Re: [PATCH v1] power: supply: cros_usbpd: Limit port counts to EC_USB_PD_MAX_PORTS

--C5XRS+V9CVgowzAx
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Jul 22, 2026 at 07:50:59PM +0000, Jameson Thies wrote:
> Currently the cros_usbpd-charger driver probe iterates based on raw
> charger port count returned by the embedded controller. The only check
> is against the number of USB PD ports which the embedded controller
> also defines. A malicious embedded controller could return an inaccurate
> port count (up to 255) resulting in an out of bounds write and
> subsequent memory corruption.
>=20
> Update helper functions in cros_usbpd-charger to limit port counts to
> EC_USB_PD_MAX_PORTS.
>=20
> Fixes: 3af15cfacd1e ("power: supply: cros: add support for dedicated port=
")
> Cc: [email protected]
> Signed-off-by: Jameson Thies <[email protected]>

Reviewed-by: Benson Leung <[email protected]>


> ---
>  drivers/power/supply/cros_usbpd-charger.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>=20
> diff --git a/drivers/power/supply/cros_usbpd-charger.c b/drivers/power/su=
pply/cros_usbpd-charger.c
> index 308e1d4e6dd8..82185ee33fd4 100644
> --- a/drivers/power/supply/cros_usbpd-charger.c
> +++ b/drivers/power/supply/cros_usbpd-charger.c
> @@ -125,6 +125,11 @@ static int cros_usbpd_charger_get_num_ports(struct c=
harger_data *charger)
>  	if (ret < 0)
>  		return ret;
> =20
> +	if (resp.port_count > EC_USB_PD_MAX_PORTS) {
> +		dev_warn(charger->dev, "Charge port count out of bounds\n");
> +		return EC_USB_PD_MAX_PORTS;
> +	}
> +
>  	return resp.port_count;
>  }
> =20
> @@ -138,6 +143,11 @@ static int cros_usbpd_charger_get_usbpd_num_ports(st=
ruct charger_data *charger)
>  	if (ret < 0)
>  		return ret;
> =20
> +	if (resp.num_ports > EC_USB_PD_MAX_PORTS) {
> +		dev_warn(charger->dev, "USB PD port count out of bounds\n");
> +		return EC_USB_PD_MAX_PORTS;
> +	}
> +
>  	return resp.num_ports;
>  }
> =20
>=20
> base-commit: 17376e7311cdec252b61cb1ecec43be61907781b
> --=20
> 2.55.0.229.g6434b31f56-goog
>=20

--C5XRS+V9CVgowzAx
Content-Type: application/pgp-signature; name=signature.asc

-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQCtZK6p/AktxXfkOlzbaomhzOwwgUCamEgDQAKCRBzbaomhzOw
wn8cAP9o/UaHtmuO3OGVfyb7gYiej2q0tbRzJ9TCk0NYnVh8lQD+PUX/OYdODfgX
TK8sGHCZq6dp8IoqaZE7JHsKoOZKlgo=
=yVpF
-----END PGP SIGNATURE-----

--C5XRS+V9CVgowzAx--