[PATCH 0/2] usb: typec: ucsi: fix input validation in UCSI core

[Nathan Rebello <nathan.c.rebello@gmail.com>]

Two input validation fixes for the UCSI core driver:

Patch 1 adds a bounds check on the connector number in
ucsi_connector_change(). The connector number is extracted from the CCI
register (7-bit field, range 1-127) but is used to index the connector
array without validation. A malicious or malfunctioning PPM could cause
an out-of-bounds access.

Patch 2 clamps the return value of ucsi_run_command() to the caller's
buffer size. The current code returns UCSI_CCI_LENGTH() directly from
the CCI register, which may exceed the buffer provided by the caller,
leading to out-of-bounds reads in callers like ucsi_register_altmodes().

Both issues were found via static analysis and confirmed with
libFuzzer and AddressSanitizer.

Nathan Rebello (2):
  usb: typec: ucsi: validate connector number in ucsi_connector_change()
  usb: typec: ucsi: clamp returned length in ucsi_run_command()

 drivers/usb/typec/ucsi/ucsi.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

-- 
2.43.0.windows.1