[PATCH 14/19] usb: typec: mux: it5205: fix oops on accessory modes

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

typec_set_mode() passes a state without an alternate mode, and the USB
and accessory modes (TYPEC_MODE_USB2 ... TYPEC_MODE_DEBUG) start at
TYPEC_STATE_MODAL like the states of the alternate modes. TCPM and UCSI
set TYPEC_MODE_AUDIO or TYPEC_MODE_DEBUG when such an accessory is
attached. it5205_mux_set() then reads state->alt->svid: plugging in an
analog audio adapter is a NULL pointer dereference.

The numbers must not reach the switch either: TYPEC_MODE_AUDIO has the
value of TYPEC_DP_STATE_D. Without an alternate mode connect the
SuperSpeed lanes for TYPEC_MODE_USB3 and disconnect them for the rest.

Fixes: 41fe9ea1696c ("usb: typec: mux: Add ITE IT5205 Alternate Mode Passive MUX driver")
Cc: stable <stable@xxxxxxxxxx>
Cc: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/typec/mux/it5205.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/typec/mux/it5205.c b/drivers/usb/typec/mux/it5205.c
index 2ab2ba6a3cbd..00d5bd55e423 100644
--- a/drivers/usb/typec/mux/it5205.c
+++ b/drivers/usb/typec/mux/it5205.c
@@ -92,13 +92,19 @@ static int it5205_switch_set(struct typec_switch_dev *sw, enum typec_orientation
 static int it5205_mux_set(struct typec_mux_dev *mux, struct typec_mux_state *state)
 {
 	struct it5205 *it = typec_mux_get_drvdata(mux);
+	unsigned long mode = state->mode;
 	u8 val;
 
-	if (state->mode >= TYPEC_STATE_MODAL &&
-	    state->alt->svid != USB_TYPEC_DP_SID)
-		return -EINVAL;
+	if (mode >= TYPEC_STATE_MODAL) {
+		/* USB and accessory modes: not the DP pin assignments */
+		if (!state->alt)
+			mode = mode == TYPEC_MODE_USB3 ? TYPEC_STATE_USB :
+							 TYPEC_STATE_SAFE;
+		else if (state->alt->svid != USB_TYPEC_DP_SID)
+			return -EINVAL;
+	}
 
-	switch (state->mode) {
+	switch (mode) {
 	case TYPEC_STATE_USB:
 		val = IT5205_USB;
 		break;

-- 
2.56.0