| Message ID | 20200414133313.131802-1-hdegoede@redhat.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | 97341ef7070d984305aaefe8b713491e3213d6ab |
| Headers | show |
| Series | usb: typec: pi3usb30532: Set switch_ / mux_desc name field to NULL | expand |
On Tue, Apr 14, 2020 at 03:33:13PM +0200, Hans de Goede wrote: > Since commit ef441dd6af91 ("usb: typec: mux: Allow the muxes to be named") > the typec_switch_desc and typec_mux_desc structs contain a name field. > > The pi3usb30532 driver allocates these structs on the stack and so far did > not explicitly zero the mem used for the structs. This causes the new name > fields to point to a random memory address, which in my test case happens > to be a valid address leading to "interesting" mux / switch names: > > [root@localhost ~]# ls -l /sys/class/typec_mux/ > total 0 > lrwxrwxrwx. 1 root root 0 Apr 14 12:55 ''$'\r''-switch' -> ... > lrwxrwxrwx. 1 root root 0 Apr 14 12:55 ''$'\320\302\006''2'$'... > > Explicitly initialize the structs to zero when declaring them on the stack > so that any unused fields get set to 0, fixing this. > > Fixes: ef441dd6af91 ("usb: typec: mux: Allow the muxes to be named") > Signed-off-by: Hans de Goede <hdegoede@redhat.com> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> > --- > drivers/usb/typec/mux/pi3usb30532.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/usb/typec/mux/pi3usb30532.c b/drivers/usb/typec/mux/pi3usb30532.c > index 46457c133d2b..7afe275b17d0 100644 > --- a/drivers/usb/typec/mux/pi3usb30532.c > +++ b/drivers/usb/typec/mux/pi3usb30532.c > @@ -114,8 +114,8 @@ pi3usb30532_mux_set(struct typec_mux *mux, struct typec_mux_state *state) > static int pi3usb30532_probe(struct i2c_client *client) > { > struct device *dev = &client->dev; > - struct typec_switch_desc sw_desc; > - struct typec_mux_desc mux_desc; > + struct typec_switch_desc sw_desc = { }; > + struct typec_mux_desc mux_desc = { }; > struct pi3usb30532 *pi; > int ret; > > -- > 2.26.0 thanks,
diff --git a/drivers/usb/typec/mux/pi3usb30532.c b/drivers/usb/typec/mux/pi3usb30532.c index 46457c133d2b..7afe275b17d0 100644 --- a/drivers/usb/typec/mux/pi3usb30532.c +++ b/drivers/usb/typec/mux/pi3usb30532.c @@ -114,8 +114,8 @@ pi3usb30532_mux_set(struct typec_mux *mux, struct typec_mux_state *state) static int pi3usb30532_probe(struct i2c_client *client) { struct device *dev = &client->dev; - struct typec_switch_desc sw_desc; - struct typec_mux_desc mux_desc; + struct typec_switch_desc sw_desc = { }; + struct typec_mux_desc mux_desc = { }; struct pi3usb30532 *pi; int ret;
Since commit ef441dd6af91 ("usb: typec: mux: Allow the muxes to be named") the typec_switch_desc and typec_mux_desc structs contain a name field. The pi3usb30532 driver allocates these structs on the stack and so far did not explicitly zero the mem used for the structs. This causes the new name fields to point to a random memory address, which in my test case happens to be a valid address leading to "interesting" mux / switch names: [root@localhost ~]# ls -l /sys/class/typec_mux/ total 0 lrwxrwxrwx. 1 root root 0 Apr 14 12:55 ''$'\r''-switch' -> ... lrwxrwxrwx. 1 root root 0 Apr 14 12:55 ''$'\320\302\006''2'$'... Explicitly initialize the structs to zero when declaring them on the stack so that any unused fields get set to 0, fixing this. Fixes: ef441dd6af91 ("usb: typec: mux: Allow the muxes to be named") Signed-off-by: Hans de Goede <hdegoede@redhat.com> --- drivers/usb/typec/mux/pi3usb30532.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)