Re: [PATCH v2] usb: typec: ucsi: displayport: Fix OOB altmode array index

[Greg KH]

On Fri, Sep 04, 2026 at 11:44:01PM +0000, Jameson Thies wrote:
> The UCSI displayport driver indexes the connector's port altmode array
> with the GET_CURRENT_CAM response after checking it is not 0xff. The
> port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM
> returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and
> not equal to 0xff, the kernel may crash with an array index OOB error.
> 
> Update the UCSI displayport driver to verify the current cam is less
> than UCSI_MAX_ALTMODES before accessing the port altmode array.
> 
> Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Jameson Thies <jthies@xxxxxxxxxx>
> ---
> Changes in v2:
>  - removed 0xff alt mode assignement when GET_CURRENT_CAM returns an error.
>  - return -EINVAL when alt mode index above UCSI_MAX_ALTMODES is returned.

Does not apply against 7.3-rc2 :(