usb: typec: tipd: Add an additional overflow check

tps6598x_block_read already checks for the maximum length of the read
but tps6598x_block_write does not. Add the symmetric check there as
well.

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Sven Peter <sven@svenpeter.dev>
Link: https://lore.kernel.org/r/20210914140235.65955-2-sven@svenpeter.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
index c18ec3785592ba0a68ba2d784b4608e4648d85e5..8c79ba17a1578a4e64518247536905f4f2483838 100644 (file)
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -139,6 +139,9 @@ static int tps6598x_block_write(struct tps6598x *tps, u8 reg,
 {
        u8 data[TPS_MAX_LEN + 1];
 
+       if (len + 1 > sizeof(data))
+               return -EINVAL;
+
        if (!tps->i2c_protocol)
                return regmap_raw_write(tps->regmap, reg, val, len);