[PATCH v2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[PATCH v2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[Radhey Shyam Pandey]

tps6598x_connect() and cd321x_update_work() pass a stack-allocated
typec_partner_desc to typec_register_partner() after initializing only
usb_pd, accessory and identity.

typec_register_partner() copies attach and deattach from the descriptor
into the partner. With those fields left unset, garbage function pointers
may be stored and later invoked from typec_partner_link_device() when a USB
device is linked to the port. Uninitialized pd_revision and usb_capability
similarly leak stack data through partner sysfs.

Zero-initialize the descriptor so optional callbacks remain NULL and the
remaining fields are zero.

Assisted-by: claude-mythos-preview-high
Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
Cc: stable@vger.kernel.org
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
---
Changes for v2:
- Add  Assisted-by tag.
- Remove explicit indentity=NULL

AI code scanning identified this issue; the possible call graph is shown below.

  USB-C plug event (IRQ)
    tps6598x_interrupt()
      tps6598x_handle_plug_event()
        tps6598x_connect()
          struct typec_partner_desc desc;     /* bug: attach/deattach unset */
          desc.usb_pd / .accessory / .identity = ...
          typec_register_partner(port, &desc)   /* class.c */
            partner->attach   = desc->attach;   /* copy stack garbage */
            partner->deattach = desc->deattach;
            [if port->usb2_dev || port->usb3_dev already set]
              typec_partner_link_device(partner, dev)
                if (partner->attach)
                  partner->attach(partner, dev)  /* indirect call via bad ptr */
---
 drivers/usb/typec/tipd/core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
index 522f56742aa9..d99a55063e34 100644
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -344,7 +344,7 @@ static void tps6598x_set_data_role(struct tps6598x *tps,
 
 static int tps6598x_connect(struct tps6598x *tps, u32 status)
 {
-	struct typec_partner_desc desc;
+	struct typec_partner_desc desc = { };
 	enum typec_pwr_opmode mode;
 	int ret;
 
@@ -355,7 +355,6 @@ static int tps6598x_connect(struct tps6598x *tps, u32 status)
 
 	desc.usb_pd = mode == TYPEC_PWR_MODE_PD;
 	desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
-	desc.identity = NULL;
 
 	if (desc.usb_pd) {
 		ret = tps6598x_read_partner_identity(tps);
@@ -841,11 +840,10 @@ static void cd321x_update_work(struct work_struct *work)
 
 	/* Set up partner if we were previously disconnected (or changed). */
 	if (!tps->partner) {
-		struct typec_partner_desc desc;
+		struct typec_partner_desc desc = { };
 
 		desc.usb_pd = is_pd;
 		desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
-		desc.identity = NULL;
 
 		if (desc.usb_pd)
 			desc.identity = &st.partner_identity;

base-commit: ea2bff00da89d7767d677bb68470130ba96f4928
-- 
2.44.4

Re: [PATCH v2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[Greg KH]

On Fri, Aug 07, 2026 at 11:16:58PM +0530, Radhey Shyam Pandey wrote:
> tps6598x_connect() and cd321x_update_work() pass a stack-allocated
> typec_partner_desc to typec_register_partner() after initializing only
> usb_pd, accessory and identity.
> 
> typec_register_partner() copies attach and deattach from the descriptor
> into the partner. With those fields left unset, garbage function pointers
> may be stored and later invoked from typec_partner_link_device() when a USB
> device is linked to the port. Uninitialized pd_revision and usb_capability
> similarly leak stack data through partner sysfs.
> 
> Zero-initialize the descriptor so optional callbacks remain NULL and the
> remaining fields are zero.
> 
> Assisted-by: claude-mythos-preview-high
> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
> Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")

Two different commits caused this issue?  Does that mean two different
commits should fix it?  How far back should this be backported?

thanks,

greg k-h

Re: [PATCH v2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[Pandey, Radhey Shyam]

