cros_typec_register_altmodes() iterates over sop_disc->svid_count and sop_disc->svids[i].mode_count from the EC_CMD_TYPEC_DISCOVERY response without validating their bounds. port->disc_data is allocated as a buffer of EC_PROTO2_MAX_RESPONSE_SIZE bytes, and each SVID entry contains a fixed mode_vdo[6] array. If the EC returns an out-of-bounds svid_count or mode_count, the loops read past the end of the mode_vdo array or the disc_data buffer. Validate that the discovery response with svid_count entries fits within EC_PROTO2_MAX_RESPONSE_SIZE using struct_size(), and ensure each SVID's mode_count does not exceed ARRAY_SIZE(sop_disc->svids[i].mode_vdo) before registering altmodes. Fixes: de0f49487db3 ("platform/chrome: cros_ec_typec: Register partner altmodes") Signed-off-by: Bartosz Szpila <bszpila@google.com> Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org> Link: https://lore.kernel.org/r/20261001085714.1086242-1-bszpila@google.com Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>