Re: [PATCH 1/2] usb: typec: ucsi: validate connector number in ucsi_connector_change()

[Greg KH <gregkh@linuxfoundation.org>]

On Thu, Feb 19, 2026 at 11:49:23AM -0500, Nathan Rebello wrote:
> ucsi_connector_change() uses the connector number from the CCI as an
> index into the connector array without first verifying it falls within
> the valid range. The connector number is extracted from the CCI register
> via UCSI_CCI_CONNECTOR(), which returns a 7-bit value (1-127), but the
> connector array is typically only 2-4 entries.
> 
> A malicious or malfunctioning device could report an out-of-range
> connector number, causing an out-of-bounds array access.
> 
> Add a bounds check to reject invalid connector numbers before indexing.
> 
> Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API")
> Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index a7b388dc7fa0..7109d3bd39b4 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -1345,7 +1345,14 @@ static void ucsi_handle_connector_change(struct work_struct *work)
>   */
>  void ucsi_connector_change(struct ucsi *ucsi, u8 num)
>  {
> -	struct ucsi_connector *con = &ucsi->connector[num - 1];
> +	struct ucsi_connector *con;
> +
> +	if (num < 1 || num > ucsi->cap.num_connectors) {
> +		dev_warn(ucsi->dev, "invalid connector number %d\n", num);
> +		return;

Shouldn't this return an error and have the caller stop what it was
attempting to do?  When this is called in ucsi_init(), the
num_connectors is already parsed, so how can this be wrong?  Shouldn't
these values all be verified in one single place and then if any of the
descriptors are "incorrect", the device rejected at that point in time
and not require "deep" changes in the logic here to try to find these
types of errors?

in short, let's validate the device once, and after that is done, we can
"trust" that it is correct and not need to check this stuff all over the
place.

thanks,

greg k-h