[PATCH] usb: typec: Check the alternate mode ID allocation

[PATCH] usb: typec: Check the alternate mode ID allocation

[Changyul Lee]

typec_register_altmode() stores the return value of altmode_id_get()
in an unsigned int without checking it. When ida_alloc() fails, the
error code becomes the ID, and the alternate mode is registered under
a name such as "port0-partner.4294967284". A second failure on the same
partner then fails with a duplicate name:

  [    0.423055] sysfs: cannot create duplicate filename '/devices/platform/altfail/typec/port0/port0-partner/port0-partner.4294967284'

Return the error when the ID allocation fails.

Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
Found with a static analysis tool we are developing.

Reproduced in QEMU (x86_64) with a test module that registers a port,
a partner and 63 partner alternate modes, and then two more with
failslab (task-filter) making ida_alloc() fail with -ENOMEM. Without
this patch, the first of the two is registered as
"port0-partner.4294967284" and the second fails with -EEXIST and the
error above. With it, both return -ENOMEM. Same result in three runs
each.

 drivers/usb/typec/class.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 54c7810b563b..29fb13ca9f28 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -641,11 +641,14 @@ typec_register_altmode(struct device *parent,
 		       const struct typec_altmode_desc *desc,
 		       const struct device_type *type)
 {
-	unsigned int id = altmode_id_get(parent);
+	int id = altmode_id_get(parent);
 	bool is_port = is_typec_port(parent);
 	struct altmode *alt;
 	int ret;
 
+	if (id < 0)
+		return ERR_PTR(id);
+
 	alt = kzalloc_obj(*alt);
 	if (!alt) {
 		altmode_id_remove(parent, id);

base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
-- 
2.43.0

Re: [PATCH] usb: typec: Check the alternate mode ID allocation

[Heikki Krogerus]

On Tue, Nov 10, 2026 at 11:14:46PM -0500, Changyul Lee wrote:
> typec_register_altmode() stores the return value of altmode_id_get()
> in an unsigned int without checking it. When ida_alloc() fails, the
> error code becomes the ID, and the alternate mode is registered under
> a name such as "port0-partner.4294967284". A second failure on the same
> partner then fails with a duplicate name:
> 
>   [    0.423055] sysfs: cannot create duplicate filename '/devices/platform/altfail/typec/port0/port0-partner/port0-partner.4294967284'
> 
> Return the error when the ID allocation fails.
> 
> Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
> Signed-off-by: Changyul Lee <lcy8047@gmail.com>

CC stable...

> ---
> Found with a static analysis tool we are developing.
> 
> Reproduced in QEMU (x86_64) with a test module that registers a port,
> a partner and 63 partner alternate modes, and then two more with
> failslab (task-filter) making ida_alloc() fail with -ENOMEM. Without
> this patch, the first of the two is registered as
> "port0-partner.4294967284" and the second fails with -EEXIST and the
> error above. With it, both return -ENOMEM. Same result in three runs
> each.
> 
>  drivers/usb/typec/class.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> index 54c7810b563b..29fb13ca9f28 100644
> --- a/drivers/usb/typec/class.c
> +++ b/drivers/usb/typec/class.c
> @@ -641,11 +641,14 @@ typec_register_altmode(struct device *parent,
>  		       const struct typec_altmode_desc *desc,
>  		       const struct device_type *type)
>  {
> -	unsigned int id = altmode_id_get(parent);
> +	int id = altmode_id_get(parent);
>  	bool is_port = is_typec_port(parent);
>  	struct altmode *alt;
>  	int ret;
>  
> +	if (id < 0)
> +		return ERR_PTR(id);
> +
>  	alt = kzalloc_obj(*alt);
>  	if (!alt) {
>  		altmode_id_remove(parent, id);
> 
> base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> -- 
> 2.43.0
> 

-- 
heikki

Re: [PATCH] usb: typec: Check the alternate mode ID allocation

[Changyul Lee]

From lcy8047@gmail.com Mon Sep 17 00:00:00 2001
From: Changyul Lee <lcy8047@gmail.com>
Subject: Re: [PATCH] usb: typec: Check the alternate mode ID allocation

On Wed, Nov 11, 2026 at 04:04:17PM +0100, Heikki Krogerus wrote:
> On Tue, Nov 10, 2026 at 11:14:46PM -0500, Changyul Lee wrote:
> > Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
> > Signed-off-by: Changyul Lee <lcy8047@gmail.com>
>
> CC stable...

I'll add the stable Cc tag and send a v2.

Thank you,
Changyul

2026년 11월 11일 (수) 오전 10:04, Heikki Krogerus
<heikki.krogerus@linux.intel.com>님이 작성:
>
> On Tue, Nov 10, 2026 at 11:14:46PM -0500, Changyul Lee wrote:
> > typec_register_altmode() stores the return value of altmode_id_get()
> > in an unsigned int without checking it. When ida_alloc() fails, the
> > error code becomes the ID, and the alternate mode is registered under
> > a name such as "port0-partner.4294967284". A second failure on the same
> > partner then fails with a duplicate name:
> >
> >   [    0.423055] sysfs: cannot create duplicate filename '/devices/platform/altfail/typec/port0/port0-partner/port0-partner.4294967284'
> >
> > Return the error when the ID allocation fails.
> >
> > Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
> > Signed-off-by: Changyul Lee <lcy8047@gmail.com>
>
> CC stable...
>
> > ---
> > Found with a static analysis tool we are developing.
> >
> > Reproduced in QEMU (x86_64) with a test module that registers a port,
> > a partner and 63 partner alternate modes, and then two more with
> > failslab (task-filter) making ida_alloc() fail with -ENOMEM. Without
> > this patch, the first of the two is registered as
> > "port0-partner.4294967284" and the second fails with -EEXIST and the
> > error above. With it, both return -ENOMEM. Same result in three runs
> > each.
> >
> >  drivers/usb/typec/class.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> > index 54c7810b563b..29fb13ca9f28 100644
> > --- a/drivers/usb/typec/class.c
> > +++ b/drivers/usb/typec/class.c
> > @@ -641,11 +641,14 @@ typec_register_altmode(struct device *parent,
> >                      const struct typec_altmode_desc *desc,
> >                      const struct device_type *type)
> >  {
> > -     unsigned int id = altmode_id_get(parent);
> > +     int id = altmode_id_get(parent);
> >       bool is_port = is_typec_port(parent);
> >       struct altmode *alt;
> >       int ret;
> >
> > +     if (id < 0)
> > +             return ERR_PTR(id);
> > +
> >       alt = kzalloc_obj(*alt);
> >       if (!alt) {
> >               altmode_id_remove(parent, id);
> >
> > base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb
> > --
> > 2.43.0
> >
>
> --
> heikki