Re: [PATCH] usb: typec: Check the alternate mode ID allocation

[Changyul Lee]

On Wed, Nov 11, 2026 at 04:04:17PM +0100, Heikki Krogerus wrote:
> On Tue, Nov 10, 2026 at 11:14:46PM -0500, Changyul Lee wrote:
> > Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
> > Signed-off-by: Changyul Lee <lcy8047@xxxxxxxxx>
>
> CC stable...

I'll add the stable Cc tag and send a v2.

Thank you,
Changyul

2026=EB=85=84 11=EC=9B=94 11=EC=9D=BC (=EC=88=98) =EC=98=A4=EC=A0=84 10:04,=
 Heikki Krogerus
<heikki.krogerus@xxxxxxxxxxxxxxx>=EB=8B=98=EC=9D=B4 =EC=9E=91=EC=84=B1:
>
> On Tue, Nov 10, 2026 at 11:14:46PM -0500, Changyul Lee wrote:
> > typec_register_altmode() stores the return value of altmode_id_get()
> > in an unsigned int without checking it. When ida_alloc() fails, the
> > error code becomes the ID, and the alternate mode is registered under
> > a name such as "port0-partner.4294967284". A second failure on the same
> > partner then fails with a duplicate name:
> >
> >   [    0.423055] sysfs: cannot create duplicate filename '/devices/plat=
form/altfail/typec/port0/port0-partner/port0-partner.4294967284'
> >
> > Return the error when the ID allocation fails.
> >
> > Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
> > Signed-off-by: Changyul Lee <lcy8047@xxxxxxxxx>
>
> CC stable...
>
> > ---
> > Found with a static analysis tool we are developing.
> >
> > Reproduced in QEMU (x86_64) with a test module that registers a port,
> > a partner and 63 partner alternate modes, and then two more with
> > failslab (task-filter) making ida_alloc() fail with -ENOMEM. Without
> > this patch, the first of the two is registered as
> > "port0-partner.4294967284" and the second fails with -EEXIST and the
> > error above. With it, both return -ENOMEM. Same result in three runs
> > each.
> >
> >  drivers/usb/typec/class.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> > index 54c7810b563b..29fb13ca9f28 100644
> > --- a/drivers/usb/typec/class.c
> > +++ b/drivers/usb/typec/class.c
> > @@ -641,11 +641,14 @@ typec_register_altmode(struct device *parent,
> >                      const struct typec_altmode_desc *desc,
> >                      const struct device_type *type)
> >  {
> > -     unsigned int id =3D altmode_id_get(parent);
> > +     int id =3D altmode_id_get(parent);
> >       bool is_port =3D is_typec_port(parent);
> >       struct altmode *alt;
> >       int ret;
> >
> > +     if (id < 0)
> > +             return ERR_PTR(id);
> > +
> >       alt =3D kzalloc_obj(*alt);
> >       if (!alt) {
> >               altmode_id_remove(parent, id);
> >
> > base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> > --
> > 2.43.0
> >
>
> --
> heikki