Re: [PATCH 8/8] usb: typec: ucsi: validate connector number in ucsi_connector_change()

[Abhishek Pandit-Subedi]

On Wed, May 13, 2026 at 9:02 AM Greg Kroah-Hartman
<gregkh@xxxxxxxxxxxxxxxxxxx> wrote:
>
> The connector number in a UCSI CCI notification is a 7-bit field
> supplied by the PPM.  ucsi_connector_change() uses it to index the
> ucsi->connector[] array without checking it against the number of
> connectors the PPM reported at init time, so a buggy or malicious PPM
> (EC firmware, or an I2C-attached UCSI controller on the ccg / stm32g0 /
> glink transports) can drive schedule_work() on memory past the end of
> the array.
>
> Reject connector numbers that are zero or exceed cap.num_connectors
> before dereferencing the array.
>
> Assisted-by: gkh_clanker_t1000
> Cc: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
> Cc: Benson Leung <bleung@xxxxxxxxxxxx>
> Cc: Jameson Thies <jthies@xxxxxxxxxx>
> Cc: Nathan Rebello <nathan.c.rebello@xxxxxxxxx>
> Cc: Johan Hovold <johan@xxxxxxxxxx>
> Cc: Pooja Katiyar <pooja.katiyar@xxxxxxxxx>
> Cc: Hsin-Te Yuan <yuanhsinte@xxxxxxxxxxxx>
> Cc: Abel Vesa <abelvesa@xxxxxxxxxx>
> Cc: stable <stable@xxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>

Reviewed-by: Abhishek Pandit-Subedi <abhishekpandit@xxxxxxxxxxxx>

> ---
>  drivers/usb/typec/ucsi/ucsi.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index 5b7ad9e99cb9..539dc706798d 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -1380,13 +1380,22 @@ static void ucsi_handle_connector_change(struct work_struct *work)
>   */
>  void ucsi_connector_change(struct ucsi *ucsi, u8 num)
>  {
> -       struct ucsi_connector *con = &ucsi->connector[num - 1];
> +       struct ucsi_connector *con;
>
>         if (!(ucsi->ntfy & UCSI_ENABLE_NTFY_CONNECTOR_CHANGE)) {
>                 dev_dbg(ucsi->dev, "Early connector change event\n");
>                 return;
>         }
>
> +       if (!num || num > ucsi->cap.num_connectors) {
> +               dev_warn_ratelimited(ucsi->dev,
> +                                    "Bogus connector change on %u (max %u)\n",
> +                                    num, ucsi->cap.num_connectors);
> +               return;
> +       }
> +
> +       con = &ucsi->connector[num - 1];
> +
>         if (!test_and_set_bit(EVENT_PENDING, &ucsi->flags))
>                 schedule_work(&con->work);
>  }
> --
> 2.54.0
>
>