Re: [PATCH] usb: typec: tipd: assign partner identity to persistent memory

[Sven Peter]

On 11/7/26 11:06, Michael Reeves via B4 Relay wrote:
> From: Michael Reeves <michael.reeves077@xxxxxxxxx>
>
> cd321x_update_work() passes a pointer to a local stack variable
> (&st.partner_identity) to typec_register_partner(). The Type-C core
> caches this pointer, leading to a stack-use-after-free and a kernel
> Oops when accessed later (e.g., via get_pd_product_type()).
>
> Fix this by copying the identity to the heap-allocated cd321x struct
> and passing a pointer to that persistent memory instead. Move up
> the assignment to cd321x->cur_partner_identity, so this works.
>
> Reported-by: Nicole Mazzuca <nicole@xxxxxxxxxxxx>
> Closes: https://github.com/AsahiLinux/linux/issues/668
> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Michael Reeves <michael.reeves077@xxxxxxxxx>
> ---

Reviewed-by: Sven Peter <sven@xxxxxxxxxx>


Thanks,


Sven