linux-kernel - [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_A6F79CBEAB47840EB720951FA48D97CD4906@qq.com>
Date: Thu, 15 Jan 2026 11:32:01 +0800
From: xiaopeitux@...mail.com
To: gregkh@...uxfoundation.org,
	linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: Pei Xiao <xiaopei01@...inos.cn>,
	Salvatore Bonaccorso <carnil@...ian.org>
Subject: [RFC] usb: typec: ucsi: Fix array index out-of-bounds in altmode registration

From: Pei Xiao <xiaopei01@...inos.cn>

Add boundary check to prevent array index out-of-bounds when PPM returns
more alternate modes than expected.

log:
UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
index 2 is out of range for type 'ucsi_altmode [2]'
CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
Workqueue: events_long ucsi_init_work [typec_ucsi]
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x80
ubsan_epilogue+0x5/0x2b
__ubsan_handle_out_of_bounds.cold+0x54/0x59
ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
ucsi_init_work+0x919/0x9b0 [typec_ucsi]
process_one_work+0x192/0x350
worker_thread+0x25a/0x3a0

Reported-by: Salvatore Bonaccorso <carnil@...ian.org>
Closes: https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
Signed-off-by: Pei Xiao <xiaopei01@...inos.cn>
---
 drivers/usb/typec/ucsi/ucsi.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index a7b388dc7fa0..00575a8720cc 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -599,6 +599,8 @@ static int ucsi_register_altmodes(struct ucsi_connector *con, u8 recipient)
 		 * incremented.
 		 */
 		num = len / sizeof(alt[0]);
+		if (num > ARRAY_SIZE(alt))
+			num = ARRAY_SIZE(alt);
 		i += num;
 
 		for (j = 0; j < num; j++) {
-- 
2.25.1