Re: [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration

[Greg KH]

On Thu, Jan 15, 2026 at 11:32:01AM +0800, xiaopeitux@xxxxxxxxxxx wrote:
> From: Pei Xiao <xiaopei01@xxxxxxxxxx>
> 
> Add boundary check to prevent array index out-of-bounds when PPM returns
> more alternate modes than expected.
> 
> log:
> UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> index 2 is out of range for type 'ucsi_altmode [2]'
> CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
> Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> Workqueue: events_long ucsi_init_work [typec_ucsi]
> Call Trace:
> <TASK>
> dump_stack_lvl+0x5d/0x80
> ubsan_epilogue+0x5/0x2b
> __ubsan_handle_out_of_bounds.cold+0x54/0x59
> ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> process_one_work+0x192/0x350
> worker_thread+0x25a/0x3a0
> 
> Reported-by: Salvatore Bonaccorso <carnil@xxxxxxxxxx>
> Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@xxxxxxxxxxx
> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index a7b388dc7fa0..00575a8720cc 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
>  		 * incremented.
>  		 */
>  		num = len / sizeof(alt[0]);
> +		if (num > ARRAY_SIZE(alt))
> +			num = ARRAY_SIZE(alt);

As Heikki said, this is a broken hardware device, please fix that
instead as it will not work with any other operating system either :)

thanks,

greg k-h