On Wed, Jul 22, 2026 at 07:50:59PM +0000, Jameson Thies wrote:
> Currently the cros_usbpd-charger driver probe iterates based on raw
> charger port count returned by the embedded controller. The only check
> is against the number of USB PD ports which the embedded controller
> also defines. A malicious embedded controller could return an inaccurate
> port count (up to 255) resulting in an out of bounds write and
> subsequent memory corruption.
> 
> Update helper functions in cros_usbpd-charger to limit port counts to
> EC_USB_PD_MAX_PORTS.
> 
> Fixes: 3af15cfacd1e ("power: supply: cros: add support for dedicated port")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jameson Thies <jthies@google.com>

Reviewed-by: Benson Leung <bleung@chromium.org>


> ---
>  drivers/power/supply/cros_usbpd-charger.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/drivers/power/supply/cros_usbpd-charger.c b/drivers/power/supply/cros_usbpd-charger.c
> index 308e1d4e6dd8..82185ee33fd4 100644
> --- a/drivers/power/supply/cros_usbpd-charger.c
> +++ b/drivers/power/supply/cros_usbpd-charger.c
> @@ -125,6 +125,11 @@ static int cros_usbpd_charger_get_num_ports(struct charger_data *charger)
>  	if (ret < 0)
>  		return ret;
>  
> +	if (resp.port_count > EC_USB_PD_MAX_PORTS) {
> +		dev_warn(charger->dev, "Charge port count out of bounds\n");
> +		return EC_USB_PD_MAX_PORTS;
> +	}
> +
>  	return resp.port_count;
>  }
>  
> @@ -138,6 +143,11 @@ static int cros_usbpd_charger_get_usbpd_num_ports(struct charger_data *charger)
>  	if (ret < 0)
>  		return ret;
>  
> +	if (resp.num_ports > EC_USB_PD_MAX_PORTS) {
> +		dev_warn(charger->dev, "USB PD port count out of bounds\n");
> +		return EC_USB_PD_MAX_PORTS;
> +	}
> +
>  	return resp.num_ports;
>  }
>  
> 
> base-commit: 17376e7311cdec252b61cb1ecec43be61907781b
> -- 
> 2.55.0.229.g6434b31f56-goog
>