linux-kernel - [PATCH] platform/chrome: cros_typec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230113182626.1149539-1-pmalani@chromium.org>
Date:   Fri, 13 Jan 2023 18:26:26 +0000
From:   Prashant Malani <pmalani@...omium.org>
To:     linux-kernel@...r.kernel.org, chrome-platform@...ts.linux.dev
Cc:     bleung@...omium.org, Prashant Malani <pmalani@...omium.org>
Subject: [PATCH] platform/chrome: cros_typec_vdm: Fix VDO copy

The usage of memcpy() affects the representation of the VDOs as they are
copied to the EC Host Command buffer. Specifically, all higher order
bits get dropped (for example: a VDO of 0x406 just gets copied as 0x6).

Avoid this by explicitly copying each VDO in the array. The number of
VDOs generated by alternate mode drivers in their VDMs is almost always
just 1 (apart from the header) so this doesn't affect performance in a
meaningful way).

Fixes: 40a9b13a09ef ("platform/chrome: cros_typec_vdm: Add VDM send support")
Signed-off-by: Prashant Malani <pmalani@...omium.org>
---
 drivers/platform/chrome/cros_typec_vdm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_typec_vdm.c b/drivers/platform/chrome/cros_typec_vdm.c
index aca9d337118e..06f4a55999c5 100644
--- a/drivers/platform/chrome/cros_typec_vdm.c
+++ b/drivers/platform/chrome/cros_typec_vdm.c
@@ -86,10 +86,12 @@ static int cros_typec_port_amode_vdm(struct typec_altmode *amode, const u32 hdr,
 		.command = TYPEC_CONTROL_COMMAND_SEND_VDM_REQ,
 	};
 	struct typec_vdm_req vdm_req = {};
+	int i;
 
 	vdm_req.vdm_data[0] = hdr;
 	vdm_req.vdm_data_objects = cnt;
-	memcpy(&vdm_req.vdm_data[1], vdo, cnt - 1);
+	for (i = 1; i < cnt; i++)
+		vdm_req.vdm_data[i] = vdo[i-1];
 	vdm_req.partner_type = TYPEC_PARTNER_SOP;
 	req.vdm_req_params = vdm_req;
 
-- 
2.39.0.314.g84b9a713c41-goog