Re: [PATCH] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data

[Tzung-Bi Shih]

On Thu, Oct 01, 2026 at 08:57:13AM +0000, Bartosz Szpila wrote:
> cros_typec_register_altmodes() iterates over sop_disc->svid_count and
> sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response
> without validating their bounds.
> 
> port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE
> bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC
> returns an out-of-bounds svid_count or mode_count, the loops read past
> the end of the mode_vdo array or the disc_data buffer.
> 
> [...]

Applied to

    https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next

[1/1] platform/chrome: cros_ec_typec: Validate SVID and mode counts in discovery data
      commit: 317e7abcaf60b79765dcf35c014edac8b9d37a6e

Thanks!