Hi, Wed, Jan 14, 2026 at 05:58:54PM +0100, Salvatore Bonaccorso kirjoitti: > Control: forwarded -1 > https://lore.kernel.org/lkml/[email protected] > Hi > > Pascal reported in Debian in https://bugs.debian.org/1123987 a problem > catched by UBSAN in drivers/usb/typec/ucsi/ucsi.c: > > [ +1,022859] ------------[ cut here ]------------ > [ +0,000008] UBSAN: array-index-out-of-bounds in > /build/reproducible-path/linux-6.17.13/drivers/usb/typec/ucsi/ucsi.c:605:12 > [ +0,001186] index 2 is out of range for type 'ucsi_altmode [2]' > [ +0,000578] CPU: 10 UID: 0 PID: 275 Comm: kworker/10:1 Not tainted > 6.17.13+deb14-amd64 #1 PREEMPT(lazy) Debian 6.17.13-1 > [ +0,000005] Hardware name: LENOVO 83J3/LNVNB161216, BIOS PYCN30WW 11/17/2025
This is a firmware bug. The interface on this system is returning more than the maximum of 12 bytes to the UCSI command GET_ALTERNATE_MODES. You guys need to be reporte this to Lenovo. I should point out that the driver in Linux requests only a single alternate mode with the GET_ALTERNATE_MODE command by leaving the "Number of Alternate Modes" to 0 (the actual number of alternate modes is the value of that field plus 1 - Table 6-24: GET_ALTERNATE_MODES Command in UCSI specification). That means the interface should only return 6 bytes (that's the size of a single alt mode description in UCSI). Br, -- heikki
