[PATCH v3 0/2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[PATCH v3 0/2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[Radhey Shyam Pandey]

tps6598x_connect() and cd321x_update_work() pass a stack-allocated
typec_partner_desc to typec_register_partner() after initializing only
usb_pd, accessory and identity.

typec_register_partner() copies attach and deattach from the descriptor
into the partner. With those fields left unset, garbage function pointers
may be stored and later invoked from typec_partner_link_device() when a USB
device is linked to the port. Uninitialized pd_revision and usb_capability
similarly leak stack data through partner sysfs.

Zero-initialize the descriptor in each call site so optional callbacks
remain NULL and the remaining fields are zero.

The series is split into one patch per function so each fix can be
backported independently with the correct stable prerequisite:

  - tps6598x_connect(): Cc stable # 5.15+ (core.c, v5.13)
  - cd321x_update_work(): Cc stable # 6.18+

Changes for v3:
- Split v2 into separate patches to simplify LTS backporting.
- Add stable Cc prerequisites per patch.
- Drop Reviewed-by tag while the series is split.

Changes for v2:
- Add Assisted-by tag.
- Remove explicit identity = NULL.

Radhey Shyam Pandey (2):
  usb: typec: tipd: fix uninitialized typec_partner_desc in
    tps6598x_connect()
  usb: typec: tipd: fix uninitialized typec_partner_desc in
    cd321x_update_work()

 drivers/usb/typec/tipd/core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

base-commit: 5e6de6a2b522f659defacb1551d0465ba6ce13cf
-- 
2.43.0

[PATCH v3 1/2] usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

[Radhey Shyam Pandey]

tps6598x_connect() passes a stack-allocated typec_partner_desc to
typec_register_partner() after initializing only usb_pd, accessory and
identity.

typec_register_partner() copies attach and deattach from the descriptor
into the partner. With those fields left unset, garbage function pointers
may be stored and later invoked from typec_partner_link_device() when a USB
device is linked to the port. Uninitialized pd_revision and usb_capability
similarly leak stack data through partner sysfs.

Zero-initialize the descriptor so optional callbacks remain NULL and the
remaining fields are zero.

Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Cc: stable@vger.kernel.org # 5.15+
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
Changes for v3:
- Split v2 into separate patches to simplify LTS backporting.
- Drop Heikki reviewed-by tag as now patch is split.

Changes for v2:
- Add  Assisted-by tag.
- Remove explicit indentity=NULL

AI code scanning identified this issue; the possible call graph is shown below.

  USB-C plug event (IRQ)
    tps6598x_interrupt()
      tps6598x_handle_plug_event()
        tps6598x_connect()
          struct typec_partner_desc desc;     /* bug: attach/deattach unset */
          desc.usb_pd / .accessory / .identity = ...
          typec_register_partner(port, &desc)   /* class.c */
            partner->attach   = desc->attach;   /* copy stack garbage */
            partner->deattach = desc->deattach;
            [if port->usb2_dev || port->usb3_dev already set]
              typec_partner_link_device(partner, dev)
                if (partner->attach)
                  partner->attach(partner, dev)  /* indirect call via bad ptr */
---
 drivers/usb/typec/tipd/core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
index 522f56742aa9..54ca726c3b15 100644
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -344,7 +344,7 @@ static void tps6598x_set_data_role(struct tps6598x *tps,
 
 static int tps6598x_connect(struct tps6598x *tps, u32 status)
 {
-	struct typec_partner_desc desc;
+	struct typec_partner_desc desc = { };
 	enum typec_pwr_opmode mode;
 	int ret;
 
@@ -355,7 +355,6 @@ static int tps6598x_connect(struct tps6598x *tps, u32 status)
 
 	desc.usb_pd = mode == TYPEC_PWR_MODE_PD;
 	desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
-	desc.identity = NULL;
 
 	if (desc.usb_pd) {
 		ret = tps6598x_read_partner_identity(tps);
-- 
2.43.0

Re: [PATCH v3 1/2] usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()

[Heikki Krogerus]

On Wed, Aug 12, 2026 at 09:44:53PM +0530, Radhey Shyam Pandey wrote:
> tps6598x_connect() passes a stack-allocated typec_partner_desc to
> typec_register_partner() after initializing only usb_pd, accessory and
> identity.
> 
> typec_register_partner() copies attach and deattach from the descriptor
> into the partner. With those fields left unset, garbage function pointers
> may be stored and later invoked from typec_partner_link_device() when a USB
> device is linked to the port. Uninitialized pd_revision and usb_capability
> similarly leak stack data through partner sysfs.
> 
> Zero-initialize the descriptor so optional callbacks remain NULL and the
> remaining fields are zero.
> 
> Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
> Cc: stable@vger.kernel.org # 5.15+
> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> Changes for v3:
> - Split v2 into separate patches to simplify LTS backporting.
> - Drop Heikki reviewed-by tag as now patch is split.
> 
> Changes for v2:
> - Add  Assisted-by tag.
> - Remove explicit indentity=NULL
> 
> AI code scanning identified this issue; the possible call graph is shown below.
> 
>   USB-C plug event (IRQ)
>     tps6598x_interrupt()
>       tps6598x_handle_plug_event()
>         tps6598x_connect()
>           struct typec_partner_desc desc;     /* bug: attach/deattach unset */
>           desc.usb_pd / .accessory / .identity = ...
>           typec_register_partner(port, &desc)   /* class.c */
>             partner->attach   = desc->attach;   /* copy stack garbage */
>             partner->deattach = desc->deattach;
>             [if port->usb2_dev || port->usb3_dev already set]
>               typec_partner_link_device(partner, dev)
>                 if (partner->attach)
>                   partner->attach(partner, dev)  /* indirect call via bad ptr */
> ---
>  drivers/usb/typec/tipd/core.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index 522f56742aa9..54ca726c3b15 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c
> @@ -344,7 +344,7 @@ static void tps6598x_set_data_role(struct tps6598x *tps,
>  
>  static int tps6598x_connect(struct tps6598x *tps, u32 status)
>  {
> -	struct typec_partner_desc desc;
> +	struct typec_partner_desc desc = { };
>  	enum typec_pwr_opmode mode;
>  	int ret;
>  
> @@ -355,7 +355,6 @@ static int tps6598x_connect(struct tps6598x *tps, u32 status)
>  
>  	desc.usb_pd = mode == TYPEC_PWR_MODE_PD;
>  	desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
> -	desc.identity = NULL;
>  
>  	if (desc.usb_pd) {
>  		ret = tps6598x_read_partner_identity(tps);
> -- 
> 2.43.0