On 8/8/2026 12:41 PM, Greg KH wrote:
> On Fri, Aug 07, 2026 at 11:16:58PM +0530, Radhey Shyam Pandey wrote:
>> tps6598x_connect() and cd321x_update_work() pass a stack-allocated
>> typec_partner_desc to typec_register_partner() after initializing only
>> usb_pd, accessory and identity.
>>
>> typec_register_partner() copies attach and deattach from the descriptor
>> into the partner. With those fields left unset, garbage function pointers
>> may be stored and later invoked from typec_partner_link_device() when a USB
>> device is linked to the port. Uninitialized pd_revision and usb_capability
>> similarly leak stack data through partner sysfs.
>>
>> Zero-initialize the descriptor so optional callbacks remain NULL and the
>> remaining fields are zero.
>>
>> Assisted-by: claude-mythos-preview-high
>> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
>> Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
> 
> Two different commits caused this issue?  Does that mean two different
> commits should fix it?  How far back should this be backported?
> 

The two related issues are in different functions and were introduced
independently by the two commits listed in the Fixes: tags.

Since they were introduced independently, in the next version I will
split the fix into two patches, each with the appropriate Fixes: tag
and stable version marker.

Thanks,
Radhey

Re: [PATCH v2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[Heikki Krogerus]

On Fri, Aug 07, 2026 at 11:16:58PM +0530, Radhey Shyam Pandey wrote:
> tps6598x_connect() and cd321x_update_work() pass a stack-allocated
> typec_partner_desc to typec_register_partner() after initializing only
> usb_pd, accessory and identity.
> 
> typec_register_partner() copies attach and deattach from the descriptor
> into the partner. With those fields left unset, garbage function pointers
> may be stored and later invoked from typec_partner_link_device() when a USB
> device is linked to the port. Uninitialized pd_revision and usb_capability
> similarly leak stack data through partner sysfs.
> 
> Zero-initialize the descriptor so optional callbacks remain NULL and the
> remaining fields are zero.
> 
> Assisted-by: claude-mythos-preview-high
> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
> Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
> Cc: stable@vger.kernel.org
> Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>

Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
> Changes for v2:
> - Add  Assisted-by tag.
> - Remove explicit indentity=NULL
> 
> AI code scanning identified this issue; the possible call graph is shown below.
> 
>   USB-C plug event (IRQ)
>     tps6598x_interrupt()
>       tps6598x_handle_plug_event()
>         tps6598x_connect()
>           struct typec_partner_desc desc;     /* bug: attach/deattach unset */
>           desc.usb_pd / .accessory / .identity = ...
>           typec_register_partner(port, &desc)   /* class.c */
>             partner->attach   = desc->attach;   /* copy stack garbage */
>             partner->deattach = desc->deattach;
>             [if port->usb2_dev || port->usb3_dev already set]
>               typec_partner_link_device(partner, dev)
>                 if (partner->attach)
>                   partner->attach(partner, dev)  /* indirect call via bad ptr */
> ---
>  drivers/usb/typec/tipd/core.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index 522f56742aa9..d99a55063e34 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c
> @@ -344,7 +344,7 @@ static void tps6598x_set_data_role(struct tps6598x *tps,
>  
>  static int tps6598x_connect(struct tps6598x *tps, u32 status)
>  {
> -	struct typec_partner_desc desc;
> +	struct typec_partner_desc desc = { };
>  	enum typec_pwr_opmode mode;
>  	int ret;
>  
> @@ -355,7 +355,6 @@ static int tps6598x_connect(struct tps6598x *tps, u32 status)
>  
>  	desc.usb_pd = mode == TYPEC_PWR_MODE_PD;
>  	desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
> -	desc.identity = NULL;
>  
>  	if (desc.usb_pd) {
>  		ret = tps6598x_read_partner_identity(tps);
> @@ -841,11 +840,10 @@ static void cd321x_update_work(struct work_struct *work)
>  
>  	/* Set up partner if we were previously disconnected (or changed). */
>  	if (!tps->partner) {
> -		struct typec_partner_desc desc;
> +		struct typec_partner_desc desc = { };
>  
>  		desc.usb_pd = is_pd;
>  		desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
> -		desc.identity = NULL;
>  
>  		if (desc.usb_pd)
>  			desc.identity = &st.partner_identity;
> 
> base-commit: ea2bff00da89d7767d677bb68470130ba96f4928
> -- 
> 2.44.4

-- 
heikki