From: Nathan Rebello <nathan.c.rebello@gmail.com> mainline inclusion from mainline-v7.0 commit 5a1140404cbf7ba40137dfb1fb96893aa9a67d68 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/14479 CVE: CVE-2026-31729 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- Notifications can arrive before ucsi_init() has populated ucsi->cap.num_connectors via GET_CAPABILITY. At that point num_connectors is still 0, causing all valid connector numbers to be incorrectly rejected as bogus. Skip the bounds check when num_connectors is 0 (not yet initialized). Pre-init notifications are already handled safely by the early-event guard in ucsi_connector_change(). Reported-by: Takashi Iwai <tiwai@suse.de> Fixes: d2d8c17ac01a ("usb: typec: ucsi: validate connector number in ucsi_notify_common()") Cc: stable@vger.kernel.org Signed-off-by: Nathan Rebello <nathan.c.rebello@gmail.com> Tested-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260407063958.863-1-nathan.c.rebello@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Conflicts: drivers/usb/typec/ucsi/ucsi.c [lhb: Context conflicts] Signed-off-by: Hongbo Li <lihongbo22@huawei.com> --- drivers/usb/typec/ucsi/ucsi.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index 51f256461201..7550e719cea6 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -839,17 +839,17 @@ void ucsi_connector_change(struct ucsi *ucsi, u8 num) { struct ucsi_connector *con; - if (num > ucsi->cap.num_connectors) { - dev_err(ucsi->dev, "bogus connector number in CCI: %u\n", - num); + if (!(ucsi->ntfy & UCSI_ENABLE_NTFY_CONNECTOR_CHANGE)) { + dev_dbg(ucsi->dev, "Early connector change event\n"); return; } - con = &ucsi->connector[num - 1]; - if (!(ucsi->ntfy & UCSI_ENABLE_NTFY_CONNECTOR_CHANGE)) { - dev_dbg(ucsi->dev, "Early connector change event\n"); + if (ucsi->cap.num_connectors && num > ucsi->cap.num_connectors) { + dev_err(ucsi->dev, "bogus connector number in CCI: %u\n", + num); return; } + con = &ucsi->connector[num - 1]; set_bit(EVENT_PENDING, &ucsi->flags); -- 2.34.1