[PATCH] gpio: ljca: validate event payload length

[PATCH] gpio: ljca: validate event payload length

[David Lee]

ljca_gpio_event_cb() ignores the event length and trusts packet->num as
the number of two-byte GPIO records. A device can provide a complete USB
message whose nested count extends beyond the payload, making the callback
read beyond the receive allocation.

Require the payload to contain both the count byte and every record it
declares before iterating over the flexible array.

Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
Assisted-by: Codex:gpt-5.5
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
 drivers/gpio/gpio-ljca.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
index f32d1d237795..cb2b2623ccb1 100644
--- a/drivers/gpio/gpio-ljca.c
+++ b/drivers/gpio/gpio-ljca.c
@@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
 
 	if (cmd != LJCA_GPIO_INT_EVENT)
 		return;
+	if (len < sizeof(*packet) ||
+	    struct_size(packet, item, packet->num) > len)
+		return;
 
 	for (i = 0; i < packet->num; i++) {
 		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,
-- 
2.43.0

RE: [PATCH] gpio: ljca: validate event payload length

[Zhang, Lixu]

>-----Original Message-----
>From: David Lee <david.lee@trailofbits.com>
>Sent: Friday, July 17, 2026 10:58 PM
>To: Zhang, Lixu <lixu.zhang@intel.com>
>Cc: David Lee <david.lee@trailofbits.com>; Sakari Ailus
><sakari.ailus@linux.intel.com>; Linus Walleij <linusw@kernel.org>; Bartosz
>Golaszewski <brgl@kernel.org>; Dominik 'Disconnect3d' Czarnota
><dominik.czarnota@trailofbits.com>; linux-gpio@vger.kernel.org; linux-
>kernel@vger.kernel.org
>Subject: [PATCH] gpio: ljca: validate event payload length
>
>ljca_gpio_event_cb() ignores the event length and trusts packet->num as the
>number of two-byte GPIO records. A device can provide a complete USB message
>whose nested count extends beyond the payload, making the callback read
>beyond the receive allocation.
>
>Require the payload to contain both the count byte and every record it declares
>before iterating over the flexible array.
>
>Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
>Assisted-by: Codex:gpt-5.5
>Signed-off-by: David Lee <david.lee@trailofbits.com>

Reviewed-by: Zhang Lixu <lixu.zhang@intel.com>

>---

[PATCH] gpio: ljca: validate event payload length

[David Lee]

ljca_gpio_event_cb() ignores the event length and trusts packet->num as
the number of two-byte GPIO records. A device can provide a complete USB
message whose nested count extends beyond the payload, making the callback
read beyond the receive allocation.

Require the payload to contain both the count byte and every record it
declares before iterating over the flexible array.

Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
Assisted-by: Codex:gpt-5.5
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
 drivers/gpio/gpio-ljca.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
index f32d1d237795..cb2b2623ccb1 100644
--- a/drivers/gpio/gpio-ljca.c
+++ b/drivers/gpio/gpio-ljca.c
@@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
 
 	if (cmd != LJCA_GPIO_INT_EVENT)
 		return;
+	if (len < sizeof(*packet) ||
+	    struct_size(packet, item, packet->num) > len)
+		return;
 
 	for (i = 0; i < packet->num; i++) {
 		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,
-- 
2.43.0

Re: [PATCH] gpio: ljca: validate event payload length

[Sakari Ailus]

Hi David,

Thanks for the patch.

On Mon, Jul 20, 2026 at 05:49:05AM +0000, David Lee wrote:
> ljca_gpio_event_cb() ignores the event length and trusts packet->num as
> the number of two-byte GPIO records. A device can provide a complete USB
> message whose nested count extends beyond the payload, making the callback
> read beyond the receive allocation.
> 
> Require the payload to contain both the count byte and every record it
> declares before iterating over the flexible array.
> 
> Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> ---
>  drivers/gpio/gpio-ljca.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
> index f32d1d237795..cb2b2623ccb1 100644
> --- a/drivers/gpio/gpio-ljca.c
> +++ b/drivers/gpio/gpio-ljca.c
> @@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
>  
>  	if (cmd != LJCA_GPIO_INT_EVENT)
>  		return;
> +	if (len < sizeof(*packet) ||
> +	    struct_size(packet, item, packet->num) > len)
> +		return;

I think this case would require a warning message, maybe using
dev_warn_once().

>  
>  	for (i = 0; i < packet->num; i++) {
>  		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,

-- 
Regards,

Sakari Ailus

Re: [PATCH] gpio: ljca: validate event payload length

[Bartosz Golaszewski]

On Fri, 17 Jul 2026 16:58:26 +0200, David Lee <david.lee@trailofbits.com> said:
> ljca_gpio_event_cb() ignores the event length and trusts packet->num as
> the number of two-byte GPIO records. A device can provide a complete USB
> message whose nested count extends beyond the payload, making the callback
> read beyond the receive allocation.
>
> Require the payload to contain both the count byte and every record it
> declares before iterating over the flexible array.
>
> Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: David Lee <david.lee@trailofbits.com>
> ---
>  drivers/gpio/gpio-ljca.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
> index f32d1d237795..cb2b2623ccb1 100644
> --- a/drivers/gpio/gpio-ljca.c
> +++ b/drivers/gpio/gpio-ljca.c
> @@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
>
>  	if (cmd != LJCA_GPIO_INT_EVENT)
>  		return;
> +	if (len < sizeof(*packet) ||
> +	    struct_size(packet, item, packet->num) > len)
> +		return;
>
>  	for (i = 0; i < packet->num; i++) {
>  		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,
> --
> 2.43.0
>
>

There are two separate v1 of this, I'm confused.

Bart