]> Git Repo - linux.git/commit
usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()
authorDan Carpenter <[email protected]>
Mon, 4 Nov 2024 17:16:42 +0000 (20:16 +0300)
committerGreg Kroah-Hartman <[email protected]>
Tue, 5 Nov 2024 12:55:19 +0000 (13:55 +0100)
commit7dd08a0b4193087976db6b3ee7807de7e8316f96
tree151b54a3b2b977ceae394ff7f024aabb42b41650
parent9cfb31e4c89d200d8ab7cb1e0bb9e6e8d621ca0b
usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd()

The "*cmd" variable can be controlled by the user via debugfs.  That means
"new_cam" can be as high as 255 while the size of the uc->updated[] array
is UCSI_MAX_ALTMODES (30).

The call tree is:
ucsi_cmd() // val comes from simple_attr_write_xsigned()
-> ucsi_send_command()
   -> ucsi_send_command_common()
      -> ucsi_run_command() // calls ucsi->ops->sync_control()
         -> ucsi_ccg_sync_control()

Fixes: 170a6726d0e2 ("usb: typec: ucsi: add support for separate DP altmode devices")
Cc: stable <[email protected]>
Signed-off-by: Dan Carpenter <[email protected]>
Reviewed-by: Heikki Krogerus <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
drivers/usb/typec/ucsi/ucsi_ccg.c
This page took 0.050687 seconds and 4 git commands to generate.