cros_ec: sandbox: Use correct value for number of slots
authorAndrew Goodbody <andrew.goodbody@linaro.org>
Thu, 3 Jul 2025 10:00:33 +0000 (11:00 +0100)
committerTom Rini <trini@konsulko.com>
Mon, 14 Jul 2025 21:16:30 +0000 (15:16 -0600)
commitbae3a34cb9e6b3ce6d01f68cdd34cdd45419f22f
tree82b2d28681b772356d38012afdfefefe60c25e24
parentebfbc77109a1fee5db71f767dd1f58d7c68bb442
cros_ec: sandbox: Use correct value for number of slots

In the definition of struct ec_state the number of slots that are
created is VSTORE_SLOT_COUNT (==4) but the value of req->slot is
checked against EC_VSTORE_SLOT_MAX (==32) so this can lead to memory
access beyond that allocated.
Instead change the size check to use VSTORE_SLOT_COUNT to ensure it
matches what has actually been allocated.

This issue found by Smatch.

Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
drivers/misc/cros_ec_sandbox.c