[PATCH v3 0/2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[Radhey Shyam Pandey]

tps6598x_connect() and cd321x_update_work() pass a stack-allocated
typec_partner_desc to typec_register_partner() after initializing only
usb_pd, accessory and identity.

typec_register_partner() copies attach and deattach from the descriptor
into the partner. With those fields left unset, garbage function pointers
may be stored and later invoked from typec_partner_link_device() when a USB
device is linked to the port. Uninitialized pd_revision and usb_capability
similarly leak stack data through partner sysfs.

Zero-initialize the descriptor in each call site so optional callbacks
remain NULL and the remaining fields are zero.

The series is split into one patch per function so each fix can be
backported independently with the correct stable prerequisite:

  - tps6598x_connect(): Cc stable # 5.15+ (core.c, v5.13)
  - cd321x_update_work(): Cc stable # 6.18+

Changes for v3:
- Split v2 into separate patches to simplify LTS backporting.
- Add stable Cc prerequisites per patch.
- Drop Reviewed-by tag while the series is split.

Changes for v2:
- Add Assisted-by tag.
- Remove explicit identity = NULL.

Radhey Shyam Pandey (2):
  usb: typec: tipd: fix uninitialized typec_partner_desc in
    tps6598x_connect()
  usb: typec: tipd: fix uninitialized typec_partner_desc in
    cd321x_update_work()

 drivers/usb/typec/tipd/core.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

base-commit: 5e6de6a2b522f659defacb1551d0465ba6ce13cf
-- 
2.43.0