Repository navigation
Conversation
The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time. Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered. This issue was found by an in-house static analysis tool. Fixes: 62b5412 ("usb: typec: ucsi: add PMIC Glink UCSI driver") Cc: stable <stable@kernel.org> Assisted-by: Codex:gpt-5.6 Link: https://lore.kernel.org/r/20260227190430.889-1-nathan.c.rebello@gmail.com Co-developed-by: Song Li <songl@zju.edu.cn> Signed-off-by: Song Li <songl@zju.edu.cn> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260908060216.616045-1-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 63b269e)
The PMIC GLINK transport checks that a message contains its header, but does not require an opcode-specific payload. Both UCSI acknowledgement handlers need a return code after that header. For a read acknowledgement shorter than the header and return code, the unsigned payload-length subtraction underflows. This can leave the selected buffer length unchanged and read the return code beyond the received message. The write handler also reads its return code without checking that it is present. Reject these short replies before selecting or accessing their payloads. Keep the existing acceptance of partial read payloads, version-dependent buffer selection, return-code handling and valid completions unchanged. This is a source-level robustness fix. It does not establish that the firmware has sent a malformed reply on any particular device. Fixes: 62b5412 ("usb: typec: ucsi: add PMIC Glink UCSI driver")
Allocate a distinct package ABI for local module and package validation without replacing the accepted v25 source or artifacts. Keep the existing annotation configuration, device trees and non-Stubble delivery policy unchanged. This qualification entry does not claim a physical firmware fault, USB4 enablement or a system-sleep fix.
This was referenced Oct 20, 2026
Merged
ooaklee
added a commit
that referenced
this pull request
Oct 20, 2026
- retain the scoped upstream UCSI remove-path correction by Fan Wu and Song Li (per the original Co-developed-by credit), disabling both work items before unregistering; - reject acknowledgement messages shorter than the required header and return code while preserving valid and partial-read handling; - retain the distinct 7.2.5-jg-0sp11v26 qualification entry; and - consolidate only the exact qualified UCSI delta on the fork's staging line. The final source tree must equal original qualified v26 commit 63de629 (tree bd947b8). The successor replays the three original UCSI commits with matching authors, author dates, full messages, trailers and stable patch IDs after the preceding SAM squash. Original per-commit provenance, including upstream review and sign-off scope, remains with the retained source commits. No aggregate certification is invented. Existing packages remain attributed to their original producer commit, not this squash SHA. No new build or device test is claimed; physical malformed-message/remove-race tests, USB4 and broad standby remain unqualified. Beta/default branches and the Surface are unchanged. Original source commits: - 611df88 - 84c3424 - 63de629 Refs #70 Refs #75 Refs ooaklee/linux-surface-pro-11-oe#33 Co-authored-by: Fan Wu <fanwu01@zju.edu.cn> Co-authored-by: Song Li <songl@zju.edu.cn>
Owner
Author
|
Incorporated through the source-equivalent successor PR #77, now squash-merged onto the separate qualified 7.2.5 staging branch. Closing this original dependent review vehicle as incorporated, not claiming this PR itself merged. Verified final commit: 4e9565e6ee38c27fa6752ec663d1ce671ff4d967; full tree The original v26 branch remains unchanged as the source/provenance and research dependency. No package is relabelled, and no new build or hardware test is claimed. Beta/default, the Surface and all build artifacts remain unchanged. Current-upstream reconstruction, fork-CI rollout, scoped provenance clarification and outstanding qualification gates remain tracked in OE #33. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Track the exact UCSI source qualification used for
7.2.5-jg-0sp11v26-qcom-x1e.Stack and evidence
Draft base:
x/sp11-sam-qualification-20261015; head:x/sp11-ucsi-qualification-v26-20261016, source63de629462c5c392402977e184c4b2248b82560c.Prior full native/module and package validation, Lexr installation and user regression checks were completed for v26. The user reported the completed UCSI/regression checks working; unperformed optional lifecycle scenarios are not automatically qualified. Committed-range
git diff --checkpassed. No build, install or hardware test was rerun for this PR.This does not repair the separately deferred GLINK channel-ownership/crossed-OPEN lifecycle work and does not claim USB4 enablement. Later Type-C/display recovery experiments belong to a separate dependent draft.
No changes to the Surface, v25/v26 artifacts, defaults or fallback policy are performed by opening this PR.
Related tracking PRs