]> git.baikalelectronics.ru Git - kernel.git/commit
usb: typec: ucsi: Prevent mode overrun
authorHeikki Krogerus <heikki.krogerus@linux.intel.com>
Wed, 16 Sep 2020 09:00:34 +0000 (12:00 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Sep 2020 10:34:10 +0000 (12:34 +0200)
commit479370e8db8d4adf66aa5174a4927c8221803cbd
treedb19de98cdb06759dec3331b81e143cb4757cddb
parent1ffc2a6255d1c49c6c0d5fd099216588f50ca561
usb: typec: ucsi: Prevent mode overrun

Sometimes the embedded controller firmware does not
terminate the list of alternate modes that the partner
supports in its response to the GET_ALTERNATE_MODES command.
Instead the firmware returns the supported alternate modes
over and over again until the driver stops requesting them.

If that happens, the number of modes for each alternate mode
will exceed the maximum 6 that is defined in the USB Power
Delivery specification. Making sure that can't happen by
adding a check for it.

This fixes NULL pointer dereference that is caused by the
overrun.

Fixes: d47cb1da1c0ba ("usb: typec: ucsi: Preliminary support for alternate modes")
Cc: stable@vger.kernel.org
Reported-by: Zwane Mwaikambo <zwanem@gmail.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20200916090034.25119-3-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/typec/ucsi/ucsi.c