Re: [PATCH] usb: typec: tipd: assign partner identity to persistent memory

[sashiko-bot@kernel.org]

> From: Michael Reeves <michael.reeves077@gmail.com>
> 
> cd321x_update_work() passes a pointer to a local stack variable
> (&st.partner_identity) to typec_register_partner(). The Type-C core
> caches this pointer, leading to a stack-use-after-free and a kernel
> Oops when accessed later (e.g., via get_pd_product_type()).
> 
> Fix this by copying the identity to the heap-allocated cd321x struct
> and passing a pointer to that persistent memory instead. Move up
> the assignment to cd321x->cur_partner_identity, so this works.
> 
> Reported-by: Nicole Mazzuca <nicole@streganil.no>
> Closes: https://github.com/AsahiLinux/linux/issues/668
> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
> Cc: stable@vger.kernel.org
> Signed-off-by: Michael Reeves <michael.reeves077@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107-tipd-stack-uaf-fix-v1-1-efcb517924ec@gmail.com?part=1