Re: [PATCH] usb: typec: ucsi: Fix potential stack buffer overflow in altmode registration

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Jun 30, 2026 at 07:33:09PM +0800, DongliLiu wrote:
> From: DongliLiu <dongli.liu@outlook.com>
> Date: Mon, 30 Jun 2026 19:32:00 +0800
> Subject: [PATCH] usb: typec: ucsi: Fix potential stack buffer overflow in
> altmode registration

Odd, this shouldn't be in the email body.

> 
> cap.num_alt_modes is a u8 hardware register value with a range of 0-255.
> The altmode arrays in ucsi_register_altmodes_nvidia() are fixed at
> UCSI_MAX_ALTMODES (30) elements. Without clamping, a malicious or
> misbehaving hardware could report more than 30 alternate modes, causing
> a write beyond the stack-allocated array bounds.
> 
> Add min_t() to clamp max_altmodes to the array size, preventing the
> overflow.
> 
> Signed-off-by: DongliLiu <dongli.liu@outlook.com>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index xxxxxxx..yyyyyyy 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -xxx,yyy @@@ static int ucsi_register_altmodes_nvidia(struct
> ucsi_connector *con)
>      struct typec_altmode_desc alt[UCSI_MAX_ALTMODES];
>      struct ucsi_altmode orig[UCSI_MAX_ALTMODES];
> -    int max_altmodes = con->ucsi->cap.num_alt_modes;
> +    int max_altmodes = min_t(int, con->ucsi->cap.num_alt_modes,
> +                 UCSI_MAX_ALTMODES);

Patch is line-wrapped and corrupted and can not be applied :(

And no need to cc: security@kernel.org for a public issue like this.

thanks,

greg k-h