UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]'

UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]'

[Salvatore Bonaccorso]

Control: forwarded -1 https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
Hi

Pascal reported in Debian in https://bugs.debian.org/1123987 a problem
catched by UBSAN in drivers/usb/typec/ucsi/ucsi.c:

[  +1,022859] ------------[ cut here ]------------
[  +0,000008] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12
[  +0,001186] index 2 is out of range for type 'ucsi_altmode [2]'
[  +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
[  +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
[  +0,000002] Workqueue: events_long ucsi_init_work [typec_ucsi]
[  +0,000010] Call Trace:
[  +0,000003]  <TASK>
[  +0,000003]  dump_stack_lvl+0x5d/0x80
[  +0,000007]  ubsan_epilogue+0x5/0x2b
[  +0,000005]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
[  +0,000007]  ucsi_register_altmodes+0x214/0x250 [typec_ucsi]
[  +0,000007]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
[  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
[  +0,000005]  process_one_work+0x192/0x350
[  +0,000006]  worker_thread+0x25a/0x3a0
[  +0,000004]  ? __pfx_worker_thread+0x10/0x10
[  +0,000003]  kthread+0xfc/0x240
[  +0,000003]  ? __pfx_kthread+0x10/0x10
[  +0,000002]  ? __pfx_kthread+0x10/0x10
[  +0,000002]  ret_from_fork+0x197/0x1c0
[  +0,000005]  ? __pfx_kthread+0x10/0x10
[  +0,000002]  ret_from_fork_asm+0x1a/0x30
[  +0,000008]  </TASK>
[  +0,000001] ---[ end trace ]---
[  +0,000006] ------------[ cut here ]------------
[  +0,000002] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
[  +0,000579] index 2 is out of range for type 'ucsi_altmode [2]'
[  +0,000562] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
[  +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
[  +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
[  +0,000005] Call Trace:
[  +0,000001]  <TASK>
[  +0,000001]  dump_stack_lvl+0x5d/0x80
[  +0,000004]  ubsan_epilogue+0x5/0x2b
[  +0,000003]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
[  +0,000005]  ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
[  +0,000006]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
[  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
[  +0,000005]  process_one_work+0x192/0x350
[  +0,000004]  worker_thread+0x25a/0x3a0
[  +0,000004]  ? __pfx_worker_thread+0x10/0x10
[  +0,000003]  kthread+0xfc/0x240
[  +0,000002]  ? __pfx_kthread+0x10/0x10
[  +0,000002]  ? __pfx_kthread+0x10/0x10
[  +0,000003]  ret_from_fork+0x197/0x1c0
[  +0,000003]  ? __pfx_kthread+0x10/0x10
[  +0,000002]  ret_from_fork_asm+0x1a/0x30
[  +0,000006]  </TASK>
[  +0,000001] ---[ end trace ]---
[  +0,000006] ------------[ cut here ]------------
[  +0,000001] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:610:19
[  +0,000608] index 2 is out of range for type 'ucsi_altmode [2]'
[  +0,000597] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
[  +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
[  +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
[  +0,000004] Call Trace:
[  +0,000002]  <TASK>
[  +0,000001]  dump_stack_lvl+0x5d/0x80
[  +0,000004]  ubsan_epilogue+0x5/0x2b
[  +0,000003]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
[  +0,000004]  ucsi_register_altmodes+0x1fa/0x250 [typec_ucsi]
[  +0,000006]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
[  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
[  +0,000006]  process_one_work+0x192/0x350
[  +0,000004]  worker_thread+0x25a/0x3a0
[  +0,000003]  ? __pfx_worker_thread+0x10/0x10
[  +0,000003]  kthread+0xfc/0x240
[  +0,000002]  ? __pfx_kthread+0x10/0x10
[  +0,000002]  ? __pfx_kthread+0x10/0x10
[  +0,000003]  ret_from_fork+0x197/0x1c0
[  +0,000003]  ? __pfx_kthread+0x10/0x10
[  +0,000002]  ret_from_fork_asm+0x1a/0x30
[  +0,000006]  </TASK>
[  +0,000001] ---[ end trace ]---

While I initially asked if Pascal can check as well mainline additionally to
the tested 6.18.2 version, the problematic code seems still present, so I'm
forwarding it now.

