mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-usb@vger.kernel.org
Cc: Alan Stern <stern@rowland.harvard.edu>,
	linux-kernel@vger.kernel.org,
	 Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	 Josef Bacik <josef@toxicpanda.com>, stable <stable@kernel.org>,
	 Heikki Krogerus <heikki.krogerus@linux.intel.com>,
	 Benson Leung <bleung@chromium.org>
Subject: [PATCH 13/19] usb: typec: anx7411: zero on-stack alt mode descriptors
Date: Tue, 27 Oct 2026 15:57:53 +0100	[thread overview]
Message-ID: <20261027-llm-usb-v1-13-b9751ddb9c7c@linuxfoundation.org> (raw)
In-Reply-To: <20261027-llm-usb-v1-0-b9751ddb9c7c@linuxfoundation.org>

From: Josef Bacik <josef@toxicpanda.com>

typec_port_register_altmodes() and anx7411_typec_register_altmode() fill a
struct typec_altmode_desc on the stack member by member: svid, vdo, mode.
typec_register_altmode() reads three more members:

 - inactive: a port alternate mode is registered with active = !inactive.
   If the byte of stack garbage is not 0, the mode starts disabled and
   typec_altmode_enter() refuses it with -EPERM until somebody writes to
   the "active" attribute of the port;
 - mode_selection: the DisplayPort and Thunderbolt drivers enter the mode
   on their own only if it is false. For the partner alternate modes of
   anx7411, garbage there means that the mode is never entered;
 - roles: decides what supported_roles of the port alternate mode shows.

typec_port_register_altmodes() is what tcpm and anx7411 register the
alternate modes of their ports with.
CONFIG_INIT_STACK_ALL_ZERO=y hides the problem.

Fixes: 183b194d8fb6 ("usb: typec: Make active on port altmode writable")
Fixes: be727d400066 ("usb: typec: Introduce mode_selection bit")
Fixes: 7b458a4c5d73 ("usb: typec: Add typec_port_register_altmodes()")
Cc: stable <stable@kernel.org>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Cc: Benson Leung <bleung@chromium.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/typec/anx7411.c | 2 +-
 drivers/usb/typec/class.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/typec/anx7411.c b/drivers/usb/typec/anx7411.c
index 06c25af094b3..ac122ab3175a 100644
--- a/drivers/usb/typec/anx7411.c
+++ b/drivers/usb/typec/anx7411.c
@@ -552,7 +552,7 @@ static int anx7411_typec_register_altmode(struct anx7411_data *ctx,
 					  int svid, int vdo)
 {
 	struct device *dev = &ctx->spi_client->dev;
-	struct typec_altmode_desc desc;
+	struct typec_altmode_desc desc = {};
 	int err;
 	int i;
 
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 54c7810b563b..9d9703c70820 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -2684,7 +2684,7 @@ void typec_port_register_altmodes(struct typec_port *port,
 	struct typec_altmode **altmodes, size_t n)
 {
 	struct fwnode_handle *child;
-	struct typec_altmode_desc desc;
+	struct typec_altmode_desc desc = {};
 	struct typec_altmode *alt;
 	size_t index = 0;
 	u16 svid;

-- 
2.56.0


  parent reply	other threads:[~2026-10-27 14:58 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-27 14:57 [PATCH 00/19] USB: a bunch of llm-found fixes Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 01/19] usb: core: sysfs: take the port lock to read the BOS Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 02/19] USB: core: signal the end of an sg request last Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 03/19] usbip: vudc: free the unlink item if the send fails Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 04/19] usb: host: oxu210hp-hcd: fix oxu_qh_alloc() deadlock Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 05/19] usb: cdns3: switch the role unlocked on resume Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 06/19] usb: gadget: snps_udc_plat: lock out the interrupt Greg Kroah-Hartman
2026-10-27 18:17   ` Herve Codina
2026-10-27 14:57 ` [PATCH 07/19] usb: gadget: bdc: the resume callback is optional Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 08/19] usb: gadget: uvc: fix oops on a premature STREAMON Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 09/19] usb: gadget: f_fs: let the request keep its fence Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 10/19] usb: host: ehci-orion: fix the probe without DT Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 11/19] usb: typec: tcpm: don't wait for the VDM discovery work Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 12/19] usb: typec: tcpci: don't act on unread alerts Greg Kroah-Hartman
2026-10-27 14:57 ` Greg Kroah-Hartman [this message]
2026-10-27 14:57 ` [PATCH 14/19] usb: typec: mux: it5205: fix oops on accessory modes Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 15/19] usb: typec: mux: tusb1046: " Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 16/19] usb: renesas_usbhs: link URBs with interrupts disabled Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 17/19] usb: renesas_usbhs: unlink the URB if it is not queued Greg Kroah-Hartman
2026-10-27 14:57 ` [PATCH 18/19] usb: isp1760: wait for the TT clear in endpoint_disable Greg Kroah-Hartman
2026-10-27 15:21   ` Rui Miguel Silva
2026-10-27 14:57 ` [PATCH 19/19] usb: dwc2: " Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261027-llm-usb-v1-13-b9751ddb9c7c@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=bleung@chromium.org \
    --cc=heikki.krogerus@linux.intel.com \
    --cc=josef@toxicpanda.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=stable@kernel.org \
    --cc=stern@rowland.harvard.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox

all inboxes | Powered by JetHome®