* UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]'
@ 2026-01-14 16:58 Salvatore Bonaccorso
2026-01-15 3:32 ` [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration xiaopeitux
2026-01-15 9:27 ` UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]' Heikki Krogerus
0 siblings, 2 replies; 5+ messages in thread
From: Salvatore Bonaccorso @ 2026-01-14 16:58 UTC (permalink / raw)
To: Heikki Krogerus, Greg Kroah-Hartman, pdormeau
Cc: linux-usb, linux-kernel, 1123987
Control: forwarded -1 https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
Hi
Pascal reported in Debian in https://bugs.debian.org/1123987 a problem
catched by UBSAN in drivers/usb/typec/ucsi/ucsi.c:
[ +1,022859] ------------[ cut here ]------------
[ +0,000008] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12
[ +0,001186] index 2 is out of range for type 'ucsi_altmode [2]'
[ +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
[ +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
[ +0,000002] Workqueue: events_long ucsi_init_work [typec_ucsi]
[ +0,000010] Call Trace:
[ +0,000003] <TASK>
[ +0,000003] dump_stack_lvl+0x5d/0x80
[ +0,000007] ubsan_epilogue+0x5/0x2b
[ +0,000005] __ubsan_handle_out_of_bounds.cold+0x54/0x59
[ +0,000007] ucsi_register_altmodes+0x214/0x250 [typec_ucsi]
[ +0,000007] ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
[ +0,000004] ucsi_init_work+0x919/0x9b0 [typec_ucsi]
[ +0,000005] process_one_work+0x192/0x350
[ +0,000006] worker_thread+0x25a/0x3a0
[ +0,000004] ? __pfx_worker_thread+0x10/0x10
[ +0,000003] kthread+0xfc/0x240
[ +0,000003] ? __pfx_kthread+0x10/0x10
[ +0,000002] ? __pfx_kthread+0x10/0x10
[ +0,000002] ret_from_fork+0x197/0x1c0
[ +0,000005] ? __pfx_kthread+0x10/0x10
[ +0,000002] ret_from_fork_asm+0x1a/0x30
[ +0,000008] </TASK>
[ +0,000001] ---[ end trace ]---
[ +0,000006] ------------[ cut here ]------------
[ +0,000002] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
[ +0,000579] index 2 is out of range for type 'ucsi_altmode [2]'
[ +0,000562] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
[ +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
[ +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
[ +0,000005] Call Trace:
[ +0,000001] <TASK>
[ +0,000001] dump_stack_lvl+0x5d/0x80
[ +0,000004] ubsan_epilogue+0x5/0x2b
[ +0,000003] __ubsan_handle_out_of_bounds.cold+0x54/0x59
[ +0,000005] ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
[ +0,000006] ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
[ +0,000004] ucsi_init_work+0x919/0x9b0 [typec_ucsi]
[ +0,000005] process_one_work+0x192/0x350
[ +0,000004] worker_thread+0x25a/0x3a0
[ +0,000004] ? __pfx_worker_thread+0x10/0x10
[ +0,000003] kthread+0xfc/0x240
[ +0,000002] ? __pfx_kthread+0x10/0x10
[ +0,000002] ? __pfx_kthread+0x10/0x10
[ +0,000003] ret_from_fork+0x197/0x1c0
[ +0,000003] ? __pfx_kthread+0x10/0x10
[ +0,000002] ret_from_fork_asm+0x1a/0x30
[ +0,000006] </TASK>
[ +0,000001] ---[ end trace ]---
[ +0,000006] ------------[ cut here ]------------
[ +0,000001] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:610:19
[ +0,000608] index 2 is out of range for type 'ucsi_altmode [2]'
[ +0,000597] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
[ +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
[ +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
[ +0,000004] Call Trace:
[ +0,000002] <TASK>
[ +0,000001] dump_stack_lvl+0x5d/0x80
[ +0,000004] ubsan_epilogue+0x5/0x2b
[ +0,000003] __ubsan_handle_out_of_bounds.cold+0x54/0x59
[ +0,000004] ucsi_register_altmodes+0x1fa/0x250 [typec_ucsi]
[ +0,000006] ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
[ +0,000004] ucsi_init_work+0x919/0x9b0 [typec_ucsi]
[ +0,000006] process_one_work+0x192/0x350
[ +0,000004] worker_thread+0x25a/0x3a0
[ +0,000003] ? __pfx_worker_thread+0x10/0x10
[ +0,000003] kthread+0xfc/0x240
[ +0,000002] ? __pfx_kthread+0x10/0x10
[ +0,000002] ? __pfx_kthread+0x10/0x10
[ +0,000003] ret_from_fork+0x197/0x1c0
[ +0,000003] ? __pfx_kthread+0x10/0x10
[ +0,000002] ret_from_fork_asm+0x1a/0x30
[ +0,000006] </TASK>
[ +0,000001] ---[ end trace ]---
While I initially asked if Pascal can check as well mainline additionally to
the tested 6.18.2 version, the problematic code seems still present, so I'm
forwarding it now.
