linux-kernel - Re: UBSAN: array-index-out-of-bounds in [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type 'ucsi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <aWizCe9um6ZrKfbT@kuha>
Date: Thu, 15 Jan 2026 11:27:37 +0200
From: Heikki Krogerus <heikki.krogerus@...ux.intel.com>
To: Salvatore Bonaccorso <carnil@...ian.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, pdormeau@...e.fr,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
	1123987@...s.debian.org
Subject: Re: UBSAN: array-index-out-of-bounds in
 [...]drivers/usb/typec/ucsi/ucsi.c:605:12: index 2 is out of range for type
 'ucsi_altmode [2]'

Hi,

Wed, Jan 14, 2026 at 05:58:54PM +0100, Salvatore Bonaccorso kirjoitti:
> Control: forwarded -1 https://lore.kernel.org/lkml/176840984804.2144647.10736984532804520381@eldamar.lan
> Hi
> 
> Pascal reported in Debian in https://bugs.debian.org/1123987 a problem
> catched by UBSAN in drivers/usb/typec/ucsi/ucsi.c:
> 
> [  +1,022859] ------------[ cut here ]------------
> [  +0,000008] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12
> [  +0,001186] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1
> [  +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025

This is a firmware bug. The interface on this system is returning more
than the maximum of 12 bytes to the UCSI command GET_ALTERNATE_MODES.
You guys need to be reporte this to Lenovo.

I should point out that the driver in Linux requests only a single
alternate mode with the GET_ALTERNATE_MODE command by leaving the
"Number of Alternate Modes" to 0 (the actual number of alternate modes
is the value of that field plus 1 - Table 6-24: GET_ALTERNATE_MODES
Command in UCSI specification). That means the interface should only
return 6 bytes (that's the size of a single alt mode description in
UCSI).

Br,

-- 
heikki