Linux USB
 help / color / mirror / Atom feed
* [PATCH] usb: typec: ucsi: Fix off-by-one in connector validation
@ 2026-06-30 11:30 DongliLiu
  2026-06-30 14:17 ` Greg KH
  0 siblings, 1 reply; 2+ messages in thread
From: DongliLiu @ 2026-06-30 11:30 UTC (permalink / raw)
  To: linux-usb

From: DongliLiu <dongli.liu@outlook.com>
Date: Mon, 30 Jun 2026 19:30:00 +0800
Subject: [PATCH] usb: typec: ucsi: Fix off-by-one in connector validation

UCSI_CCI_CONNECTOR() returns a 1-based connector index, while
num_connectors represents the total count of connectors. Using '<='
allows num_connectors itself as a valid index, which is off-by-one
since valid indices are 0 to num_connectors-1.

Change the comparison from '<=' to '<' to correctly reject the
out-of-bounds case.

Signed-off-by: DongliLiu <dongli.liu@outlook.com>
---
  drivers/usb/typec/ucsi/ucsi.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index xxxxxxx..yyyyyyy 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -xxx,yyy @@@ static void ucsi_notify_common(struct ucsi *ucsi, u32 cci)
      ...

-    if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
+    if (UCSI_CCI_CONNECTOR(cci) < ucsi->cap.num_connectors)
          ...
-- 
2.40.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2026-06-30 14:19 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-30 11:30 [PATCH] usb: typec: ucsi: Fix off-by-one in connector validation DongliLiu
2026-06-30 14:17 ` Greg KH

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox