Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #90576 > unrolled thread

Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c

Started bySalvatore Bonaccorso <carnil@debian.org>
First post2025-12-26 17:10 +0100
Last post2025-12-26 19:10 +0100
Articles 6 — 3 participants

Back to article view | Back to linux.debian.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c Salvatore Bonaccorso <carnil@debian.org> - 2025-12-26 17:10 +0100
    Processed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in  ucsi.c "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-12-26 17:10 +0100
    Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c <pdormeau@free.fr> - 2025-12-26 18:10 +0100
      Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c Salvatore Bonaccorso <carnil@debian.org> - 2025-12-26 18:40 +0100
      Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c Salvatore Bonaccorso <carnil@debian.org> - 2025-12-26 19:10 +0100
        Processed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in  ucsi.c "Debian Bug Tracking System" <owner@bugs.debian.org> - 2025-12-26 19:10 +0100

#90576 — Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c

FromSalvatore Bonaccorso <carnil@debian.org>
Date2025-12-26 17:10 +0100
SubjectBug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c
Message-ID<M6iy5-5PqS-7@gated-at.bofh.it>
Control: tags -1 + moreinfo upstream

Hi
On Thu, Dec 25, 2025 at 04:27:25PM +0100, pdormeau@free.fr wrote:
> Package: src:linux
> Version: 6.17.13-1
> Severity: normal
> 
> Dear Maintainer,
> 
>    * What led up to the situation?
> Kernel oops during boot if the USB-C power cord is plugged in (or when the USB-C power cord is plugged in after a boot on battery).
> This happens also with the kernels 6.16.x. 
> 
> [  +1,022859] ------------[ cut here ]------------
> [  +0,000008] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12
> [  +0,001186] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1 
> [  +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> [  +0,000002] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [  +0,000010] Call Trace:
> [  +0,000003]  <TASK>
> [  +0,000003]  dump_stack_lvl+0x5d/0x80
> [  +0,000007]  ubsan_epilogue+0x5/0x2b
> [  +0,000005]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
> [  +0,000007]  ucsi_register_altmodes+0x214/0x250 [typec_ucsi]
> [  +0,000007]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> [  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> [  +0,000005]  process_one_work+0x192/0x350
> [  +0,000006]  worker_thread+0x25a/0x3a0
> [  +0,000004]  ? __pfx_worker_thread+0x10/0x10
> [  +0,000003]  kthread+0xfc/0x240
> [  +0,000003]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork+0x197/0x1c0
> [  +0,000005]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork_asm+0x1a/0x30
> [  +0,000008]  </TASK>
> [  +0,000001] ---[ end trace ]---
> [  +0,000006] ------------[ cut here ]------------
> [  +0,000002] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:609:18
> [  +0,000579] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000562] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1 
> [  +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> [  +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [  +0,000005] Call Trace:
> [  +0,000001]  <TASK>
> [  +0,000001]  dump_stack_lvl+0x5d/0x80
> [  +0,000004]  ubsan_epilogue+0x5/0x2b
> [  +0,000003]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
> [  +0,000005]  ucsi_register_altmodes+0x233/0x250 [typec_ucsi]
> [  +0,000006]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> [  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> [  +0,000005]  process_one_work+0x192/0x350
> [  +0,000004]  worker_thread+0x25a/0x3a0
> [  +0,000004]  ? __pfx_worker_thread+0x10/0x10
> [  +0,000003]  kthread+0xfc/0x240
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000003]  ret_from_fork+0x197/0x1c0
> [  +0,000003]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork_asm+0x1a/0x30
> [  +0,000006]  </TASK>
> [  +0,000001] ---[ end trace ]---
> [  +0,000006] ------------[ cut here ]------------
> [  +0,000001] UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:610:19
> [  +0,000608] index 2 is out of range for type 'ucsi_altmode [2]'
> [  +0,000597] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted 6.17.13+deb14-amd64 #1 PREEMPT(lazy)  Debian 6.17.13-1 
> [  +0,000003] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
> [  +0,000001] Workqueue: events_long ucsi_init_work [typec_ucsi]
> [  +0,000004] Call Trace:
> [  +0,000002]  <TASK>
> [  +0,000001]  dump_stack_lvl+0x5d/0x80
> [  +0,000004]  ubsan_epilogue+0x5/0x2b
> [  +0,000003]  __ubsan_handle_out_of_bounds.cold+0x54/0x59
> [  +0,000004]  ucsi_register_altmodes+0x1fa/0x250 [typec_ucsi]
> [  +0,000006]  ucsi_check_altmodes+0x1b/0xa0 [typec_ucsi]
> [  +0,000004]  ucsi_init_work+0x919/0x9b0 [typec_ucsi]
> [  +0,000006]  process_one_work+0x192/0x350
> [  +0,000004]  worker_thread+0x25a/0x3a0
> [  +0,000003]  ? __pfx_worker_thread+0x10/0x10
> [  +0,000003]  kthread+0xfc/0x240
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ? __pfx_kthread+0x10/0x10
> [  +0,000003]  ret_from_fork+0x197/0x1c0
> [  +0,000003]  ? __pfx_kthread+0x10/0x10
> [  +0,000002]  ret_from_fork_asm+0x1a/0x30
> [  +0,000006]  </TASK>
> [  +0,000001] ---[ end trace ]---
>  
> 
>    * What exactly did you do (or not do) that was effective (or
>      ineffective)?
> As mentionned above it happens when the USB-C power cord is plugged in. 
> No oops if the laptop stays on battery. 
> 
>    * What was the outcome of this action?
> The laptop seems still usable but for somme reason it delays the wifi association with iwd.
> I guess because its happens when iwd starts.
> Updating the bios does not solve the problem.
>    * What outcome did you expect instead?
> No oops

Can you verify if this still happens with 6.18.2-1~exp1 in
experimental (and ideally as well tested explicitly with mainline)?

Regards,
Salvatore

[toc] | [next] | [standalone]

#90577 — Processed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c

From"Debian Bug Tracking System" <owner@bugs.debian.org>
Date2025-12-26 17:10 +0100
SubjectProcessed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c
Message-ID<M6iy6-5PqS-19@gated-at.bofh.it>
In reply to#90576
Processing control commands:

> tags -1 + moreinfo upstream
Bug #1123987 [src:linux] UBSAN: array-index-out-of-bounds in ucsi.c
Added tag(s) upstream and moreinfo.

-- 
1123987: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123987
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [next] | [standalone]

#90579

From<pdormeau@free.fr>
Date2025-12-26 18:10 +0100
Message-ID<M6ju9-5Q30-15@gated-at.bofh.it>
In reply to#90576
Le Fri, 26 Dec 2025 16:40:04 +0100,
Salvatore Bonaccorso <carnil@debian.org> a écrit :

>Can you verify if this still happens with 6.18.2-1~exp1 in
>experimental (and ideally as well tested explicitly with mainline)?
>
>Regards,
>Salvatore
Hi, thank you for answering.

Still there with 6.18.2-1~exp1. I will test with main line. It may
take some time because this faulty laptop is the one I use in vacation,
and I cannot let it in operation for too long (especially for compiling
a kernel). I will let you know when it is done

Regards
Pascal

[toc] | [prev] | [next] | [standalone]

#90582

FromSalvatore Bonaccorso <carnil@debian.org>
Date2025-12-26 18:40 +0100
Message-ID<M6jXb-5QdE-3@gated-at.bofh.it>
In reply to#90579
Hi Pascal,

On Fri, Dec 26, 2025 at 05:17:00PM +0100, Salvatore Bonaccorso wrote:
> Control: found -1 6.18.2-1~exp1
> 
> Hi Pascal,
> 
> On Fri, Dec 26, 2025 at 05:04:36PM +0100, pdormeau@free.fr wrote:
> > Le Fri, 26 Dec 2025 16:40:04 +0100,
> > Salvatore Bonaccorso <carnil@debian.org> a écrit :
> > 
> > >Can you verify if this still happens with 6.18.2-1~exp1 in
> > >experimental (and ideally as well tested explicitly with mainline)?
> > >
> > >Regards,
> > >Salvatore
> > Hi, thank you for answering.
> > 
> > Still there with 6.18.2-1~exp1. I will test with main line. It may
> > take some time because this faulty laptop is the one I use in vacation,
> > and I cannot let it in operation for too long (especially for compiling
> > a kernel). I will let you know when it is done
> 
> Thanks for the confirmation.
> 
> Ack sure take the time it needs even delaying after vacation. We put
> ourself on hold for now, as I have no better idea as to try the bisect
> experiment as described. Maybe someone else comes up with a better
> approrach!

Sorry I wanted to write actually someting else :). If we can confirm
it in mainline then we can forward the bugreport straight as there is
no need to further bisect, as the issue was already as well present in
the 6.16.y series.

So ignore please the last comment from me.

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#90583

FromSalvatore Bonaccorso <carnil@debian.org>
Date2025-12-26 19:10 +0100
Message-ID<M6jXb-5QdE-5@gated-at.bofh.it>
In reply to#90579
Control: found -1 6.18.2-1~exp1

Hi Pascal,

On Fri, Dec 26, 2025 at 05:04:36PM +0100, pdormeau@free.fr wrote:
> Le Fri, 26 Dec 2025 16:40:04 +0100,
> Salvatore Bonaccorso <carnil@debian.org> a écrit :
> 
> >Can you verify if this still happens with 6.18.2-1~exp1 in
> >experimental (and ideally as well tested explicitly with mainline)?
> >
> >Regards,
> >Salvatore
> Hi, thank you for answering.
> 
> Still there with 6.18.2-1~exp1. I will test with main line. It may
> take some time because this faulty laptop is the one I use in vacation,
> and I cannot let it in operation for too long (especially for compiling
> a kernel). I will let you know when it is done

Thanks for the confirmation.

Ack sure take the time it needs even delaying after vacation. We put
ourself on hold for now, as I have no better idea as to try the bisect
experiment as described. Maybe someone else comes up with a better
approrach!

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#90584 — Processed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c

From"Debian Bug Tracking System" <owner@bugs.debian.org>
Date2025-12-26 19:10 +0100
SubjectProcessed: Re: Bug#1123987: UBSAN: array-index-out-of-bounds in ucsi.c
Message-ID<M6kqd-5QFo-17@gated-at.bofh.it>
In reply to#90583
Processing control commands:

> found -1 6.18.2-1~exp1
Bug #1123987 [src:linux] UBSAN: array-index-out-of-bounds in ucsi.c
Marked as found in versions linux/6.18.2-1~exp1.

-- 
1123987: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1123987
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web