diff options
| author | Bryam Vargas <hexlabsecurity@proton.me> | 2026-06-18 00:46:28 -0500 |
|---|---|---|
| committer | Tzung-Bi Shih <tzungbi@kernel.org> | 2026-06-29 02:47:59 +0000 |
| commit | 833740a2333c2e4db4e02e3d0ffba04e8718a5f3 (patch) | |
| tree | 86b55b19186c2969d1cc9940e0fd4320f2da98d7 | |
| parent | dc59e4fea9d83f03bad6bddf3fa2e52491777482 (diff) | |
| download | linux-833740a2333c2e4db4e02e3d0ffba04e8718a5f3.tar.gz linux-833740a2333c2e4db4e02e3d0ffba04e8718a5f3.zip | |
platform/chrome: sensorhub: Bound the EC-reported sensor number
Each EC FIFO event carries an 8-bit sensor number (in->sensor_num).
cros_ec_sensorhub_ring_handler() validates the FIFO event count, the
per-read count and the ring bound, but not the sensor number, which
cros_ec_sensor_ring_process_event() then uses unchecked to index
sensorhub->batch_state[] - allocated with only sensorhub->sensor_num
entries. A sensor number of sensor_num or larger is an out-of-bounds
read and write of batch_state[].
Validate the sensor number in the ring handler, where each event is read
from the EC, and drop a malformed event before it is used.
Fixes: 145d59baff59 ("platform/chrome: cros_ec_sensorhub: Add FIFO support")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Link: https://lore.kernel.org/r/20260618-b4-disp-adb3f790-v3-1-3a164ed63cbd@proton.me
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
| -rw-r--r-- | drivers/platform/chrome/cros_ec_sensorhub_ring.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/platform/chrome/cros_ec_sensorhub_ring.c b/drivers/platform/chrome/cros_ec_sensorhub_ring.c index a10579144c34..64e9615ed6f4 100644 --- a/drivers/platform/chrome/cros_ec_sensorhub_ring.c +++ b/drivers/platform/chrome/cros_ec_sensorhub_ring.c @@ -890,6 +890,14 @@ static void cros_ec_sensorhub_ring_handler(struct cros_ec_sensorhub *sensorhub) for (in = sensorhub->resp->fifo_read.data, j = 0; j < number_data; j++, in++) { + /* Skip event if sensor_num from EC is out of bounds. */ + if (in->sensor_num >= sensorhub->sensor_num) { + dev_warn_ratelimited(sensorhub->dev, + "Invalid sensor number %u from EC\n", + in->sensor_num); + continue; + } + if (cros_ec_sensor_ring_process_event( sensorhub, fifo_info, fifo_timestamp, |