Cleanup UCSI DisplayPort OOB fix

Recently I sent
https://patch.msgid.link/[email protected]
to prevent an OOB array index in the UCSI displayport driver. This merged to 7.3-rc2 but did not include feedback from reviewers in a v2 version of the patch here
https://lore.kernel.org/all/[email protected]/

This series reverts the v1 version of the patch merged to 7.3-rc2 then applies the fix including reviewer feedback. Because this series is cleaning up the previous change, and not needed to prevent the OOB access, I've removed the CC stable and Fixes tag from the displayport driver update.

Let mw know if you have any questions/concerns.

Jameson Thies (2):
Revert "usb: typec: ucsi: displayport: Fix OOB altmode array index"
usb: typec: ucsi: displayport: Check CAM to fix OOB altmode array
index

 drivers/usb/typec/ucsi/displayport.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

base-commit: 34c9c5517033a74039a54dfab24e7bf767a4e0e4

2.55.0.1007.g17ff1f9808-goog

This reverts commit 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18.

---
 drivers/usb/typec/ucsi/displayport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 8d2032d0762c..7067f2561b84 100644
@@ -74,7 +74,7 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
 		cur = 0xff;
 	}
 
-	if (cur < UCSI_MAX_ALTMODES) {
+	if (cur != 0xff) {
 		ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
 		goto err_unlock;
 	}

2.55.0.1007.g17ff1f9808-goog

The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.

Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array. If the current CAM is greater than UCSI_MAX_ALTMODES and not 0xff, return an invalid error from ucsi_displayport_enter().

---
 drivers/usb/typec/ucsi/displayport.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

index 7067f2561b84..572da7bbd29c 100644
@@ -71,11 +71,14 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
 	if (ret < 0) {
 		if (ucsi->version > 0x0100)
 			goto err_unlock;
-		cur = 0xff;
 	}
 
 	if (cur != 0xff) {
-		ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		if (cur < UCSI_MAX_ALTMODES)
+			ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		else
+			ret = -EINVAL;
+
 		goto err_unlock;
 	}
 

2.55.0.1007.g17ff1f9808-goog

I don't think this is necessary.

Thanks,

heikki

Hi Heikki, thanks for taking a look. Mentioned on the original thread, I'll send a fixup patch to make these changes.