Heikki Krogerus

A potential array underflow issue has been identified in the Linux kernel, specifically in the `ucsi ccg sync control()` function. The `command` variable can be controlled by the user via debugfs, which poses a risk if `con index` is zero, potentially leading to an array underflow. The issue arises when accessing `&uc->ucsi->connector[con index - 1]`.

The issue is related to a potential out of bounds condition in the `ucsi ccg update set new cam cmd()` function. The `*cmd` variable can be controlled by the user via debugfs, allowing `new cam` to be as high as 255, while the size of the `uc->updated[]` array is `UCSI MAX ALTMODES` (30). The call tree involves several functions, including `ucsi cmd()`, `ucsi send command()`, `ucsi send command common()`, `ucsi run command()`, and `ucsi ccg sync control()`. This could potentially impact the confidentiality and availability of protected information.

A null pointer dereference issue has been resolved in the Linux kernel. The issue occurs when `ucsi register altmode` checks `IS ERR` for the `alt` pointer and treats `NULL` as valid. When `CONFIG TYPEC DP ALTMODE` is not enabled, `ucsi register displayport` returns `NULL`, causing a null pointer dereference in trace. To fix this, `typec port register altmode` is called to register DisplayPort alternate mode as a non-controllable mode when `CONFIG TYPEC DP ALTMODE` is not enabled.