK1i3QGzoTtytaMuB5enh9hro1ER85fVrQ3/JCBSgSngjLx7hWBHkYj3yIuUJ05k x4OLFPM/Vs6yCDGfYFZE8HL4V+qqg7ES73RzhzccsCG265xK6i+MvliyVao+RWGP1lme KWk440Dfk71SLZkYHA01gpnn1Ut0k0SKHe7igN+ZVa07nxHCuVJNnIHGSRImK4YML//z N8IA== X-Forwarded-Encrypted: i=1; AHgh+RqNxOAp/lo7TQdJh+z1nmZ8cNE2ZMawBDVzSNRgb5E+9Q5wr+JNcLnERc6cR6JcTFvAvzx7t4gn62fpsgc=@vger.kernel.org X-Gm-Message-State: AOJu0Yyf7Sv32rLUXALAqv/RJsYI9twMm53TX+RgmOd6yO1sgZaM/AI7 b6lYgSzgYobX6H1CBQeXhqMjCzaAikEja7nswb4vkvxCdttH5uIoozEf657ANbr/tM8hpm8dtOO 1Kuww X-Gm-Gg: AfdE7ckWZY/rYC4wwi0agpmtLMenoeSMmA7sI4F1Q5fpqrs7nonqySp0es9fV2Xjj+u 8nER4qslbxoWwIQUWJ37yF8aSD+2eV61qgxDc+dmsIPv0OAq5ckHA5q4gG8+B8Ypx0isQQY0gyb 3obDikukUm9z53SPhGAUy63d00gFTRyt9UtoyMYMEQMav7M6YyOkosMyEFTO6CWj2H3nqpvfBvR sniWYzVD8GxNQi1xlqd4fLYqtxYN2ONtY44H4C1da6CsFtAW00WOmq+1XrUjo7iEe2OvTMYn2ud iH58S1OPDV/LsFToZcOu4jwDMz8wfvXM5pP4sHmDAilRd1lQoUUf+MZji/hI/O3UhriOTJ2xt+A ZRv61JQI0QYkJm4XA2HKSGFCC5yMRfqf7scPb4HwW7AM3sQT8fl822Eg8bWPeXsaZ9BOe5j1Zps Q1zGCZCUU= X-Received: by 2002:ac8:5aca:0:b0:51b:fd82:22dd with SMTP id d75a77b69052e-5213d2b6a4emr110458171cf.15.1784526547250; Sun, 19 Jul 2026 22:49:07 -0700 (PDT) Received: from localhost ([146.190.222.192]) by smtp.gmail.com with UTF8SMTPSA id d75a77b69052e-5214f0161e4sm65601511cf.14.2026.07.19.22.49.06 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 19 Jul 2026 22:49:07 -0700 (PDT) From: David Lee To: Lixu Zhang Cc: David Lee , Sakari Ailus , Linus Walleij , Bartosz Golaszewski , Dominik 'Disconnect3d' Czarnota , linux-gpio@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] gpio: ljca: validate event payload length Date: Mon, 20 Jul 2026 05:49:05 +0000 Message-ID: <20260720054906.69588-1-david.lee@trailofbits.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" ljca_gpio_event_cb() ignores the event length and trusts packet->num as the number of two-byte GPIO records. A device can provide a complete USB message whose nested count extends beyond the payload, making the callback read beyond the receive allocation. Require the payload to contain both the count byte and every record it declares before iterating over the flexible array. Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver") Assisted-by: Codex:gpt-5.5 Signed-off-by: David Lee --- drivers/gpio/gpio-ljca.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c index f32d1d237795..cb2b2623ccb1 100644 --- a/drivers/gpio/gpio-ljca.c +++ b/drivers/gpio/gpio-ljca.c @@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, c= onst void *evt_data, =20 if (cmd !=3D LJCA_GPIO_INT_EVENT) return; + if (len < sizeof(*packet) || + struct_size(packet, item, packet->num) > len) + return; =20 for (i =3D 0; i < packet->num; i++) { generic_handle_domain_irq(ljca_gpio->gc.irq.domain, --=20 2.43.0