[PATCH 6.6 & 5.10] usb: typec: ucsi: validate connector number in ucsi_connector_change

[Hongbo Li <lihongbo22@huawei.com>]

Commit d2d8c17ac01a ("usb: typec: ucsi: validate connector
number in ucsi_notify_common()") and commit 5a1140404cbf ("usb:
typec: ucsi: skip connector validation before init") add the bounds
check when do the connector change both in pre-init notification and
the forward notifications. But they are difficult to backport to
early stable branch such as LTS 6.6, LTS 5.10 due to many dependencies.
Instead, we choose to validate connector number in ucsi_connector_change
directly to avoid out-of-range issue.

Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API")
Signed-off-by: Hongbo Li <lihongbo22@huawei.com>
---
 drivers/usb/typec/ucsi/ucsi.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index b88f4e179a7a..4f5a72a1fbd8 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -960,13 +960,20 @@ static void ucsi_handle_connector_change(struct work_struct *work)
  */
 void ucsi_connector_change(struct ucsi *ucsi, u8 num)
 {
-	struct ucsi_connector *con = &ucsi->connector[num - 1];
+	struct ucsi_connector *con;
 
 	if (!(ucsi->ntfy & UCSI_ENABLE_NTFY_CONNECTOR_CHANGE)) {
 		dev_dbg(ucsi->dev, "Early connector change event\n");
 		return;
 	}
 
+	if (ucsi->cap.num_connectors && num > ucsi->cap.num_connectors) {
+		dev_err(ucsi->dev, "bogus connector number in CCI: %u\n",
+			num);
+		return;
+	}
+	con = &ucsi->connector[num - 1];
+
 	if (!test_and_set_bit(EVENT_PENDING, &ucsi->flags))
 		schedule_work(&con->work);
 }
-- 
2.34.1