platform/chrome: Fix for double-fetched ioctl args

A single fix this time, closing a window where ioctl args are fetched twice.
platform/chrome: cros_ec_dev - double fetch bug in ioctl

We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure
that those values have not changed between the two copy_from_user()
calls.  Otherwise it could lead to a buffer overflow.

Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value.
We should use the new smaller value so we don't copy too much data to
the user.

Reported-by: Pengfei Wang <>
Fixes: a841178445bb ('mfd: cros_ec: Use a zero-length array for command data')
Signed-off-by: Dan Carpenter <>
Reviewed-by: Kees Cook <>
Tested-by: Gwendal Grignou <>
Cc: <> # v4.2+
Signed-off-by: Olof Johansson <>
1 file changed