]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
usb: typec: altmodes/displayport: validate count before reading Status Update VDO
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 13 May 2026 15:52:49 +0000 (17:52 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 19 May 2026 10:25:35 +0000 (12:25 +0200)
commit8a18f896e667df491331371b55d4ad644dc51d60
tree2dd9294fffdc9de87c9ee7e7aba1a804f36c1619
parent4af7ad0e6d7aa4403dbb1dac7b9659b0421efcaa
usb: typec: altmodes/displayport: validate count before reading Status Update VDO

A broken/malicious device can send the incorrect count for a status
update VDO, which will cause the kernel to read uninitialized stack data
and send it off elsewhere.

Fix this up by correctly verifying the count for the update object.

Assisted-by: gkh_clanker_t1000
Cc: stable <stable@kernel.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/2026051350-reacquire-sculpture-4244@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/typec/altmodes/displayport.c