Re: [PATCH 14/19] usb: typec: mux: it5205: fix oops on accessory modes

[Heikki Krogerus]

On Tue, Oct 27, 2026 at 03:57:54PM +0100, Greg Kroah-Hartman wrote:
> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> 
> typec_set_mode() passes a state without an alternate mode, and the USB
> and accessory modes (TYPEC_MODE_USB2 ... TYPEC_MODE_DEBUG) start at
> TYPEC_STATE_MODAL like the states of the alternate modes. TCPM and UCSI
> set TYPEC_MODE_AUDIO or TYPEC_MODE_DEBUG when such an accessory is
> attached. it5205_mux_set() then reads state->alt->svid: plugging in an
> analog audio adapter is a NULL pointer dereference.

Please just explain here that the code is accessing state->alt->svid
without first checking does state->alt exist.

Then make a note that state->alt is NULL if for example TCPM sets the
mux to an accessory mode TYPEC_MODE_AUDIO or TYPEC_MODE_DEBUG.

> The numbers must not reach the switch either: TYPEC_MODE_AUDIO has the
> value of TYPEC_DP_STATE_D. Without an alternate mode connect the
> SuperSpeed lanes for TYPEC_MODE_USB3 and disconnect them for the rest.

I think what that is trying to say is that this driver needs to handle
the mode value separately with the "normal" USB Type-C modes and the
alternate modes, because those values overlap, right?

> Fixes: 41fe9ea1696c ("usb: typec: mux: Add ITE IT5205 Alternate Mode Passive MUX driver")
> Cc: stable <stable@xxxxxxxxxx>
> Cc: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/usb/typec/mux/it5205.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/typec/mux/it5205.c b/drivers/usb/typec/mux/it5205.c
> index 2ab2ba6a3cbd..00d5bd55e423 100644
> --- a/drivers/usb/typec/mux/it5205.c
> +++ b/drivers/usb/typec/mux/it5205.c
> @@ -92,13 +92,19 @@ static int it5205_switch_set(struct typec_switch_dev *sw, enum typec_orientation
>  static int it5205_mux_set(struct typec_mux_dev *mux, struct typec_mux_state *state)
>  {
>  	struct it5205 *it = typec_mux_get_drvdata(mux);
> +	unsigned long mode = state->mode;
>  	u8 val;
>  
> -	if (state->mode >= TYPEC_STATE_MODAL &&
> -	    state->alt->svid != USB_TYPEC_DP_SID)
> -		return -EINVAL;
> +	if (mode >= TYPEC_STATE_MODAL) {
> +		/* USB and accessory modes: not the DP pin assignments */
> +		if (!state->alt)
> +			mode = mode == TYPEC_MODE_USB3 ? TYPEC_STATE_USB :
> +							 TYPEC_STATE_SAFE;

So now if the mux is set to an accessory mode, this function returns
successfully, even thought the connector is not actually in that
accessory mode?

Return -EINVAL in that case?

thanks,


> +		else if (state->alt->svid != USB_TYPEC_DP_SID)
> +			return -EINVAL;
> +	}

-- 
heikki