Regards,
Salvatore
^ permalink raw reply [flat|nested] 5+ messages in thread
* [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration
2026-01-14 16:58 UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]' Salvatore Bonaccorso
@ 2026-01-15 3:32 ` xiaopeitux
2026-01-16 11:22 ` Greg KH
2026-01-15 9:27 ` UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]' Heikki Krogerus
1 sibling, 1 reply; 5+ messages in thread
From: xiaopeitux @ 2026-01-15 3:32 UTC (permalink / raw)
To: gregkh, linux-usb, linux-kernel; +Cc: Pei Xiao, Salvatore Bonaccorso
From: Pei Xiao <xiaopei01@kylinos.cn>
Add boundary check to prevent array index out-of-bounds when PPM returns
more alternate modes than expected.
log:
UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
index 2 is out of range for type 'ucsi_altmode [2]'
CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
Workqueue: events_long ucsi_init_work [typec_ucsi]
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
ubsan_epilogue+0x5/0x2b
__ubsan_handle_out_of_bounds.cold+0x54/0x59
ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
ucsi_init_work+0x919/0x9b0 [typec_ucsi]
process_one_work+0x192/0x350
worker_thread+0x25a/0x3a0
Reported-by: Salvatore Bonaccorso <carnil@debian.org>
Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
---
drivers/usb/typec/ucsi/ucsi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index a7b388dc7fa0..00575a8720cc 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
* incremented.
*/
num = len / sizeof(alt[0]);
+ if (num > ARRAY_SIZE(alt))
+ num = ARRAY_SIZE(alt);
i += num;
for (j = 0; j < num; j++) {
--
2.25.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]'
2026-01-14 16:58 UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]' Salvatore Bonaccorso
2026-01-15 3:32 ` [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration xiaopeitux
@ 2026-01-15 9:27 ` Heikki Krogerus
1 sibling, 0 replies; 5+ messages in thread
From: Heikki Krogerus @ 2026-01-15 9:27 UTC (permalink / raw)
To: Salvatore Bonaccorso
Cc: Greg Kroah-Hartman, pdormeau, linux-usb, linux-kernel, 1123987
Hi,
Wed, Jan 14, 2026 at 05:58:54PM +0100, Salvatore Bonaccorso kirjoitti:
> Control: forwarded -1 https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> Hi
>
> Pascal reported in Debian in https://bugs.debian.org/1123987 a problem
> catched by UBSAN in drivers/usb/typec/ucsi/ucsi.c:
>
> [ +1,022859] ------------[ cut here ]------------
> [ +0,000008] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12
> [ +0,001186] index 2 is out of range for type 'ucsi_altmode [2]'
> [ +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
> [ +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
This is a firmware bug. The interface on this system is returning more
than the maximum of 12 bytes to the UCSI command GET_ALTERNATE_MODES.
You guys need to be reporte this to Lenovo.
I should point out that the driver in Linux requests only a single
alternate mode with the GET_ALTERNATE_MODE command by leaving the
"Number of Alternate Modes" to 0 (the actual number of alternate modes
is the value of that field plus 1 - Table 6-24: GET_ALTERNATE_MODES
Command in UCSI specification). That means the interface should only
return 6 bytes (that's the size of a single alt mode description in
UCSI).
