do_flash() locates the first .cyacd record with

	p = strnchr(fw->data, fw->size, ':');
	while (p < eof) {
		s = strnchr(p + 1, eof - p - 1, ':');
		...
	}

If the firmware image contains no ':' byte,  strnchr() returns NULL.
NULL compares less than the valid kernel pointer eof, so the loop body
runs and strnchr() is called with p + 1 == (void *)1 and a length of
roughly (unsigned long)eof, causing a wonderful crash.

The not_signed_fw fallthrough earlier in do_flash() and the chip-state
branches in ccg_fw_update_needed() allow an unsigned blob to reach this
loop, so a root user who can place a crafted file under /lib/firmware
and write the do_flash sysfs attribute can trigger the oops.

Bail out with -EINVAL when the initial strnchr() returns NULL.

Assisted-by: gkh_clanker_t1000
Cc: stable <stable@kernel.org>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
index 199799b319c2..4463c1ae96bd 100644
--- a/drivers/usb/typec/ucsi/ucsi_ccg.c
+++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
@@ -1243,6 +1243,11 @@ static int do_flash(struct ucsi_ccg *uc, enum enum_flash_mode mode)
 	 *****************************************************************/
 
 	p = strnchr(fw->data, fw->size, ':');
+	if (!p) {
+		dev_err(dev, "Bad FW format: no ':' record header found\n");
+		err = -EINVAL;
+		goto release_mem;
+	}
 	while (p < eof) {
 		s = strnchr(p + 1, eof - p - 1, ':');
 
-- 
2.54.0

On Thu, May 14, 2026 at 07:10:06PM +0200, Greg Kroah-Hartman wrote:
> do_flash() locates the first .cyacd record with
> 
> 	p = strnchr(fw->data, fw->size, ':');
> 	while (p < eof) {
> 		s = strnchr(p + 1, eof - p - 1, ':');
> 		...
> 	}
> 
> If the firmware image contains no ':' byte,  strnchr() returns NULL.
> NULL compares less than the valid kernel pointer eof, so the loop body
> runs and strnchr() is called with p + 1 == (void *)1 and a length of
> roughly (unsigned long)eof, causing a wonderful crash.
> 
> The not_signed_fw fallthrough earlier in do_flash() and the chip-state
> branches in ccg_fw_update_needed() allow an unsigned blob to reach this
> loop, so a root user who can place a crafted file under /lib/firmware
> and write the do_flash sysfs attribute can trigger the oops.
> 
> Bail out with -EINVAL when the initial strnchr() returns NULL.
> 
> Assisted-by: gkh_clanker_t1000
> Cc: stable <stable@kernel.org>
> Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/typec/ucsi/ucsi_ccg.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
> index 199799b319c2..4463c1ae96bd 100644
> --- a/drivers/usb/typec/ucsi/ucsi_ccg.c
> +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
> @@ -1243,6 +1243,11 @@ static int do_flash(struct ucsi_ccg *uc, enum enum_flash_mode mode)
>  	 *****************************************************************/
>  
>  	p = strnchr(fw->data, fw->size, ':');
> +	if (!p) {
> +		dev_err(dev, "Bad FW format: no ':' record header found\n");
> +		err = -EINVAL;
> +		goto release_mem;
> +	}
>  	while (p < eof) {
>  		s = strnchr(p + 1, eof - p - 1, ':');
>  
> -- 
> 2.54.0

-- 
heikki