Repository navigation
Conversation
The pmic_glink client is released by the devres cleanup, which runs after pmic_glink_ucsi_remove() has returned, so its notification callbacks can queue work until then. Work that runs after ucsi_unregister() has been called touches freed state: it dereferences the connector array that ucsi_unregister() freed, or registers and unregisters the instance a second time. Disable both work items with disable_work_sync() before unregistering, and unregister only if the instance is still registered. This issue was found by an in-house static analysis tool. Fixes: 62b5412 ("usb: typec: ucsi: add PMIC Glink UCSI driver") Cc: stable <stable@kernel.org> Assisted-by: Codex:gpt-5.6 Link: https://lore.kernel.org/r/20260227190430.889-1-nathan.c.rebello@gmail.com Co-developed-by: Song Li <songl@zju.edu.cn> Signed-off-by: Song Li <songl@zju.edu.cn> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn> Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> Link: https://patch.msgid.link/20260908060216.616045-1-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit 63b269e)
The PMIC GLINK transport checks that a message contains its header, but does not require an opcode-specific payload. Both UCSI acknowledgement handlers need a return code after that header. For a read acknowledgement shorter than the header and return code, the unsigned payload-length subtraction underflows. This can leave the selected buffer length unchanged and read the return code beyond the received message. The write handler also reads its return code without checking that it is present. Reject these short replies before selecting or accessing their payloads. Keep the existing acceptance of partial read payloads, version-dependent buffer selection, return-code handling and valid completions unchanged. This is a source-level robustness fix. It does not establish that the firmware has sent a malformed reply on any particular device. Fixes: 62b5412 ("usb: typec: ucsi: add PMIC Glink UCSI driver")
Allocate a distinct package ABI for local module and package validation without replacing the accepted v25 source or artifacts. Keep the existing annotation configuration, device trees and non-Stubble delivery policy unchanged. This qualification entry does not claim a physical firmware fault, USB4 enablement or a system-sleep fix.
ooaklee
marked this pull request as ready for review
October 20, 2026 20:06
7 of 11 tasks
1 of 3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Source-equivalent successor to UCSI PR #70, following the squash of SAM/input PR #75 onto
x/sp11-qualified-base-7.2.5-20261020.A direct retarget of the old dependent branch after that squash creates a real changelog conflict. This successor replays only the three original UCSI commits, preserving author identities/dates, full messages/trailers and stable patch IDs. No original qualification or research branch is rewritten.
The net delta is exactly
drivers/usb/typec/ucsi/ucsi_glink.canddebian.qcom-x1e/changelog. The completed source tree must equal original v26 commit63de629462c5c392402977e184c4b2248b82560c, treebd947b826e14a835a71bf364cba8af28076387aa, before merging and again after the squash.Qualified scope and limits
Carry the previously checked remove-path fix, short-ACK admission and v26 package version. Native module/package validation, Lexr installation and reported ordinary-use checks belong to the original producer/source. No package is relabelled as built from the new squash SHA, and no new build or hardware test is claimed.
Malformed-reply/remove-race execution, USB4, broad suspend and full device parity remain unqualified. This is a fork-only 7.2.5 staging consolidation, not current-upstream, beta/stable, provenance or fork-CI acceptance. Upstream 7.2.9 reconstruction and the remaining promotion gates are tracked in OE #33.
The original v8/v25/v26 source refs, research PRs, Surface, builds, volumes and installed defaults remain unchanged. GLINK channel ownership/crossed-OPEN work remains deferred.