Re: [PATCH 00/19] USB: a bunch of llm-found fixes

[Romain Gantois]

On Tuesday, 27 October 2026 15:57:55 CET Greg Kroah-Hartman wrote:
> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> 
> typec_set_mode() passes a state without an alternate mode, and the USB
> and accessory modes (TYPEC_MODE_USB2 ... TYPEC_MODE_DEBUG) start at
> TYPEC_STATE_MODAL like the states of the alternate modes. TCPM and UCSI
> set TYPEC_MODE_AUDIO or TYPEC_MODE_DEBUG when such an accessory is
> attached. tusb1046_mux_set() then reads state->alt->svid: plugging in an
> analog audio adapter is a NULL pointer dereference.
> 
> The numbers must not reach the switch either: TYPEC_MODE_AUDIO has the
> value of TYPEC_DP_STATE_D. Without an alternate mode connect the
> SuperSpeed lanes for TYPEC_MODE_USB3 and disconnect them for the rest.
> 
> Fixes: 7c561b8c3e83 ("usb: typec: mux: Add support for the TUSB1046
> crosspoint switch") Cc: stable <stable@xxxxxxxxxx>
> Cc: Romain Gantois <romain.gantois@xxxxxxxxxxx>
> Cc: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/usb/typec/mux/tusb1046.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/typec/mux/tusb1046.c
> b/drivers/usb/typec/mux/tusb1046.c index 34ef81f75693..a463ba5f53be 100644
> --- a/drivers/usb/typec/mux/tusb1046.c
> +++ b/drivers/usb/typec/mux/tusb1046.c
> @@ -43,11 +43,17 @@ static int tusb1046_mux_set(struct typec_mux_dev *mux,
>  	struct tusb1046_priv *priv = typec_mux_get_drvdata(mux);
>  	struct i2c_client *client = priv->client;
>  	struct device *dev = &client->dev;
> +	unsigned long req = state->mode;
>  	int mode, val, ret = 0;
> 
> -	if (state->mode >= TYPEC_STATE_MODAL &&
> -	    state->alt->svid != USB_TYPEC_DP_SID)
> -		return -EINVAL;
> +	if (req >= TYPEC_STATE_MODAL) {
> +		/* USB and accessory modes: not the DP pin assignments */
> +		if (!state->alt)
> +			req = req == TYPEC_MODE_USB3 ? TYPEC_STATE_USB :
> +						       TYPEC_STATE_SAFE;
> +		else if (state->alt->svid != USB_TYPEC_DP_SID)
> +			return -EINVAL;
> +	}
> 
>  	dev_dbg(dev, "mux mode requested: %lu\n", state->mode);
> 
> @@ -60,7 +66,7 @@ static int tusb1046_mux_set(struct typec_mux_dev *mux,
>  		goto out_unlock;
>  	}
> 
> -	switch (state->mode) {
> +	switch (req) {
>  	case TYPEC_STATE_USB:
>  		mode = TUSB1046_CTLSEL_USB3;
>  		break;

Signed-off-by: Romain Gantois <romain.gantois@xxxxxxxxxxx>