[PATCH] usb: typec: ucsi: Fix potential stack buffer overflow in altmode registration

[PATCH] usb: typec: ucsi: Fix potential stack buffer overflow in altmode registration

[DongliLiu]

From: DongliLiu <dongli.liu@outlook.com>
Date: Mon, 30 Jun 2026 19:32:00 +0800
Subject: [PATCH] usb: typec: ucsi: Fix potential stack buffer overflow 
in altmode registration

cap.num_alt_modes is a u8 hardware register value with a range of 0-255.
The altmode arrays in ucsi_register_altmodes_nvidia() are fixed at
UCSI_MAX_ALTMODES (30) elements. Without clamping, a malicious or
misbehaving hardware could report more than 30 alternate modes, causing
a write beyond the stack-allocated array bounds.

Add min_t() to clamp max_altmodes to the array size, preventing the
overflow.

Signed-off-by: DongliLiu <dongli.liu@outlook.com>
---
  drivers/usb/typec/ucsi/ucsi.c | 3 ++-
  1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index xxxxxxx..yyyyyyy 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -xxx,yyy @@@ static int ucsi_register_altmodes_nvidia(struct 
ucsi_connector *con)
      struct typec_altmode_desc alt[UCSI_MAX_ALTMODES];
      struct ucsi_altmode orig[UCSI_MAX_ALTMODES];
-    int max_altmodes = con->ucsi->cap.num_alt_modes;
+    int max_altmodes = min_t(int, con->ucsi->cap.num_alt_modes,
+                 UCSI_MAX_ALTMODES);
      int i, k = 0;

      for (i = 0; i < max_altmodes; i++) {
-- 
2.40.0

Re: [PATCH] usb: typec: ucsi: Fix potential stack buffer overflow in altmode registration

[Greg KH]

On Tue, Jun 30, 2026 at 07:33:09PM +0800, DongliLiu wrote:
> From: DongliLiu <dongli.liu@outlook.com>
> Date: Mon, 30 Jun 2026 19:32:00 +0800
> Subject: [PATCH] usb: typec: ucsi: Fix potential stack buffer overflow in
> altmode registration

Odd, this shouldn't be in the email body.

> 
> cap.num_alt_modes is a u8 hardware register value with a range of 0-255.
> The altmode arrays in ucsi_register_altmodes_nvidia() are fixed at
> UCSI_MAX_ALTMODES (30) elements. Without clamping, a malicious or
> misbehaving hardware could report more than 30 alternate modes, causing
> a write beyond the stack-allocated array bounds.
> 
> Add min_t() to clamp max_altmodes to the array size, preventing the
> overflow.
> 
> Signed-off-by: DongliLiu <dongli.liu@outlook.com>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index xxxxxxx..yyyyyyy 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -xxx,yyy @@@ static int ucsi_register_altmodes_nvidia(struct
> ucsi_connector *con)
>      struct typec_altmode_desc alt[UCSI_MAX_ALTMODES];
>      struct ucsi_altmode orig[UCSI_MAX_ALTMODES];
> -    int max_altmodes = con->ucsi->cap.num_alt_modes;
> +    int max_altmodes = min_t(int, con->ucsi->cap.num_alt_modes,
> +                 UCSI_MAX_ALTMODES);

Patch is line-wrapped and corrupted and can not be applied :(

And no need to cc: security@kernel.org for a public issue like this.

thanks,

greg k-h