[PATCH] usb: typec: tipd: assign partner identity to persistent memory

[PATCH] usb: typec: tipd: assign partner identity to persistent memory

[Michael Reeves via B4 Relay]

From: Michael Reeves <michael.reeves077@gmail.com>

cd321x_update_work() passes a pointer to a local stack variable
(&st.partner_identity) to typec_register_partner(). The Type-C core
caches this pointer, leading to a stack-use-after-free and a kernel
Oops when accessed later (e.g., via get_pd_product_type()).

Fix this by copying the identity to the heap-allocated cd321x struct
and passing a pointer to that persistent memory instead. Move up
the assignment to cd321x->cur_partner_identity, so this works.

Reported-by: Nicole Mazzuca <nicole@streganil.no>
Closes: https://github.com/AsahiLinux/linux/issues/668
Fixes: 82432bbfb9e8 ("usb: typec: tipd: Handle mode transitions for CD321x")
Cc: stable@vger.kernel.org
Signed-off-by: Michael Reeves <michael.reeves077@gmail.com>
---
Cc: Nicole Mazzuca <nicole@streganil.no>
Cc: asahi@lists.linux.dev
---
 drivers/usb/typec/tipd/core.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
index 02539378ffed..dce0aa8be5e0 100644
--- a/drivers/usb/typec/tipd/core.c
+++ b/drivers/usb/typec/tipd/core.c
@@ -855,8 +855,10 @@ static void cd321x_update_work(struct work_struct *work)
 		desc.usb_pd = is_pd;
 		desc.accessory = TYPEC_ACCESSORY_NONE; /* XXX: handle accessories */
 
-		if (desc.usb_pd)
-			desc.identity = &st.partner_identity;
+		if (desc.usb_pd) {
+			cd321x->cur_partner_identity = st.partner_identity;
+			desc.identity = &cd321x->cur_partner_identity;
+		}
 
 		tps->partner = typec_register_partner(tps->port, &desc);
 		if (IS_ERR(tps->partner)) {
@@ -864,10 +866,8 @@ static void cd321x_update_work(struct work_struct *work)
 			return;
 		}
 
-		if (desc.identity) {
+		if (desc.identity)
 			typec_partner_set_identity(tps->partner);
-			cd321x->cur_partner_identity = st.partner_identity;
-		}
 	}
 
 	/* Update the TypeC MUX/PHY state */

---
base-commit: d48723711bae9b8cdc56719c448ba42fef28cbee
change-id: 20261107-tipd-stack-uaf-fix-d3148059c017

Best regards,
-- 
Michael Reeves <michael.reeves077@gmail.com>