[PATCH v1 0/2] Cleanup UCSI DisplayPort OOB fix

[PATCH v1 0/2] Cleanup UCSI DisplayPort OOB fix

[Jameson Thies]

Recently I sent 
https://patch.msgid.link/20260825234545.2076049-1-jthies@google.com 
to prevent an OOB array index in the UCSI displayport driver. This
merged to 7.3-rc2 but did not include feedback from reviewers in a
v2 version of the patch here
https://lore.kernel.org/all/20260904234401.2339633-1-jthies@google.com/

This series reverts the v1 version of the patch merged to 7.3-rc2
then applies the fix including reviewer feedback. Because this
series is cleaning up the previous change, and not needed to prevent
the OOB access, I've removed the CC stable and Fixes tag from the
displayport driver update.

Let mw know if you have any questions/concerns.

Jameson Thies (2):
  Revert "usb: typec: ucsi: displayport: Fix OOB altmode array index"
  usb: typec: ucsi: displayport: Check CAM to fix OOB altmode array
    index

 drivers/usb/typec/ucsi/displayport.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)


base-commit: 34c9c5517033a74039a54dfab24e7bf767a4e0e4
-- 
2.55.0.1007.g17ff1f9808-goog

[PATCH v1 1/2] Revert "usb: typec: ucsi: displayport: Fix OOB altmode array index"

[Jameson Thies]

This reverts commit 04cec690b1fd9d1c4c314b91a10d8c68a3acfe18.

Signed-off-by: Jameson Thies <jthies@google.com>
---
 drivers/usb/typec/ucsi/displayport.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c
index 8d2032d0762c..7067f2561b84 100644
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -74,7 +74,7 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
 		cur = 0xff;
 	}
 
-	if (cur < UCSI_MAX_ALTMODES) {
+	if (cur != 0xff) {
 		ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
 		goto err_unlock;
 	}
-- 
2.55.0.1007.g17ff1f9808-goog

[PATCH v1 2/2] usb: typec: ucsi: displayport: Check CAM to fix OOB altmode array index

[Jameson Thies]

The UCSI displayport driver indexes the connector's port altmode array
with the GET_CURRENT_CAM response after checking it is not 0xff. The
port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM
returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and
not equal to 0xff, the kernel may crash with an array index OOB error.

Update the UCSI displayport driver to verify the current cam is less
than UCSI_MAX_ALTMODES before accessing the port altmode array. If the
current CAM is greater than UCSI_MAX_ALTMODES and not 0xff, return an
invalid error from ucsi_displayport_enter().

Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Jameson Thies <jthies@google.com>
---
 drivers/usb/typec/ucsi/displayport.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c
index 7067f2561b84..572da7bbd29c 100644
--- a/drivers/usb/typec/ucsi/displayport.c
+++ b/drivers/usb/typec/ucsi/displayport.c
@@ -71,11 +71,14 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
 	if (ret < 0) {
 		if (ucsi->version > 0x0100)
 			goto err_unlock;
-		cur = 0xff;
 	}
 
 	if (cur != 0xff) {
-		ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		if (cur < UCSI_MAX_ALTMODES)
+			ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		else
+			ret = -EINVAL;
+
 		goto err_unlock;
 	}
 
-- 
2.55.0.1007.g17ff1f9808-goog

Re: [PATCH v1 0/2] Cleanup UCSI DisplayPort OOB fix

[Heikki Krogerus]

On Thu, Sep 10, 2026 at 11:35:51PM +0000, Jameson Thies wrote:
> Recently I sent 
> https://patch.msgid.link/20260825234545.2076049-1-jthies@google.com 
> to prevent an OOB array index in the UCSI displayport driver. This
> merged to 7.3-rc2 but did not include feedback from reviewers in a
> v2 version of the patch here
> https://lore.kernel.org/all/20260904234401.2339633-1-jthies@google.com/
> 
> This series reverts the v1 version of the patch merged to 7.3-rc2
> then applies the fix including reviewer feedback. Because this
> series is cleaning up the previous change, and not needed to prevent
> the OOB access, I've removed the CC stable and Fixes tag from the
> displayport driver update.
> 
> Let mw know if you have any questions/concerns.

I don't think this is necessary.

Thanks,

-- 
heikki

Re: [PATCH v1 0/2] Cleanup UCSI DisplayPort OOB fix

[Jameson Thies]

On Fri, Sep 11, 2026 at 6:32 AM Heikki Krogerus
<heikki.krogerus@linux.intel.com> wrote:

> I don't think this is necessary.

Hi Heikki, thanks for taking a look. Mentioned on the original thread,
I'll send a fixup patch to make these changes.