Re: [PATCH v2] usb: typec: tipd: fix uninitialized typec_partner_desc on stack

On 8/8/2026 12:41 PM, Greg KH wrote:
> On Fri, Aug 07, 2026 at 11:16:58PM +0530, Radhey Shyam Pandey wrote:
>> tps6598x_connect() and cd321x_update_work() pass a stack-allocated
>> typec_partner_desc to typec_register_partner() after initializing only
>> usb_pd, accessory and identity.
>>
>> typec_register_partner() copies attach and deattach from the descriptor
>> into the partner. With those fields left unset, garbage function pointers
>> may be stored and later invoked from typec_partner_link_device() when a USB
>> device is linked to the port. Uninitialized pd_revision and usb_capability
>> similarly leak stack data through partner sysfs.
>>
>> Zero-initialize the descriptor so optional callbacks remain NULL and the
>> remaining fields are zero.
>>
>> Assisted-by: claude-mythos-preview-high
>> Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
>> Fixes: 0a4c005bd171 ("usb: typec: driver for TI TPS6598x USB Power Delivery controllers")
> 
> Two different commits caused this issue?  Does that mean two different
> commits should fix it?  How far back should this be backported?
> 

The two related issues are in different functions and were introduced
independently by the two commits listed in the Fixes: tags.

Since they were introduced independently, in the next version I will
split the fix into two patches, each with the appropriate Fixes: tag
and stable version marker.

Thanks,
Radhey