usb: typec: ucsi: skip connector validation before init

[PATCH] usb: typec: ucsi: skip connector validation before init

Posted by Nathan Rebello 2 months, 1 week ago

Notifications can arrive before ucsi_init() has populated
ucsi->cap.num_connectors via GET_CAPABILITY. At that point
num_connectors is still 0, causing all valid connector numbers to be
incorrectly rejected as bogus.

Skip the bounds check when num_connectors is 0 (not yet initialized).
Pre-init notifications are already handled safely by the early-event
guard in ucsi_connector_change().

Reported-by: Takashi Iwai <tiwai@suse.de>
Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()")
Cc: stable@vger.kernel.org
Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>
---
 drivers/usb/typec/ucsi/ucsi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index b77910152399..7df3a7b94a40 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -43,7 +43,8 @@ void ucsi_notify_common(struct ucsi *ucsi, u32 cci)
 		return;
 
 	if (UCSI_CCI_CONNECTOR(cci)) {
-		if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
+		if (!ucsi->cap.num_connectors ||
+		    UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
 			ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci));
 		else
 			dev_err(ucsi->dev, "bogus connector number in CCI: %lu\n",
-- 
2.43.0.windows.1

Re: [PATCH] usb: typec: ucsi: skip connector validation before init

Posted by Heikki Krogerus 2 months, 1 week ago

On Tue, Apr 07, 2026 at 02:39:58AM -0400, Nathan Rebello wrote:
> Notifications can arrive before ucsi_init() has populated
> ucsi->cap.num_connectors via GET_CAPABILITY. At that point
> num_connectors is still 0, causing all valid connector numbers to be
> incorrectly rejected as bogus.
> 
> Skip the bounds check when num_connectors is 0 (not yet initialized).
> Pre-init notifications are already handled safely by the early-event
> guard in ucsi_connector_change().
> 
> Reported-by: Takashi Iwai <tiwai@suse.de>
> Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>

Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/typec/ucsi/ucsi.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index b77910152399..7df3a7b94a40 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -43,7 +43,8 @@ void ucsi_notify_common(struct ucsi *ucsi, u32 cci)
>  		return;
>  
>  	if (UCSI_CCI_CONNECTOR(cci)) {
> -		if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
> +		if (!ucsi->cap.num_connectors ||
> +		    UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
>  			ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci));
>  		else
>  			dev_err(ucsi->dev, "bogus connector number in CCI: %lu\n",
> -- 
> 2.43.0.windows.1

-- 
heikki

Re: [PATCH] usb: typec: ucsi: skip connector validation before init

Posted by Takashi Iwai 2 months, 1 week ago

On Tue, 07 Apr 2026 08:39:58 +0200,
Nathan Rebello wrote:
> 
> Notifications can arrive before ucsi_init() has populated
> ucsi->cap.num_connectors via GET_CAPABILITY. At that point
> num_connectors is still 0, causing all valid connector numbers to be
> incorrectly rejected as bogus.
> 
> Skip the bounds check when num_connectors is 0 (not yet initialized).
> Pre-init notifications are already handled safely by the early-event
> guard in ucsi_connector_change().
> 
> Reported-by: Takashi Iwai <tiwai@suse.de>
> Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index b77910152399..7df3a7b94a40 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -43,7 +43,8 @@ void ucsi_notify_common(struct ucsi *ucsi, u32 cci)
>  		return;
>  
>  	if (UCSI_CCI_CONNECTOR(cci)) {
> -		if (UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
> +		if (!ucsi->cap.num_connectors ||
> +		    UCSI_CCI_CONNECTOR(cci) <= ucsi->cap.num_connectors)
>  			ucsi_connector_change(ucsi, UCSI_CCI_CONNECTOR(cci));
>  		else
>  			dev_err(ucsi->dev, "bogus connector number in CCI: %lu\n",

Confirmed that it fixes my case.

Tested-by: Takashi Iwai <tiwai@suse.de>


Thanks!

Takashi