diff options
| author | Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> | 2026-09-06 18:49:42 +0530 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-09-10 17:09:19 +0200 |
| commit | 88c7e458af53ff781a3f1051708395892b325576 (patch) | |
| tree | 7bb55766d1236af65693174c1b494b87d66c5208 /tools/lib/python/kdoc/python_version.py | |
| parent | c4b27b3605788bbf9e4251f3cd4ab94645ab036f (diff) | |
| download | linux-next-88c7e458af53ff781a3f1051708395892b325576.tar.gz linux-next-88c7e458af53ff781a3f1051708395892b325576.zip | |
usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()
cd321x_update_work() passes a stack-allocated typec_partner_desc to
typec_register_partner() after initializing only usb_pd, accessory and
identity.
typec_register_partner() copies attach and deattach from the descriptor
into the partner. With those fields left unset, garbage function pointers
may be stored and later invoked from typec_partner_link_device() when a USB
device is linked to the port. Uninitialized pd_revision and usb_capability
similarly leak stack data through partner sysfs.
Zero-initialize the descriptor so optional callbacks remain NULL and the
remaining fields are zero.
Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
Cc: stable <stable@kernel.org> # 6.18+
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://patch.msgid.link/20260906131942.83153-3-radhey.shyam.pandey@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/lib/python/kdoc/python_version.py')
0 files changed, 0 insertions, 0 deletions