[PATCH 15/19] usb: typec: mux: tusb1046: fix oops on accessory modes

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

typec_set_mode() passes a state without an alternate mode, and the USB
and accessory modes (TYPEC_MODE_USB2 ... TYPEC_MODE_DEBUG) start at
TYPEC_STATE_MODAL like the states of the alternate modes. TCPM and UCSI
set TYPEC_MODE_AUDIO or TYPEC_MODE_DEBUG when such an accessory is
attached. tusb1046_mux_set() then reads state->alt->svid: plugging in an
analog audio adapter is a NULL pointer dereference.

The numbers must not reach the switch either: TYPEC_MODE_AUDIO has the
value of TYPEC_DP_STATE_D. Without an alternate mode connect the
SuperSpeed lanes for TYPEC_MODE_USB3 and disconnect them for the rest.

Fixes: 7c561b8c3e83 ("usb: typec: mux: Add support for the TUSB1046 crosspoint switch")
Cc: stable <stable@xxxxxxxxxx>
Cc: Romain Gantois <romain.gantois@xxxxxxxxxxx>
Cc: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/typec/mux/tusb1046.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/typec/mux/tusb1046.c b/drivers/usb/typec/mux/tusb1046.c
index 34ef81f75693..a463ba5f53be 100644
--- a/drivers/usb/typec/mux/tusb1046.c
+++ b/drivers/usb/typec/mux/tusb1046.c
@@ -43,11 +43,17 @@ static int tusb1046_mux_set(struct typec_mux_dev *mux,
 	struct tusb1046_priv *priv = typec_mux_get_drvdata(mux);
 	struct i2c_client *client = priv->client;
 	struct device *dev = &client->dev;
+	unsigned long req = state->mode;
 	int mode, val, ret = 0;
 
-	if (state->mode >= TYPEC_STATE_MODAL &&
-	    state->alt->svid != USB_TYPEC_DP_SID)
-		return -EINVAL;
+	if (req >= TYPEC_STATE_MODAL) {
+		/* USB and accessory modes: not the DP pin assignments */
+		if (!state->alt)
+			req = req == TYPEC_MODE_USB3 ? TYPEC_STATE_USB :
+						       TYPEC_STATE_SAFE;
+		else if (state->alt->svid != USB_TYPEC_DP_SID)
+			return -EINVAL;
+	}
 
 	dev_dbg(dev, "mux mode requested: %lu\n", state->mode);
 
@@ -60,7 +66,7 @@ static int tusb1046_mux_set(struct typec_mux_dev *mux,
 		goto out_unlock;
 	}
 
-	switch (state->mode) {
+	switch (req) {
 	case TYPEC_STATE_USB:
 		mode = TUSB1046_CTLSEL_USB3;
 		break;

-- 
2.56.0