Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c
Date	2025-12-26 17:10 +0100
Message-ID	<M6iy5-5PqS-7@gated-at.bofh.it> (permalink)
References	<M5VrP-5zQZ-7@gated-at.bofh.it> <M5VrP-5zQZ-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Control: tags -1 + moreinfo upstream

Hi
On Thu, Dec 25, 2025 at 04:27:25PM +0100, pdormeau@free.fr wrote:
> Package: src:linux
> Version: 6.17.13-1
> Severity: normal
> 
> Dear Maintainer,
> 
>    * What led up to the situation?
> Kernel oops during boot if the USB-C power cord is plugged in (or when the USB-C power cord is plugged in after a boot on battery).
> This happens also with the kernels 6.16.x. 
> 
> [  +1,022859] ------------[ cut here ]------------
> [  +0,000008] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12
> [  +0,001186] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1 
> [  +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> [  +0,000002] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [  +0,000010] Call Trace:
> [  +0,000003]  <TASK>
> [  +0,000003]  dump_stack_lvl+0x5d/0x80
> [  +0,000007]  ubsan_epilogue+0x5/0x2b
> [  +0,000005]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
> [  +0,000007]  ucsi_register_altmodes+0x214/0x250 [typec_ucsi]
> [  +0,000007]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> [  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> [  +0,000005]  process_one_work+0x192/0x350
> [  +0,000006]  worker_thread+0x25a/0x3a0
> [  +0,000004]  ? __pfx_worker_thread+0x10/0x10
> [  +0,000003]  kthread+0xfc/0x240
> [  +0,000003]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork+0x197/0x1c0
> [  +0,000005]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork_asm+0x1a/0x30
> [  +0,000008]  </TASK>
> [  +0,000001] ---[ end trace ]---
> [  +0,000006] ------------[ cut here ]------------
> [  +0,000002] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> [  +0,000579] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000562] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1 
> [  +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> [  +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [  +0,000005] Call Trace:
> [  +0,000001]  <TASK>
> [  +0,000001]  dump_stack_lvl+0x5d/0x80
> [  +0,000004]  ubsan_epilogue+0x5/0x2b
> [  +0,000003]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
> [  +0,000005]  ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> [  +0,000006]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> [  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> [  +0,000005]  process_one_work+0x192/0x350
> [  +0,000004]  worker_thread+0x25a/0x3a0
> [  +0,000004]  ? __pfx_worker_thread+0x10/0x10
> [  +0,000003]  kthread+0xfc/0x240
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000003]  ret_from_fork+0x197/0x1c0
> [  +0,000003]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork_asm+0x1a/0x30
> [  +0,000006]  </TASK>
> [  +0,000001] ---[ end trace ]---
> [  +0,000006] ------------[ cut here ]------------
> [  +0,000001] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:610:19
> [  +0,000608] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000597] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1 
> [  +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> [  +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [  +0,000004] Call Trace:
> [  +0,000002]  <TASK>
> [  +0,000001]  dump_stack_lvl+0x5d/0x80
> [  +0,000004]  ubsan_epilogue+0x5/0x2b
> [  +0,000003]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
> [  +0,000004]  ucsi_register_altmodes+0x1fa/0x250 [typec_ucsi]
> [  +0,000006]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> [  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> [  +0,000006]  process_one_work+0x192/0x350
> [  +0,000004]  worker_thread+0x25a/0x3a0
> [  +0,000003]  ? __pfx_worker_thread+0x10/0x10
> [  +0,000003]  kthread+0xfc/0x240
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000003]  ret_from_fork+0x197/0x1c0
> [  +0,000003]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork_asm+0x1a/0x30
> [  +0,000006]  </TASK>
> [  +0,000001] ---[ end trace ]---
>  
> 
>    * What exactly did you do (or not do) that was effective (or
>      ineffective)?
> As mentionned above it happens when the USB-C power cord is plugged in. 
> No oops if the laptop stays on battery. 
> 
>    * What was the outcome of this action?
> The laptop seems still usable but for somme reason it delays the wifi association with iwd.
> I guess because its happens when iwd starts.
> Updating the bios does not solve the problem.
>    * What outcome did you expect instead?
> No oops

Can you verify if this still happens with 6.18.2-1~exp1 in
experimental (and ideally as well tested explicitly with mainline)?

Regards,
Salvatore

Back to linux.debian.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c Salvatore Bonaccorso <carnil@debian.org> - 2025-12-26 17:10 +0100
  Processed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in  ucsi.c "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-12-26 17:10 +0100
  Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c <pdormeau@free.fr> - 2025-12-26 18:10 +0100
    Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c Salvatore Bonaccorso <carnil@debian.org> - 2025-12-26 18:40 +0100
    Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c Salvatore Bonaccorso <carnil@debian.org> - 2025-12-26 19:10 +0100
      Processed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in  ucsi.c "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-12-26 19:10 +0100

csiph-web