On Tue, Apr 14, 2020 at 03:33:13PM +0200, Hans de Goede wrote:
> Since commit ef441dd6af91 ("usb: typec: mux: Allow the muxes to be named")
> the typec_switch_desc and typec_mux_desc structs contain a name field.
>
> The pi3usb30532 driver allocates these structs on the stack and so far did
> not explicitly zero the mem used for the structs. This causes the new name
> fields to point to a random memory address, which in my test case happens
> to be a valid address leading to "interesting" mux / switch names:
>
> [root@localhost ~]# ls -l /sys/class/typec_mux/
> total 0
> lrwxrwxrwx. 1 root root 0 Apr 14 12:55 ''$'\r''-switch' -> ...
> lrwxrwxrwx. 1 root root 0 Apr 14 12:55 ''$'\320\302\006''2'$'...
>
> Explicitly initialize the structs to zero when declaring them on the stack
> so that any unused fields get set to 0, fixing this.
>
> Fixes: ef441dd6af91 ("usb: typec: mux: Allow the muxes to be named")
> Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
Acked-by: Heikki Krogerus <heikki.krogerus@xxxxxxxxxxxxxxx>
> ---
> drivers/usb/typec/mux/pi3usb30532.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/typec/mux/pi3usb30532.c b/drivers/usb/typec/mux/pi3usb30532.c
> index 46457c133d2b..7afe275b17d0 100644
> --- a/drivers/usb/typec/mux/pi3usb30532.c
> +++ b/drivers/usb/typec/mux/pi3usb30532.c
> @@ -114,8 +114,8 @@ pi3usb30532_mux_set(struct typec_mux *mux, struct typec_mux_state *state)
> static int pi3usb30532_probe(struct i2c_client *client)
> {
> struct device *dev = &client->dev;
> - struct typec_switch_desc sw_desc;
> - struct typec_mux_desc mux_desc;
> + struct typec_switch_desc sw_desc = { };
> + struct typec_mux_desc mux_desc = { };
> struct pi3usb30532 *pi;
> int ret;
>
> --
> 2.26.0
thanks,
--
heikki
