From: Salvatore Bonaccorso <carnil@debian.org>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: xiaopeitux@foxmail.com, linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org, Pei Xiao <xiaopei01@kylinos.cn>,
Heikki Krogerus <heikki.krogerus@linux.intel.com>,
pdormeau@free.fr
Date: Sat, 17 Jan 2026 00:05:51 +0100 [thread overview]
Message-ID: <aWrET0wfgHNGd2cT@eldamar.lan> (raw)
Bcc:
Subject: Re: [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode
registration
Reply-To:
In-Reply-To: <2026011617-phantom-diploma-cd79@gregkh>
Hi Greg, hi Heikki
On Fri, Jan 16, 2026 at 12:22:42PM +0100, Greg KH wrote:
> On Thu, Jan 15, 2026 at 11:32:01AM +0800, xiaopeitux@foxmail.com wrote:
> > From: Pei Xiao <xiaopei01@kylinos.cn>
> >
> > Add boundary check to prevent array index out-of-bounds when PPM returns
> > more alternate modes than expected.
> >
> > log:
> > UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> > index 2 is out of range for type 'ucsi_altmode [2]'
> > CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1
> > Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> > Workqueue: events_long ucsi_init_work [typec_ucsi]
> > Call Trace:
> > <TASK>
> > dump_stack_lvl+0x5d/0x80
> > ubsan_epilogue+0x5/0x2b
> > __ubsan_handle_out_of_bounds.cold+0x54/0x59
> > ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> > ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> > ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> > process_one_work+0x192/0x350
> > worker_thread+0x25a/0x3a0
> >
> > Reported-by: Salvatore Bonaccorso <carnil@debian.org>
> > Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> > Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> > ---
> > drivers/usb/typec/ucsi/ucsi.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> > index a7b388dc7fa0..00575a8720cc 100644
> > --- a/drivers/usb/typec/ucsi/ucsi.c
> > +++ b/drivers/usb/typec/ucsi/ucsi.c
> > @@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
> > * incremented.
> > */
> > num = len / sizeof(alt[0]);
> > + if (num > ARRAY_SIZE(alt))
> > + num = ARRAY_SIZE(alt);
>
> As Heikki said, this is a broken hardware device, please fix that
> instead as it will not work with any other operating system either :)
Thanks a lot for looking into it. Pascal, can you pleas report this
issue then to the vendor as it is a firmware bug?
Regards,
Salvatore
reply other threads:[~2026-01-17 0:48 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aWrET0wfgHNGd2cT@eldamar.lan \
--to=carnil@debian.org \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=pdormeau@free.fr \
--cc=xiaopei01@kylinos.cn \
--cc=xiaopeitux@foxmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox