]> git.baikalelectronics.ru Git - kernel.git/commit
usb: typec: ucsi: Prevent mode overrun
authorHeikki Krogerus <heikki.krogerus@linux.intel.com>
Wed, 16 Sep 2020 09:00:34 +0000 (12:00 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 16 Sep 2020 10:34:10 +0000 (12:34 +0200)
commitc0a8d0cc9ab9b1eb5cbd702df6b7e1912405d625
treedb19de98cdb06759dec3331b81e143cb4757cddb
parent9aa7578e9da08f47243ad3e64fd8cd3bd5ce37b8
usb: typec: ucsi: Prevent mode overrun

Sometimes the embedded controller firmware does not
terminate the list of alternate modes that the partner
supports in its response to the GET_ALTERNATE_MODES command.
Instead the firmware returns the supported alternate modes
over and over again until the driver stops requesting them.

If that happens, the number of modes for each alternate mode
will exceed the maximum 6 that is defined in the USB Power
Delivery specification. Making sure that can't happen by
adding a check for it.

This fixes NULL pointer dereference that is caused by the
overrun.

Fixes: 0bcf5fb2f39f5 ("usb: typec: ucsi: Preliminary support for alternate modes")
Cc: stable@vger.kernel.org
Reported-by: Zwane Mwaikambo <zwanem@gmail.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20200916090034.25119-3-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/usb/typec/ucsi/ucsi.c