| From 5a1140404cbf7ba40137dfb1fb96893aa9a67d68 Mon Sep 17 00:00:00 2001 |
| From: Nathan Rebello <nathan.c.rebello@gmail.com> |
| Date: Tue, 7 Apr 2026 02:39:58 -0400 |
| Subject: usb: typec: ucsi: skip connector validation before init |
| |
| From: Nathan Rebello <nathan.c.rebello@gmail.com> |
| |
| commit 5a1140404cbf7ba40137dfb1fb96893aa9a67d68 upstream. |
| |
| Notifications can arrive before ucsi_init() has populated |
| ucsi->cap.num_connectors via GET_CAPABILITY. At that point |
| num_connectors is still 0, causing all valid connector numbers to be |
| incorrectly rejected as bogus. |
| |
| Skip the bounds check when num_connectors is 0 (not yet initialized). |
| Pre-init notifications are already handled safely by the early-event |
| guard in ucsi_connector_change(). |
| |
| Reported-by: Takashi Iwai <tiwai@suse.de> |
| Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com> |
| Tested-by: Takashi Iwai <tiwai@suse.de> |
| Link: https://patch.msgid.link/20260407063958.863-1-nathan.c.rebello@gmail.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/usb/typec/ucsi/ucsi.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/usb/typec/ucsi/ucsi.c |
| +++ b/drivers/usb/typec/ucsi/ucsi.c |
| @@ -43,7 +43,8 @@ void ucsi_notify_common(struct ucsi *ucs |
| return; |
| |
| if (UCSI_CCI_CONNECTOR(cci)) { |
| - if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors) |
| + if (!ucsi->cap.num_connectors || |
| + UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors) |
| ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci)); |
| else |
| dev_err(ucsi->dev, "bogus connector number in CCI: %lu\n", |
