diff options
| author |   Sven Peter <sven@svenpeter.dev> | 2021-09-14 16:02:34 +0200 |
|---|---|---|
| committer |   Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-09-21 16:31:28 +0200 |
| commit | ac588dfa66ab040bff7e5978be888dc040a026f9 (patch) | |
| tree | 0691c111656818b2ed06a09d0e5c82524516462c /drivers/usb/typec | |
| parent | usb: typec: tipd: Don't read/write more bytes than required (diff) | |
| download | wireguard-linux-ac588dfa66ab040bff7e5978be888dc040a026f9.tar.xz wireguard-linux-ac588dfa66ab040bff7e5978be888dc040a026f9.zip | |
usb: typec: tipd: Add an additional overflow check
tps6598x_block_read already checks for the maximum length of the read
but tps6598x_block_write does not. Add the symmetric check there as
well.
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Sven Peter <sven@svenpeter.dev>
Link: https://lore.kernel.org/r/20210914140235.65955-2-sven@svenpeter.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/typec')
| -rw-r--r-- | drivers/usb/typec/tipd/core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c index c18ec3785592..8c79ba17a157 100644 --- a/drivers/usb/typec/tipd/core.c +++ b/drivers/usb/typec/tipd/core.c @@ -139,6 +139,9 @@ static int tps6598x_block_write(struct tps6598x *tps, u8 reg, { u8 data[TPS_MAX_LEN + 1]; + if (len + 1 > sizeof(data)) + return -EINVAL; + if (!tps->i2c_protocol) return regmap_raw_write(tps->regmap, reg, val, len); |