[PATCH] gpio: ljca: validate event payload length

[David Lee <david.lee@trailofbits.com>]

ljca_gpio_event_cb() ignores the event length and trusts packet->num as
the number of two-byte GPIO records. A device can provide a complete USB
message whose nested count extends beyond the payload, making the callback
read beyond the receive allocation.

Require the payload to contain both the count byte and every record it
declares before iterating over the flexible array.

Fixes: c5a4b6fd31e8 ("gpio: Add support for Intel LJCA USB GPIO driver")
Assisted-by: Codex:gpt-5.5
Signed-off-by: David Lee <david.lee@trailofbits.com>
---
 drivers/gpio/gpio-ljca.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/gpio/gpio-ljca.c b/drivers/gpio/gpio-ljca.c
index f32d1d237795..cb2b2623ccb1 100644
--- a/drivers/gpio/gpio-ljca.c
+++ b/drivers/gpio/gpio-ljca.c
@@ -290,6 +290,9 @@ static void ljca_gpio_event_cb(void *context, u8 cmd, const void *evt_data,
 
 	if (cmd != LJCA_GPIO_INT_EVENT)
 		return;
+	if (len < sizeof(*packet) ||
+	    struct_size(packet, item, packet->num) > len)
+		return;
 
 	for (i = 0; i < packet->num; i++) {
 		generic_handle_domain_irq(ljca_gpio->gc.irq.domain,
-- 
2.43.0