typec_register_altmode() stores the return value of altmode_id_get() in an unsigned int without checking it. When ida_alloc() fails, the error code becomes the ID, and the alternate mode is registered under a name such as "port0-partner.4294967284". A second failure on the same partner then fails with a duplicate name: [ 0.423055] sysfs: cannot create duplicate filename '/devices/platform/altfail/typec/port0/port0-partner/port0-partner.4294967284' Return the error when the ID allocation fails. Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes") Cc: stable@vger.kernel.org Signed-off-by: Changyul Lee --- Changes in v2: - Add Cc: stable@vger.kernel.org v1: https://lore.kernel.org/all/20261111041446.3072716-1-lcy8047@gmail.com/ Found with a static analysis tool we are developing. Reproduced in QEMU (x86_64) with a test module that registers a port, a partner and 63 partner alternate modes, and then two more with failslab (task-filter) making ida_alloc() fail with -ENOMEM. Without this patch, the first of the two is registered as "port0-partner.4294967284" and the second fails with -EEXIST and the error above. With it, both return -ENOMEM. Same result in three runs each. drivers/usb/typec/class.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c index 54c7810b563b..29fb13ca9f28 100644 --- a/drivers/usb/typec/class.c +++ b/drivers/usb/typec/class.c @@ -641,11 +641,14 @@ typec_register_altmode(struct device *parent, const struct typec_altmode_desc *desc, const struct device_type *type) { - unsigned int id = altmode_id_get(parent); + int id = altmode_id_get(parent); bool is_port = is_typec_port(parent); struct altmode *alt; int ret; + if (id < 0) + return ERR_PTR(id); + alt = kzalloc_obj(*alt); if (!alt) { altmode_id_remove(parent, id); base-commit: 7475ea8b58616b33c04afb976cf0fbaad9dd63fb -- 2.43.0