Re: [PATCH 1/2] usb: typec: ucsi: validate connector number in ucsi_connector_change()

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Feb 20, 2026 at 01:34:04AM -0500, Nathan Rebello wrote:
> After.

I'm sorry, but I have no context here.  Remember, some of us get 1000+
emails a day, context matters :)

/me goes and digs...

> ucsi_connector_change() is only called via ucsi_notify_common(),
> which processes CCI interrupts from a bound device. The connector number
> comes from the CCI register (UCSI_CCI_CONNECTOR), a 7-bit field that
> can return 1-127, while the connector array is allocated based on
> num_connectors (typically 2-4). The same register is already validated
> for other fields in ucsi_init() (line 1840: "This is out of spec but
> happens in buggy FW").

Why not fix the buggy fw?  :)

Remember, Linux trusts hardware.  If people wish to change that model,
great, I'm all for that, and wack-a-mole fixes like this for after a
driver is bound to a device are nice to attempt, and clean up, but are
not really the solution.

That's why we have USBGuard, which prevents the driver from binding to
the device.  Make that policy decision in userspace, and then if you
trust the device, great, we trust the device to send us correct data.

And again, fix the hardware to not send invalid data.

thanks,

greg k-h