[PATCH 2/2] usb: typec: ucsi: clamp returned length in ucsi_run_command()

[Nathan Rebello <nathan.c.rebello@gmail.com>]

ucsi_run_command() returns UCSI_CCI_LENGTH(cci) as the data length to
callers. This value comes directly from the CCI register and reflects
the length reported by the PPM firmware, not the actual number of bytes
copied into the caller's buffer (which is bounded by the size parameter
passed to sync_control).

If the firmware reports a length larger than the buffer provided by the
caller, callers such as ucsi_register_altmodes() will iterate past the
end of their stack buffer when computing:

    num = len / sizeof(alt[0]);
    for (j = 0; j < num; j++)  /* reads past alt[2] */

Clamp the return value to the buffer size to prevent out-of-bounds reads.

Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API")
Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>
---
 drivers/usb/typec/ucsi/ucsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index 7109d3bd39b4..5791597fe662 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -140,7 +140,7 @@ static int ucsi_run_command(struct ucsi *ucsi, u64 command, u32 *cci,
 	if (ret)
 		return ret;
 
-	return err ?: UCSI_CCI_LENGTH(*cci);
+	return err ?: min_t(u32, UCSI_CCI_LENGTH(*cci), size);
 }
 
 static int ucsi_read_error(struct ucsi *ucsi, u8 connector_num)
-- 
2.43.0.windows.1