linux/drivers/usb
Amit Sunil Dhamne cd3b9cea67 usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling
When a sink detach occurs while waiting for TX send status, the old
TCPM_SOURCING_VBUS event along with TCPM_VBUS_EVENT and TCPM_CC_EVENT
can be queued in port->pd_events. Because TCPM_SOURCING_VBUS is
evaluated after TCPM_VBUS_EVENT and TCPM_CC_EVENT in
tcpm_pd_event_handler(), a stale TCPM_SOURCING_VBUS event can override
the detach handling and incorrectly set port->vbus_source and
port->vbus_present to true.

Add a state guard to check that the port is either operating as a
Source (tcpm_port_is_source(port)) or in a Fast Role Swap (FRS) state
up to FR_SWAP_SNK_SRC_SOURCE_VBUS_APPLIED before processing
TCPM_SOURCING_VBUS. Otherwise, discard and log the event.

Log snippet for error condition before fix:
[72792.204955] state change SRC_ATTACHED -> SRC_STARTUP [rev3 NONE_AMS]
[72792.204960] sourcing vbus
[72792.204962] VBUS on
[72792.204970] AMS POWER_NEGOTIATION start
[72792.204974] cc:=4
[72792.205319] state change SRC_STARTUP -> AMS_START [rev3 POWER_NEGOTIATION]
[72792.205325] state change AMS_START -> SRC_SEND_CAPABILITIES [rev3 POWER_NEGOTIATION]
[72792.205332] PD TX, header: 0x11a1
[72792.216911] PD TX complete, status: 2
[72792.216957] pending state change SRC_SEND_CAPABILITIES -> SRC_SEND_CAPABILITIES @ 150 ms [rev3 POWER_NEGOTIATION]
[72792.218005] VBUS off
[72792.218013] pending state change SRC_SEND_CAPABILITIES -> SNK_UNATTACHED @ 650 ms [rev3 POWER_NEGOTIATION]
[72792.218020] VBUS VSAFE0V
[72792.218024] state change SRC_SEND_CAPABILITIES -> SNK_UNATTACHED [rev3 POWER_NEGOTIATION]
[72792.218458] CC1: 2 -> 0, CC2: 0 -> 0 [state SNK_UNATTACHED, polarity 0, disconnected]
[72792.218467] VBUS on --> VBUS left on
[72792.218980] disable vbus discharge ret:0
[72792.235193] Start toggling

After fix:
[ 1195.291691] state change SRC_ATTACHED -> SRC_STARTUP [rev3 NONE_AMS]
[ 1195.291698] sourcing vbus
[ 1195.291700] VBUS on
[ 1195.291707] AMS POWER_NEGOTIATION start
[ 1195.291710] cc:=4
[ 1195.291758] state change SRC_STARTUP -> AMS_START [rev3 POWER_NEGOTIATION]
[ 1195.291794] state change AMS_START -> SRC_SEND_CAPABILITIES [rev3 POWER_NEGOTIATION]
[ 1195.291798] PD TX, header: 0x11a1
[ 1195.297056] PD TX complete, status: 2
[ 1195.297092] pending state change SRC_SEND_CAPABILITIES -> SRC_SEND_CAPABILITIES @ 150 ms [rev3 POWER_NEGOTIATION]
[ 1195.297177] VBUS off
[ 1195.297184] pending state change SRC_SEND_CAPABILITIES -> SNK_UNATTACHED @ 650 ms [rev3 POWER_NEGOTIATION]
[ 1195.297227] CC1: 2 -> 0, CC2: 0 -> 0 [state SRC_SEND_CAPABILITIES, polarity 0, disconnected]
[ 1195.307469] cc:=2
[ 1195.307544] pending state change SRC_SEND_CAPABILITIES -> SNK_UNATTACHED @ 650 ms [rev3 POWER_NEGOTIATION]
[ 1195.307555] Discarding sourcing vbus! Invalid state SRC_SEND_CAPABILITIES
[ 1195.957636] state change SRC_SEND_CAPABILITIES -> SNK_UNATTACHED [delayed 650 ms]
[ 1195.957732] disable vbus discharge ret:0
[ 1195.970196] Start toggling
[ 1195.970468] VBUS off
[ 1196.051637] VBUS off
[ 1196.051642] VBUS VSAFE0V

Fixes: 8dc4bd0736 ("usb: typec: tcpm: Add support for Sink Fast Role SWAP(FRS)")
Cc: stable <stable@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Amit Sunil Dhamne <amitsd@google.com>
Reviewed-by: Badhri Jagan Sridharan <badhri@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://patch.msgid.link/20260827-sourcing-vbus-v1-1-9be1aca991a0@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-08-31 18:44:47 +02:00
..
atm Including fixes from Bluetooth, IPSec and Netfilter. 2026-08-27 13:53:43 -07:00
c67x00 USB: c67x00: fix use-after-free in c67x00_add_iso_urb() 2026-08-14 10:49:00 +09:00
cdns3 Merge 7.2-rc7 into usb-next 2026-08-14 10:17:11 +09:00
chipidea USB / Thunderbolt changes for 7.3-rc1 2026-08-25 10:44:46 -07:00
class Merge 7.2-rc3 into usb-next 2026-07-13 07:09:28 +02:00
common USB: ulpi: fix memory leak on registration failure 2026-06-25 15:11:27 +01:00
core usb: usbfs: fix use-after-free of usb_device in usbdev_release() 2026-08-14 10:49:38 +09:00
dwc2 usb: dwc2: gadget: Exit partial power down state when changing USB pull-up 2026-08-14 10:48:41 +09:00
dwc3 usb: dwc3: gadget: Fix use-after-free in dwc3_gadget_free_endpoints due to race condition 2026-08-14 10:49:25 +09:00
early usb: early: xhci-dbc: Fix early_ioremap leak 2025-07-07 11:04:46 +02:00
fotg210 usb: free iso schedules on failed submit 2026-07-08 13:30:38 +02:00
gadget usb: gadget: uvc: fix dangling pointers in uvc_function_bind() and uvc_function_unbind() 2026-08-14 10:49:48 +09:00
host xhci: fix lost bounce buffers on TDs spanning several ring segments 2026-08-31 11:43:00 +02:00
image Merge 7.0-rc4 into usb-next 2026-03-16 11:50:48 +01:00
isp1760 Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
misc usb: usbtest: disable dynamic ID support 2026-08-14 10:49:12 +09:00
mon Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
mtu3 Merge 7.2-rc3 into usb-next 2026-07-13 07:09:28 +02:00
musb USB / Thunderbolt changes for 7.3-rc1 2026-08-25 10:44:46 -07:00
phy USB: phy: fsl-usb: fix missing static keywords 2026-07-17 17:54:18 +02:00
renesas_usbhs usb: renesas_usbhs: Fix power-off ordering on unbind 2026-07-10 15:56:24 +02:00
roles usb: roles: get usb role switch from parent only for usb-b-connector 2026-03-11 16:22:22 +01:00
serial USB serial updates for 7.3-rc1 2026-08-14 10:25:23 +09:00
storage USB: storage: add NO_ATA_1X quirk for Longmai USB Key 2026-07-16 17:11:02 +02:00
typec usb: typec: tcpm: constrain TCPM_SOURCING_VBUS event handling 2026-08-31 18:44:47 +02:00
usbip usbip: vudc: fix NULL deref in vep_dequeue() 2026-07-08 13:29:31 +02:00
Kconfig
Makefile usb: cdns3: Add USBSSP platform driver support 2026-04-27 05:14:18 -06:00
usb-skeleton.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00