-- 
heikki

[PATCH v3 2/2] usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

[Radhey Shyam Pandey]

cd321x_update_work() passes a stack-allocated typec_partner_desc to
typec_register_partner() after initializing only usb_pd, accessory and
identity.

typec_register_partner() copies attach and deattach from the descriptor
into the partner. With those fields left unset, garbage function pointers
may be stored and later invoked from typec_partner_link_device() when a USB
device is linked to the port. Uninitialized pd_revision and usb_capability
similarly leak stack data through partner sysfs.

Zero-initialize the descriptor so optional callbacks remain NULL and the
remaining fields are zero.

Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
Cc: stable@vger.kernel.org # 6.18+
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
Changes for v3:
- Split v2 into separate patches to simplify LTS backporting.
- Drop Heikki reviewed-by tag as now patch is split.

Changes for v2:
- Add  Assisted-by tag.
- Remove explicit indentity=NULL

AI code scanning identified this issue; the possible call graph is shown below.

  USB-C plug event (IRQ)
    tps6598x_interrupt()
      tps6598x_handle_plug_event()
        tps6598x_connect()
          struct typec_partner_desc desc;     /* bug: attach/deattach unset */
          desc.usb_pd / .accessory / .identity = ...
          typec_register_partner(port, &desc)   /* class.c */
            partner->attach   = desc->attach;   /* copy stack garbage */
            partner->deattach = desc->deattach;
            [if port->usb2_dev || port->usb3_dev already set]
              typec_partner_link_device(partner, dev)
                if (partner->attach)
                  partner->attach(partner, dev)  /* indirect call via bad ptr */
---
 drivers/usb/typec/tipd/core.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
index 54ca726c3b15..d99a55063e34 100644
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -840,11 +840,10 @@ static void cd321x_update_work(struct work_struct *work)
 
 	/* Set up partner if we were previously disconnected (or changed). */
 	if (!tps->partner) {
-		struct typec_partner_desc desc;
+		struct typec_partner_desc desc = { };
 
 		desc.usb_pd = is_pd;
 		desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
-		desc.identity = NULL;
 
 		if (desc.usb_pd)
 			desc.identity = &st.partner_identity;
-- 
2.43.0

Re: [PATCH v3 2/2] usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

[Heikki Krogerus]

On Wed, Aug 12, 2026 at 09:44:54PM +0530, Radhey Shyam Pandey wrote:
> cd321x_update_work() passes a stack-allocated typec_partner_desc to
> typec_register_partner() after initializing only usb_pd, accessory and
> identity.
> 
> typec_register_partner() copies attach and deattach from the descriptor
> into the partner. With those fields left unset, garbage function pointers
> may be stored and later invoked from typec_partner_link_device() when a USB
> device is linked to the port. Uninitialized pd_revision and usb_capability
> similarly leak stack data through partner sysfs.
> 
> Zero-initialize the descriptor so optional callbacks remain NULL and the
> remaining fields are zero.
> 
> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
> Cc: stable@vger.kernel.org # 6.18+
> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> Changes for v3:
> - Split v2 into separate patches to simplify LTS backporting.
> - Drop Heikki reviewed-by tag as now patch is split.
> 
> Changes for v2:
> - Add  Assisted-by tag.
> - Remove explicit indentity=NULL
> 
> AI code scanning identified this issue; the possible call graph is shown below.
> 
>   USB-C plug event (IRQ)
>     tps6598x_interrupt()
>       tps6598x_handle_plug_event()
>         tps6598x_connect()
>           struct typec_partner_desc desc;     /* bug: attach/deattach unset */
>           desc.usb_pd / .accessory / .identity = ...
>           typec_register_partner(port, &desc)   /* class.c */
>             partner->attach   = desc->attach;   /* copy stack garbage */
>             partner->deattach = desc->deattach;
>             [if port->usb2_dev || port->usb3_dev already set]
>               typec_partner_link_device(partner, dev)
>                 if (partner->attach)
>                   partner->attach(partner, dev)  /* indirect call via bad ptr */
> ---
>  drivers/usb/typec/tipd/core.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index 54ca726c3b15..d99a55063e34 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c
> @@ -840,11 +840,10 @@ static void cd321x_update_work(struct work_struct *work)
>  
>  	/* Set up partner if we were previously disconnected (or changed). */
>  	if (!tps->partner) {
> -		struct typec_partner_desc desc;
> +		struct typec_partner_desc desc = { };
>  
>  		desc.usb_pd = is_pd;
>  		desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
> -		desc.identity = NULL;
>  
>  		if (desc.usb_pd)
>  			desc.identity = &st.partner_identity;
> -- 
> 2.43.0

-- 
heikki