usb: typec: ucsi: displayport: Fix OOB altmode array index

PATCH In review Jameson Thies 5 participants 8 messages Sep 4 – Sep 11

Subsystems (3)

Stable branch USB USB Type-C class

lore

Share & tools

lore

Jameson Thies

author

2026-09-04 23:44 UTC #0 lore raw

PATCH v2 1/1 usb: typec: ucsi: displayport: Fix OOB altmode array index

The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.

Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.

Fixes af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")

Cc [email protected]

Signed-off-by Jameson Thies <[email protected]>

---
Changes in v2:
- removed 0xff alt mode assignement when GET_CURRENT_CAM returns an error.
- return -EINVAL when alt mode index above UCSI_MAX_ALTMODES is returned.

 drivers/usb/typec/ucsi/displayport.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

drivers/usb/typec/ucsi/displayport.c +5 -2

index 7067f2561b84..572da7bbd29c 100644
@@ -71,11 +71,14 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
 	if (ret < 0) {
 		if (ucsi->version > 0x0100)
 			goto err_unlock;
-		cur = 0xff;
 	}
 
 	if (cur != 0xff) {
-		ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		if (cur < UCSI_MAX_ALTMODES)
+			ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		else
+			ret = -EINVAL;
+
 		goto err_unlock;
 	}

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935

Signature · 1 line

2.55.0.979.g7e5102b832-goog

Benson Leung

Reviewed-by on v2 1/1

2026-09-05 00:53 UTC #1 lore raw

Quoted 6 lines · Jameson Thies

The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.

Quoted 6 lines

Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
Fixes af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc [email protected]
Signed-off-by Jameson Thies <[email protected]>

Reviewed-by Benson Leung <[email protected]>

Quoted 34 lines

---
Changes in v2:
- removed 0xff alt mode assignement when GET_CURRENT_CAM returns an error.
- return -EINVAL when alt mode index above UCSI_MAX_ALTMODES is returned.

 drivers/usb/typec/ucsi/displayport.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

drivers/usb/typec/ucsi/displayport.c +5 -2

index 7067f2561b84..572da7bbd29c 100644
@@ -71,11 +71,14 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
 	if (ret < 0) {
 		if (ucsi->version > 0x0100)
 			goto err_unlock;
-		cur = 0xff;
 	}
 
 	if (cur != 0xff) {
-		ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		if (cur < UCSI_MAX_ALTMODES)
+			ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		else
+			ret = -EINVAL;
+
 		goto err_unlock;
 	}

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935

Signature · 1 line

2.55.0.979.g7e5102b832-goog

Andrei Kuchynski

Reviewed-by on v2 1/1

2026-09-07 09:44 UTC #2 lore raw

In reply to Jameson Thies

Quoted 7 lines · Jameson Thies

The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.

Quoted 6 lines

Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
Fixes af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc [email protected]
Signed-off-by Jameson Thies <[email protected]>

Reviewed-by Andrei Kuchynski <[email protected]>

Quoted 34 lines

---
Changes in v2:
- removed 0xff alt mode assignement when GET_CURRENT_CAM returns an error.
- return -EINVAL when alt mode index above UCSI_MAX_ALTMODES is returned.

 drivers/usb/typec/ucsi/displayport.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

drivers/usb/typec/ucsi/displayport.c +5 -2

index 7067f2561b84..572da7bbd29c 100644
@@ -71,11 +71,14 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
        if (ret < 0) {
                if (ucsi->version > 0x0100)
                        goto err_unlock;
-               cur = 0xff;
        }
 
        if (cur != 0xff) {
-               ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+               if (cur < UCSI_MAX_ALTMODES)
+                       ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+               else
+                       ret = -EINVAL;
+
                goto err_unlock;
        }

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935 --
2.55.0.979.g7e5102b832-goog

Heikki Krogerus

maintainer Reviewed-by on v2 1/1

2026-09-07 17:43 UTC #3 lore raw

In reply to Jameson Thies

Quoted 6 lines · Jameson Thies

The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.

Quoted 6 lines

Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.
Fixes af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc [email protected]
Signed-off-by Jameson Thies <[email protected]>

Reviewed-by Heikki Krogerus <[email protected]>

Quoted 33 lines

---
Changes in v2:
- removed 0xff alt mode assignement when GET_CURRENT_CAM returns an error.
- return -EINVAL when alt mode index above UCSI_MAX_ALTMODES is returned.

 drivers/usb/typec/ucsi/displayport.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

drivers/usb/typec/ucsi/displayport.c +5 -2

index 7067f2561b84..572da7bbd29c 100644
@@ -71,11 +71,14 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo)
 	if (ret < 0) {
 		if (ucsi->version > 0x0100)
 			goto err_unlock;
-		cur = 0xff;
 	}
 
 	if (cur != 0xff) {
-		ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		if (cur < UCSI_MAX_ALTMODES)
+			ret = dp->con->port_altmode[cur] == alt ? 0 : -EBUSY;
+		else
+			ret = -EINVAL;
+
 		goto err_unlock;
 	}

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935

Signature · 1 line

2.55.0.979.g7e5102b832-goog

Signature · 1 line

heikki

Greg KH

maintainer

2026-09-10 12:39 UTC #4 lore raw

In reply to Jameson Thies

Quoted 9 lines · Jameson Thies

The UCSI displayport driver indexes the connector's port altmode array with the GET_CURRENT_CAM response after checking it is not 0xff. The port altmode array is UCSI_MAX_ALTMODES elements long. If the PPM returns an invalid GET_CURRENT_CAM response above UCSI_MAX_ALTMODES and not equal to 0xff, the kernel may crash with an array index OOB error.
Update the UCSI displayport driver to verify the current cam is less than UCSI_MAX_ALTMODES before accessing the port altmode array.

Quoted 7 lines

Fixes af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode")
Cc [email protected]
Signed-off-by Jameson Thies <[email protected]>
---
Changes in v2:
- removed 0xff alt mode assignement when GET_CURRENT_CAM returns an error.
- return -EINVAL when alt mode index above UCSI_MAX_ALTMODES is returned.

Does not apply against 7.3-rc2 :(

Jameson Thies

author

2026-09-10 19:52 UTC #5 lore raw

Hi Greg.

Quoted 1 line

Does not apply against 7.3-rc2 :(

7.3-rc2 and usb-next include the v1 version of this patch which fixes the OOB issue but doesn't incorporate Heikki's or Andrei's feedback. I'll send a quick series to revert the existing change and followup with the v2 version.

- Jameson

Greg KH

maintainer

2026-09-11 05:56 UTC #6 lore raw

Quoted 8 lines · Jameson Thies

Hi Greg.
Quoted 1 line
Does not apply against 7.3-rc2 :(
7.3-rc2 and usb-next include the v1 version of this patch which fixes the OOB issue but doesn't incorporate Heikki's or Andrei's feedback. I'll send a quick series to revert the existing change and followup with the v2 version.

Why not just a fixup patch instead?

Jameson Thies

author

2026-09-11 18:28 UTC #7 lore raw

Quoted 1 line · Greg KH

Why not just a fixup patch instead?

Sorry, wasn't aware this was an option. I'll send a fixup patch to address this.