Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

usb: typec: ucsi: skip connector validation before init

Notifications can arrive before ucsi_init() has populated
ucsi->cap.num_connectors via GET_CAPABILITY. At that point
num_connectors is still 0, causing all valid connector numbers to be
incorrectly rejected as bogus.

Skip the bounds check when num_connectors is 0 (not yet initialized).
Pre-init notifications are already handled safely by the early-event
guard in ucsi_connector_change().

Reported-by: Takashi Iwai <tiwai@suse.de>
Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()")
Cc: stable@vger.kernel.org
Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>
Tested-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20260407063958.863-1-nathan.c.rebello@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Nathan Rebello and committed by
Greg Kroah-Hartman
5a114040 591cd656

+2 -1
+2 -1
drivers/usb/typec/ucsi/ucsi.c
··· 44 44 return; 45 45 46 46 if (UCSI_CCI_CONNECTOR(cci)) { 47 - if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors) 47 + if (!ucsi->cap.num_connectors || 48 + UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors) 48 49 ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci)); 49 50 else 50 51 dev_err(ucsi->dev, "bogus connector number in CCI: %lu\n",