Re: [PATCH v1] usb: typec: ucsi: displayport: Fix OOB altmode array index

[Andrei Kuchynski]

On Mon, Aug 31, 2026 at 12:37 PM Heikki Krogerus
<heikki.krogerus@xxxxxxxxxxxxxxx> wrote:
>
> On Tue, Aug 25, 2026 at 11:45:45PM +0000, Jameson Thies wrote:
> > The UCSI displayport driver indexes the connector's port altmode array
> > with the GET_CURRENT_CAM response after checking it is not 0xff. The
> > port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM
> > returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and
> > not equal to 0xff, the kernel may crash with an array index OOB error.
> >
> > Update the UCSI displayport driver to verify the current cam is less
> > than UCSI_MAX_ALTMODES before accessing the port altmode array.
> >
> > Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
> > Cc: stable@xxxxxxxxxxxxxxx
> > Signed-off-by: Jameson Thies <jthies@xxxxxxxxxx>
> > ---
> >  drivers/usb/typec/ucsi/displayport.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c
> > index 7067f2561b84..8d2032d0762c 100644
> > --- a/drivers/usb/typec/ucsi/displayport.c
> > +++ b/drivers/usb/typec/ucsi/displayport.c
> > @@ -74,7 +74,7 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
> >               cur = 0xff;
>
> Can you remove the above line while at it?
>
> >       }
> >
> > -     if (cur != 0xff) {
> > +     if (cur < UCSI_MAX_ALTMODES) {
>
> Shouldn't that be the other way around?
>

Looks fine, but shouldn't we return an error if an invalid value is
received, similar to the Thunderbolt implementation?

        if (cur != 0xff) {
                if (cur >= UCSI_MAX_ALTMODES ||
dp->con->port_altmode[cur] != alt)
                        ret = -EBUSY;
                else
                        ret = 0;
                goto err_unlock;

Thanks,
Andrei