Br,
--
heikki
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration
2026-01-15 3:32 ` [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration xiaopeitux
@ 2026-01-16 11:22 ` Greg KH
2026-01-16 23:08 ` Salvatore Bonaccorso
0 siblings, 1 reply; 5+ messages in thread
From: Greg KH @ 2026-01-16 11:22 UTC (permalink / raw)
To: xiaopeitux; +Cc: linux-usb, linux-kernel, Pei Xiao, Salvatore Bonaccorso
On Thu, Jan 15, 2026 at 11:32:01AM +0800, xiaopeitux@foxmail.com wrote:
> From: Pei Xiao <xiaopei01@kylinos.cn>
>
> Add boundary check to prevent array index out-of-bounds when PPM returns
> more alternate modes than expected.
>
> log:
> UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> index 2 is out of range for type 'ucsi_altmode [2]'
> CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
> Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> Workqueue: events_long ucsi_init_work [typec_ucsi]
> Call Trace:
> <TASK>
> dump_stack_lvl+0x5d/0x80
> ubsan_epilogue+0x5/0x2b
> __ubsan_handle_out_of_bounds.cold+0x54/0x59
> ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> process_one_work+0x192/0x350
> worker_thread+0x25a/0x3a0
>
> Reported-by: Salvatore Bonaccorso <carnil@debian.org>
> Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> ---
> drivers/usb/typec/ucsi/ucsi.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index a7b388dc7fa0..00575a8720cc 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
> * incremented.
> */
> num = len / sizeof(alt[0]);
> + if (num > ARRAY_SIZE(alt))
> + num = ARRAY_SIZE(alt);
As Heikki said, this is a broken hardware device, please fix that
instead as it will not work with any other operating system either :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration
2026-01-16 11:22 ` Greg KH
@ 2026-01-16 23:08 ` Salvatore Bonaccorso
0 siblings, 0 replies; 5+ messages in thread
From: Salvatore Bonaccorso @ 2026-01-16 23:08 UTC (permalink / raw)
To: Greg KH
Cc: xiaopeitux, linux-usb, linux-kernel, Pei Xiao, Heikki Krogerus,
pdormeau
Hi Greg, hi Heikki
[sorry for getting this twice, my former email was broken]
On Fri, Jan 16, 2026 at 12:22:42PM +0100, Greg KH wrote:
> On Thu, Jan 15, 2026 at 11:32:01AM +0800, xiaopeitux@foxmail.com wrote:
> > From: Pei Xiao <xiaopei01@kylinos.cn>
> >
> > Add boundary check to prevent array index out-of-bounds when PPM returns
> > more alternate modes than expected.
> >
> > log:
> > UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> > index 2 is out of range for type 'ucsi_altmode [2]'
> > CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
> > Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> > Workqueue: events_long ucsi_init_work [typec_ucsi]
> > Call Trace:
> > <TASK>
> > dump_stack_lvl+0x5d/0x80
> > ubsan_epilogue+0x5/0x2b
> > __ubsan_handle_out_of_bounds.cold+0x54/0x59
> > ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> > ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> > ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> > process_one_work+0x192/0x350
> > worker_thread+0x25a/0x3a0
> >
> > Reported-by: Salvatore Bonaccorso <carnil@debian.org>
> > Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> > Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> > ---
> > drivers/usb/typec/ucsi/ucsi.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> > index a7b388dc7fa0..00575a8720cc 100644
> > --- a/drivers/usb/typec/ucsi/ucsi.c
> > +++ b/drivers/usb/typec/ucsi/ucsi.c
> > @@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
> > * incremented.
> > */
> > num = len / sizeof(alt[0]);
> > + if (num > ARRAY_SIZE(alt))
> > + num = ARRAY_SIZE(alt);
>
> As Heikki said, this is a broken hardware device, please fix that
> instead as it will not work with any other operating system either :)
Thanks a lot for looking into it. Pascal, can you pleas report this
issue then to the vendor as it is a firmware bug?
Regards,
Salvatore
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-01-17 1:06 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-14 16:58 UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]' Salvatore Bonaccorso
2026-01-15 3:32 ` [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration xiaopeitux
2026-01-16 11:22 ` Greg KH
2026-01-16 23:08 ` Salvatore Bonaccorso
2026-01-15 9:27 ` UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]' Heikki Krogerus
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox