Re: [PATCH v4] usb: typec: ucsi: validate connector number in ucsi_notify_common()

[Heikki Krogerus <heikki.krogerus@linux.intel.com>]

Thu, Mar 12, 2026 at 05:15:03PM -0400, Nathan Rebello wrote:
> The connector number extracted from CCI via UCSI_CCI_CONNECTOR() is a
> 7-bit field (0-127) that is used to index into the connector array in
> ucsi_connector_change(). However, the array is only allocated for the
> number of connectors reported by the device (typically 2-4 entries).
> 
> A malicious or malfunctioning device could report an out-of-range
> connector number in the CCI, causing an out-of-bounds array access in
> ucsi_connector_change().
> 
> Add a bounds check in ucsi_notify_common(), the central point where CCI
> is parsed after arriving from hardware, so that bogus connector numbers
> are rejected before they propagate further.
> 
> Fixes: bdc62f2bae8f ("usb: typec: ucsi: Simplified registration and I/O API")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>

Did you see this happening on an actual device?

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> v4:
>  - Moved bounds check to ucsi_notify_common(), the single point where
>    CCI is parsed after read_cci(), so bogus connector numbers never
>    propagate to ucsi_connector_change() (Greg KH)
>  - Changed dev_warn to dev_err
> v3:
>  - Added changelog (Greg's bot)
> v2:
>  - Kept bounds check in ucsi_connector_change() rather than moving it
>    to ucsi_notify_common() (Greg KH)
> 
>  drivers/usb/typec/ucsi/ucsi.c | 9 +++++++--
>  1 file changed, 7 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index a7b388dc7fa0..10261992f020 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -42,8 +42,13 @@ void ucsi_notify_common(struct ucsi *ucsi, u32 cci)
>  	if (cci & UCSI_CCI_BUSY)
>  		return;
>  
> -	if (UCSI_CCI_CONNECTOR(cci))
> -		ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci));
> +	if (UCSI_CCI_CONNECTOR(cci)) {
> +		if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
> +			ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci));
> +		else
> +			dev_err(ucsi->dev, "bogus connector number in CCI: %u\n",
> +				UCSI_CCI_CONNECTOR(cci));
> +	}
>  
>  	if (cci & UCSI_CCI_ACK_COMPLETE &&
>  	    test_and_clear_bit(ACK_PENDING, &ucsi->flags))
> -- 
> 2.43.0.windows.1

-- 
heikki