From bae3a34cb9e6b3ce6d01f68cdd34cdd45419f22f Mon Sep 17 00:00:00 2001 From: Andrew Goodbody Date: Thu, 3 Jul 2025 11:00:33 +0100 Subject: [PATCH] cros_ec: sandbox: Use correct value for number of slots In the definition of struct ec_state the number of slots that are created is VSTORE_SLOT_COUNT (==4) but the value of req->slot is checked against EC_VSTORE_SLOT_MAX (==32) so this can lead to memory access beyond that allocated. Instead change the size check to use VSTORE_SLOT_COUNT to ensure it matches what has actually been allocated. This issue found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Quentin Schulz --- drivers/misc/cros_ec_sandbox.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/misc/cros_ec_sandbox.c b/drivers/misc/cros_ec_sandbox.c index 3ac690a3733..432b1fbb0c4 100644 --- a/drivers/misc/cros_ec_sandbox.c +++ b/drivers/misc/cros_ec_sandbox.c @@ -540,7 +540,7 @@ static int process_cmd(struct ec_state *ec, const struct ec_params_vstore_write *req = req_data; struct vstore_slot *slot; - if (req->slot >= EC_VSTORE_SLOT_MAX) + if (req->slot >= VSTORE_SLOT_COUNT) return -EINVAL; slot = &ec->slot[req->slot]; slot->locked = true; @@ -553,7 +553,7 @@ static int process_cmd(struct ec_state *ec, struct ec_response_vstore_read *resp = resp_data; struct vstore_slot *slot; - if (req->slot >= EC_VSTORE_SLOT_MAX) + if (req->slot >= VSTORE_SLOT_COUNT) return -EINVAL; slot = &ec->slot[req->slot]; memcpy(resp->data, slot->data, EC_VSTORE_SLOT_SIZE); -- 2.47.2