Re: [PATCH] usb: typec: ucsi: ccg: reject firmware images without a ':' record header

[Heikki Krogerus <heikki.krogerus@linux.intel.com>]

On Thu, May 14, 2026 at 07:10:06PM +0200, Greg Kroah-Hartman wrote:
> do_flash() locates the first .cyacd record with
> 
> 	p = strnchr(fw->data, fw->size, ':');
> 	while (p < eof) {
> 		s = strnchr(p + 1, eof - p - 1, ':');
> 		...
> 	}
> 
> If the firmware image contains no ':' byte,  strnchr() returns NULL.
> NULL compares less than the valid kernel pointer eof, so the loop body
> runs and strnchr() is called with p + 1 == (void *)1 and a length of
> roughly (unsigned long)eof, causing a wonderful crash.
> 
> The not_signed_fw fallthrough earlier in do_flash() and the chip-state
> branches in ccg_fw_update_needed() allow an unsigned blob to reach this
> loop, so a root user who can place a crafted file under /lib/firmware
> and write the do_flash sysfs attribute can trigger the oops.
> 
> Bail out with -EINVAL when the initial strnchr() returns NULL.
> 
> Assisted-by: gkh_clanker_t1000
> Cc: stable <stable@kernel.org>
> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
> index 199799b319c2..4463c1ae96bd 100644
> --- a/drivers/usb/typec/ucsi/ucsi_ccg.c
> +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
> @@ -1243,6 +1243,11 @@ static int do_flash(struct ucsi_ccg *uc, enum enum_flash_mode mode)
>  	 *****************************************************************/
>  
>  	p = strnchr(fw->data, fw->size, ':');
> +	if (!p) {
> +		dev_err(dev, "Bad FW format: no ':' record header found\n");
> +		err = -EINVAL;
> +		goto release_mem;
> +	}
>  	while (p < eof) {
>  		s = strnchr(p + 1, eof - p - 1, ':');
>  
> -- 
> 2.54.0

-- 
heikki