Re: [PATCH v2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

[Pandey, Radhey Shyam]

On 8/8/2026 12:41 PM, Greg KH wrote:
> On Fri, Aug 07, 2026 at 11:16:58PM +0530, Radhey Shyam Pandey wrote:
> > tps6598x_connect() and cd321x_update_work() pass a stack-allocated
> > typec_partner_desc to typec_register_partner() after initializing only
> > usb_pd, accessory and identity.
> >
> > typec_register_partner() copies attach and deattach from the descriptor
> > into the partner. With those fields left unset, garbage function pointers
> > may be stored and later invoked from typec_partner_link_device() when a USB
> > device is linked to the port. Uninitialized pd_revision and usb_capability
> > similarly leak stack data through partner sysfs.
> >
> > Zero-initialize the descriptor so optional callbacks remain NULL and the
> > remaining fields are zero.
> >
> > Assisted-by: claude-mythos-preview-high
> > Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
> > Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
>
> Two different commits caused this issue?  Does that mean two different
> commits should fix it?  How far back should this be backported?

The two related issues are in different functions and were introduced
independently by the two commits listed in the Fixes: tags.

Since they were introduced independently, in the next version I will
split the fix into two patches, each with the appropriate Fixes: tag
and stable version marker.

Thanks,
Radhey