CVE-2026-98761: usb: typec: tcpm: recover after failure to start the frs ams

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: tcpm: recover after failure to start the frs ams

Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it.

This helps in cases where some cables (incorrectly) signal an FRS to an FRS capable port during disconnection. The TCPC autonomously starts sourcing VBUS on detecting the FRS signal. However, the VBUS sourcing is left on when the FASTROLESWAP AMS fails to start (as tcpmsinktxok is 0 as CC is open due to the cable disconnect). This is because the code sets the state to INVALIDSTATE without resetting the port state.

Log snippet before changes: [ 101.401960] AMS FASTROLESWAP start [ 101.401971] Sink TX No Go [ 101.401982] sourcing vbus [ 101.401987] VBUS on [ 101.402159] VBUS on [ 109.257809] CC1: 0 -> 0, CC2: 5 -> 0 [state SNKREADY, polarity 1, disconnected] [ 111.267442] VBUS on

After changes: [ 70.541211] AMS FASTROLESWAP start [ 70.541220] Sink TX No Go [ 70.541228] state change SNKREADY -> ERRORRECOVERY [rev3 NONEAMS] [ 70.541362] VBUS on [ 70.541365] sourcing vbus [ 70.541367] VBUS on [ 70.541374] state change ERRORRECOVERY -> PORTRESET [rev3 NONEAMS] [ 70.541410] disable vbus discharge ret:0 [ 70.543028] Setting usbcomm capable false [ 70.544009] Setting voltage/current limit 0 mV 0 mA [ 70.544034] polarity 0 [ 70.544239] Requesting mux state 0, usb-role 0, orientation 0 [ 70.555550] cc:=0 [ 70.555595] pending state change PORTRESET -> PORTRESETWAITOFF @ 100 ms [rev3 NONEAMS] [ 70.555697] VBUS off [ 70.555702] VBUS VSAFE0V [ 70.555762] CC1: 5 -> 0, CC2: 0 -> 0 [state PORTRESET, polarity 0, disconnected] [ 70.587794] VBUS off [ 70.587799] VBUS VSAFE0V [ 70.655672] state change PORTRESET -> PORTRESETWAITOFF [delayed 100 ms] [ 70.655682] state change PORTRESETWAITOFF -> SNKUNATTACHED [rev3 NONEAMS] [ 70.655686] Start toggling [ 70.656274] CC1: 0 -> 0, CC2: 0 -> 0 [state TOGGLING, polarity 0, disconnected]