Regards,
Salvatore

[RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration

[xiaopeitux]

From: Pei Xiao <xiaopei01@kylinos.cn>

Add boundary check to prevent array index out-of-bounds when PPM returns
more alternate modes than expected.

log:
UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
index 2 is out of range for type 'ucsi_altmode [2]'
CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
Workqueue: events_long ucsi_init_work [typec_ucsi]
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
ubsan_epilogue+0x5/0x2b
__ubsan_handle_out_of_bounds.cold+0x54/0x59
ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
ucsi_init_work+0x919/0x9b0 [typec_ucsi]
process_one_work+0x192/0x350
worker_thread+0x25a/0x3a0

Reported-by: Salvatore Bonaccorso <carnil@debian.org>
Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
---
 drivers/usb/typec/ucsi/ucsi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index a7b388dc7fa0..00575a8720cc 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
 		 * incremented.
 		 */
 		num = len / sizeof(alt[0]);
+		if (num > ARRAY_SIZE(alt))
+			num = ARRAY_SIZE(alt);
 		i += num;
 
 		for (j = 0; j < num; j++) {
-- 
2.25.1

Re: [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration

[Greg KH]

On Thu, Jan 15, 2026 at 11:32:01AM +0800, xiaopeitux@foxmail.com wrote:
> From: Pei Xiao <xiaopei01@kylinos.cn>
> 
> Add boundary check to prevent array index out-of-bounds when PPM returns
> more alternate modes than expected.
> 
> log:
> UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> index 2 is out of range for type 'ucsi_altmode [2]'
> CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
> Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> Workqueue: events_long ucsi_init_work [typec_ucsi]
> Call Trace:
> <TASK>
> dump_stack_lvl+0x5d/0x80
> ubsan_epilogue+0x5/0x2b
> __ubsan_handle_out_of_bounds.cold+0x54/0x59
> ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> process_one_work+0x192/0x350
> worker_thread+0x25a/0x3a0
> 
> Reported-by: Salvatore Bonaccorso <carnil@debian.org>
> Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index a7b388dc7fa0..00575a8720cc 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
>  		 * incremented.
>  		 */
>  		num = len / sizeof(alt[0]);
> +		if (num > ARRAY_SIZE(alt))
> +			num = ARRAY_SIZE(alt);

As Heikki said, this is a broken hardware device, please fix that
instead as it will not work with any other operating system either :)

thanks,

greg k-h

Re: [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration

[Salvatore Bonaccorso]

Hi Greg, hi Heikki

[sorry for getting this twice, my former email was broken]

On Fri, Jan 16, 2026 at 12:22:42PM +0100, Greg KH wrote:
> On Thu, Jan 15, 2026 at 11:32:01AM +0800, xiaopeitux@foxmail.com wrote:
> > From: Pei Xiao <xiaopei01@kylinos.cn>
> > 
> > Add boundary check to prevent array index out-of-bounds when PPM returns
> > more alternate modes than expected.
> > 
> > log:
> > UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> > index 2 is out of range for type 'ucsi_altmode [2]'
> > CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
> > Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> > Workqueue: events_long ucsi_init_work [typec_ucsi]
> > Call Trace:
> > <TASK>
> > dump_stack_lvl+0x5d/0x80
> > ubsan_epilogue+0x5/0x2b
> > __ubsan_handle_out_of_bounds.cold+0x54/0x59
> > ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> > ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> > ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> > process_one_work+0x192/0x350
> > worker_thread+0x25a/0x3a0
> > 
> > Reported-by: Salvatore Bonaccorso <carnil@debian.org>
> > Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> > Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> > ---
> >  drivers/usb/typec/ucsi/ucsi.c | 2 ++
> >  1 file changed, 2 insertions(+)
> > 
> > diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> > index a7b388dc7fa0..00575a8720cc 100644
> > --- a/drivers/usb/typec/ucsi/ucsi.c
> > +++ b/drivers/usb/typec/ucsi/ucsi.c
> > @@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
> >  		 * incremented.
> >  		 */
> >  		num = len / sizeof(alt[0]);
> > +		if (num > ARRAY_SIZE(alt))
> > +			num = ARRAY_SIZE(alt);
> 
> As Heikki said, this is a broken hardware device, please fix that
> instead as it will not work with any other operating system either :)

Thanks a lot for looking into it. Pascal, can you pleas report this
issue then to the vendor as it is a firmware bug?

Regards,
Salvatore

Re: UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi_altmode [2]'

[Heikki Krogerus]

Hi,

Wed, Jan 14, 2026 at 05:58:54PM +0100, Salvatore Bonaccorso kirjoitti:
> Control: forwarded -1 https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> Hi
> 
> Pascal reported in Debian in https://bugs.debian.org/1123987 a problem
> catched by UBSAN in drivers/usb/typec/ucsi/ucsi.c:
> 
> [  +1,022859] ------------[ cut here ]------------
> [  +0,000008] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12
> [  +0,001186] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
> [  +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025

This is a firmware bug. The interface on this system is returning more
than the maximum of 12 bytes to the UCSI command GET_ALTERNATE_MODES.
You guys need to be reporte this to Lenovo.

I should point out that the driver in Linux requests only a single
alternate mode with the GET_ALTERNATE_MODE command by leaving the
"Number of Alternate Modes" to 0 (the actual number of alternate modes
is the value of that field plus 1 - Table 6-24: GET_ALTERNATE_MODES
Command in UCSI specification). That means the interface should only
return 6 bytes (that's the size of a single alt mode description in
UCSI).

Br,

-- 
heikki