Commit a53b4f9c51a9 ("usb: typec: mux: avoid duplicated orientation
switches") started using the orientation switch result array as state for
duplicate detection, but left the array uninitialized.

The first match therefore scans indeterminate stack contents before any
result has been stored. A valid orientation switch may be incorrectly
discarded as a duplicate, causing fwnode_typec_switch_get() to return no
switch.

Zero-initialize the array before collecting matches.

Fixes: a53b4f9c51a9 ("usb: typec: mux: avoid duplicated orientation switches")
Signed-off-by: Haobo Cheng <i@4t.pw>
---
 drivers/usb/typec/mux.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c
index 9b908c46b..55dab1c76 100644
--- a/drivers/usb/typec/mux.c
+++ b/drivers/usb/typec/mux.c
@@ -79,7 +79,7 @@ static void *typec_switch_match(const struct fwnode_handle *fwnode,
  */
 struct typec_switch *fwnode_typec_switch_get(struct fwnode_handle *fwnode)
 {
-	struct typec_switch_dev *sw_devs[TYPEC_MUX_MAX_DEVS];
+	struct typec_switch_dev *sw_devs[TYPEC_MUX_MAX_DEVS] = { };
 	struct typec_switch *sw;
 	int count;
 	int err;
-- 
2.53.0

Hi,

On Tue, Aug 04, 2026 at 04:34:34PM +0800, Haobo Cheng wrote:
> Commit a53b4f9c51a9 ("usb: typec: mux: avoid duplicated orientation
> switches") started using the orientation switch result array as state for
> duplicate detection, but left the array uninitialized.
> 
> The first match therefore scans indeterminate stack contents before any
> result has been stored. A valid orientation switch may be incorrectly
> discarded as a duplicate, causing fwnode_typec_switch_get() to return no
> switch.
> 
> Zero-initialize the array before collecting matches.
> 
> Fixes: a53b4f9c51a9 ("usb: typec: mux: avoid duplicated orientation switches")
> Signed-off-by: Haobo Cheng <i@4t.pw>
> ---

oops.

Cc: stable@vger.kernel.org
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>

Greetings,

-- Sebastian

>  drivers/usb/typec/mux.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c
> index 9b908c46b..55dab1c76 100644
> --- a/drivers/usb/typec/mux.c
> +++ b/drivers/usb/typec/mux.c
> @@ -79,7 +79,7 @@ static void *typec_switch_match(const struct fwnode_handle *fwnode,
>   */
>  struct typec_switch *fwnode_typec_switch_get(struct fwnode_handle *fwnode)
>  {
> -	struct typec_switch_dev *sw_devs[TYPEC_MUX_MAX_DEVS];
> +	struct typec_switch_dev *sw_devs[TYPEC_MUX_MAX_DEVS] = { };
>  	struct typec_switch *sw;
>  	int count;
>  	int err;
> -- 
> 2.53.0
>