Re: [PATCH 00/19] USB: a bunch of llm-found fixes

[Romain Gantois <romain.gantois@bootlin.com>]

[-- Attachment #1: Type: text/plain, Size: 2856 bytes --]

On Monday, 2 November 2026 10:04:16 CET Romain Gantois wrote:
> On Tuesday, 27 October 2026 15:57:55 CET Greg Kroah-Hartman wrote:
> > From: Josef Bacik <josef@toxicpanda.com>
> > 
> > typec_set_mode() passes a state without an alternate mode, and the USB
> > and accessory modes (TYPEC_MODE_USB2 ... TYPEC_MODE_DEBUG) start at
> > TYPEC_STATE_MODAL like the states of the alternate modes. TCPM and UCSI
> > set TYPEC_MODE_AUDIO or TYPEC_MODE_DEBUG when such an accessory is
> > attached. tusb1046_mux_set() then reads state->alt->svid: plugging in an
> > analog audio adapter is a NULL pointer dereference.
> > 
> > The numbers must not reach the switch either: TYPEC_MODE_AUDIO has the
> > value of TYPEC_DP_STATE_D. Without an alternate mode connect the
> > SuperSpeed lanes for TYPEC_MODE_USB3 and disconnect them for the rest.
> > 
> > Fixes: 7c561b8c3e83 ("usb: typec: mux: Add support for the TUSB1046
> > crosspoint switch") Cc: stable <stable@kernel.org>
> > Cc: Romain Gantois <romain.gantois@bootlin.com>
> > Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> > Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> > 
> >  drivers/usb/typec/mux/tusb1046.c | 14 ++++++++++----
> >  1 file changed, 10 insertions(+), 4 deletions(-)
> > 
> > diff --git a/drivers/usb/typec/mux/tusb1046.c
> > b/drivers/usb/typec/mux/tusb1046.c index 34ef81f75693..a463ba5f53be 100644
> > --- a/drivers/usb/typec/mux/tusb1046.c
> > +++ b/drivers/usb/typec/mux/tusb1046.c
> > @@ -43,11 +43,17 @@ static int tusb1046_mux_set(struct typec_mux_dev *mux,
> > 
> >  	struct tusb1046_priv *priv = typec_mux_get_drvdata(mux);
> >  	struct i2c_client *client = priv->client;
> >  	struct device *dev = &client->dev;
> > 
> > +	unsigned long req = state->mode;
> > 
> >  	int mode, val, ret = 0;
> > 
> > -	if (state->mode >= TYPEC_STATE_MODAL &&
> > -	    state->alt->svid != USB_TYPEC_DP_SID)
> > -		return -EINVAL;
> > +	if (req >= TYPEC_STATE_MODAL) {
> > +		/* USB and accessory modes: not the DP pin assignments */
> > +		if (!state->alt)
> > +			req = req == TYPEC_MODE_USB3 ? TYPEC_STATE_USB :
> > +						       TYPEC_STATE_SAFE;
> > +		else if (state->alt->svid != USB_TYPEC_DP_SID)
> > +			return -EINVAL;
> > +	}
> > 
> >  	dev_dbg(dev, "mux mode requested: %lu\n", state->mode);
> > 
> > @@ -60,7 +66,7 @@ static int tusb1046_mux_set(struct typec_mux_dev *mux,
> > 
> >  		goto out_unlock;
> >  	
> >  	}
> > 
> > -	switch (state->mode) {
> > +	switch (req) {
> > 
> >  	case TYPEC_STATE_USB:
> >  		mode = TUSB1046_CTLSEL_USB3;
> >  		break;
> 
> Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>

That was supposed to be a reviewed-by, sorry about that, sometimes Mondays are 
hard '-_-

-- 
Romain Gantois, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com

[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 833 bytes --]