Re: [PATCH] usb: typec: tipd: assign partner identity to persistent memory

[Heikki Krogerus]

On Sat, Nov 07, 2026 at 10:06:17AM +0000, Michael Reeves via B4 Relay wrote:
> From: Michael Reeves <michael.reeves077@xxxxxxxxx>
> 
> cd321x_update_work() passes a pointer to a local stack variable
> (&st.partner_identity) to typec_register_partner(). The Type-C core
> caches this pointer, leading to a stack-use-after-free and a kernel
> Oops when accessed later (e.g., via get_pd_product_type()).
> 
> Fix this by copying the identity to the heap-allocated cd321x struct
> and passing a pointer to that persistent memory instead. Move up
> the assignment to cd321x->cur_partner_identity, so this works.
> 
> Reported-by: Nicole Mazzuca <nicole@xxxxxxxxxxxx>
> Closes: https://github.com/AsahiLinux/linux/issues/668
> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Michael Reeves <michael.reeves077@xxxxxxxxx>

Acked-by: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>

> ---
> Cc: Nicole Mazzuca <nicole@xxxxxxxxxxxx>
> Cc: asahi@xxxxxxxxxxxxxxx
> ---
>  drivers/usb/typec/tipd/core.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index 02539378ffed..dce0aa8be5e0 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c
> @@ -855,8 +855,10 @@ static void cd321x_update_work(struct work_struct *work)
>  		desc.usb_pd = is_pd;
>  		desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
>  
> -		if (desc.usb_pd)
> -			desc.identity = &st.partner_identity;
> +		if (desc.usb_pd) {
> +			cd321x->cur_partner_identity = st.partner_identity;
> +			desc.identity = &cd321x->cur_partner_identity;
> +		}
>  
>  		tps->partner = typec_register_partner(tps->port, &desc);
>  		if (IS_ERR(tps->partner)) {
> @@ -864,10 +866,8 @@ static void cd321x_update_work(struct work_struct *work)
>  			return;
>  		}
>  
> -		if (desc.identity) {
> +		if (desc.identity)
>  			typec_partner_set_identity(tps->partner);
> -			cd321x->cur_partner_identity = st.partner_identity;
> -		}
>  	}
>  
>  	/* Update the TypeC MUX/PHY state */
> 
> ---
> base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
> change-id: 20261107-tipd-stack-uaf-fix-d3148059c017
> 
> Best regards,
> -- 
> Michael Reeves <michael.reeves077@xxxxxxxxx>
> 

-- 
heikki