linux/drivers/usb
Subbaraman Narayanamurthy cd04f7fab9 ANDROID: usb: typec: ucsi: Ensure bounds check when accessing src_pdos
Currently, when reading the following properties under
ucsi-source-psy-*, src_pdos array is accessed but it only checks
for the condition num_pdos > 0.

- voltage_max
- voltage_now
- current_max

In the case if a PPM passes num_pdos greater than UCSI_MAX_PDOS,
an OOB access can be made. Fix it by checking the upper bound for
src_pdos which is UCSI_MAX_PDOS.

This issue is detected by enabling UBSAN.

Bug: 186400956
Fixes: 992a60ed0d ("usb: typec: ucsi: register with power_supply class")
Fixes: 4dbc6a4ef0 ("usb: typec: ucsi: save power data objects in PD mode")
Change-Id: Id0aca674208b23329be089671cba873baca930cf
Signed-off-by: Subbaraman Narayanamurthy <quic_subbaram@quicinc.com>
2021-05-11 09:07:13 +00:00
..
atm
c67x00 Linux 5.9-rc3 2020-08-31 07:11:45 +02:00
cdns3 usb: cdns3: fix NULL pointer dereference on no platform data 2021-03-11 14:17:26 +01:00
chipidea usb: chipidea: ci_hdrc_imx: add missing put_device() call in usbmisc_get_init_data() 2021-01-12 20:18:19 +01:00
class USB: CDC-ACM: fix poison/unpoison imbalance 2021-04-28 13:40:02 +02:00
common FROMGIT: usb: common: move function's kerneldoc next to its definition 2021-03-08 16:15:00 +01:00
core Merge 5.10.35 into android12-5.10 2021-05-08 12:45:00 +02:00
dwc2 FROMGIT: usb: dwc2: Fix gadget DMA unmap direction 2021-05-10 14:51:38 +02:00
dwc3 FROMGIT: usb: dwc3: omap: improve extcon initialization 2021-05-10 15:05:13 +02:00
early usb: early: ehci-dbgp: convert to readl_poll_timeout_atomic() 2020-09-25 16:29:09 +02:00
gadget FROMGIT: usb: gadget: Fix double free of device descriptor pointers 2021-04-22 13:57:57 +00:00
host ANDROID: usb: host: Use old init scheme when hook unavailable 2021-04-13 23:22:23 +00:00
image USB: microtek: use set_host_byte() 2020-09-16 12:42:10 +02:00
isp1760 usb: isp1760-hcd: convert to readl_poll_timeout_atomic() 2020-09-25 16:30:05 +02:00
misc USB: yurex: fix control-URB timeout handling 2021-01-12 20:18:20 +01:00
mon
mtu3 usb: mtu3: fix memory corruption in mtu3_debugfs_regset() 2020-12-26 16:02:38 +01:00
musb usb: musb: Fix suspend with devices connected for a64 2021-04-07 15:00:12 +02:00
phy usb: phy: phy-ab8500-usb: fix spello of "function" 2020-10-02 09:57:41 +03:00
renesas_usbhs usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM 2021-03-17 17:06:29 +01:00
roles device connection: Remove struct device_connection 2020-09-07 11:14:09 +02:00
serial USB: serial: cp210x: add some more GE USB IDs 2021-03-17 17:06:30 +01:00
storage usb-storage: Add quirk to defeat Kindle's automatic unload 2021-03-25 09:04:14 +01:00
typec ANDROID: usb: typec: ucsi: Ensure bounds check when accessing src_pdos 2021-05-11 09:07:13 +00:00
usbip usbip: synchronize event handler with sysfs code paths 2021-04-14 08:42:03 +02:00
Kconfig
Makefile
usb-skeleton.c