]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 13 May 2026 15:52:51 +0000 (17:52 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 19 May 2026 10:25:49 +0000 (12:25 +0200)
commit8fbc349e8383125dd2d8de1c1e926279d398ab17
treec3a26d3b6194f8115aa051f863d7a6ddd0071240
parentaa2f716327be1818e1cb156da8a2844804aaec2f
usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers

Properly validate the count passed from a device when calling
svdm_consume_identity() or svdm_consume_identity_sop_prime() as the
device-controlled value could index off of the static arrays, which
could leak data.

Assisted-by: gkh_clanker_t1000
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: stable <stable@kernel.org>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Link: https://patch.msgid.link/2026051350-plated-salute-0efe@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/typec/tcpm/tcpm.c