[PATCH] usb: typec: Check the alternate mode ID allocation

[PATCH] usb: typec: Check the alternate mode ID allocation

[Changyul Lee]

typec_register_altmode() stores the return value of altmode_id_get()
in an unsigned int without checking it. When ida_alloc() fails, the
error code becomes the ID, and the alternate mode is registered under
a name such as "port0-partner.4294967284". A second failure on the same
partner then fails with a duplicate name:

  [    0.423055] sysfs: cannot create duplicate filename '/devices/platform/altfail/typec/port0/port0-partner/port0-partner.4294967284'

Return the error when the ID allocation fails.

Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
Found with a static analysis tool we are developing.

Reproduced in QEMU (x86_64) with a test module that registers a port,
a partner and 63 partner alternate modes, and then two more with
failslab (task-filter) making ida_alloc() fail with -ENOMEM. Without
this patch, the first of the two is registered as
"port0-partner.4294967284" and the second fails with -EEXIST and the
error above. With it, both return -ENOMEM. Same result in three runs
each.

 drivers/usb/typec/class.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 54c7810b563b..29fb13ca9f28 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -641,11 +641,14 @@ typec_register_altmode(struct device *parent,
 		       const struct typec_altmode_desc *desc,
 		       const struct device_type *type)
 {
-	unsigned int id = altmode_id_get(parent);
+	int id = altmode_id_get(parent);
 	bool is_port = is_typec_port(parent);
 	struct altmode *alt;
 	int ret;
 
+	if (id < 0)
+		return ERR_PTR(id);
+
 	alt = kzalloc_obj(*alt);
 	if (!alt) {
 		altmode_id_remove(parent, id);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.43.0

Re: [PATCH] usb: typec: Check the alternate mode ID allocation

[Heikki Krogerus]

On Tue, Nov 10, 2026 at 11:14:46PM -0500, Changyul Lee wrote:
> typec_register_altmode() stores the return value of altmode_id_get()
> in an unsigned int without checking it. When ida_alloc() fails, the
> error code becomes the ID, and the alternate mode is registered under
> a name such as "port0-partner.4294967284". A second failure on the same
> partner then fails with a duplicate name:
> 
>   [    0.423055] sysfs: cannot create duplicate filename '/devices/platform/altfail/typec/port0/port0-partner/port0-partner.4294967284'
> 
> Return the error when the ID allocation fails.
> 
> Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
> Signed-off-by: Changyul Lee <lcy8047@gmail.com>

CC stable...

> ---
> Found with a static analysis tool we are developing.
> 
> Reproduced in QEMU (x86_64) with a test module that registers a port,
> a partner and 63 partner alternate modes, and then two more with
> failslab (task-filter) making ida_alloc() fail with -ENOMEM. Without
> this patch, the first of the two is registered as
> "port0-partner.4294967284" and the second fails with -EEXIST and the
> error above. With it, both return -ENOMEM. Same result in three runs
> each.
> 
>  drivers/usb/typec/class.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> index 54c7810b563b..29fb13ca9f28 100644
> --- a/drivers/usb/typec/class.c
> +++ b/drivers/usb/typec/class.c
> @@ -641,11 +641,14 @@ typec_register_altmode(struct device *parent,
>  		       const struct typec_altmode_desc *desc,
>  		       const struct device_type *type)
>  {
> -	unsigned int id = altmode_id_get(parent);
> +	int id = altmode_id_get(parent);
>  	bool is_port = is_typec_port(parent);
>  	struct altmode *alt;
>  	int ret;
>  
> +	if (id < 0)
> +		return ERR_PTR(id);
> +
>  	alt = kzalloc_obj(*alt);
>  	if (!alt) {
>  		altmode_id_remove(parent, id);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.43.0
> 

-- 
heikki