From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C237FC43458 for ; Mon, 29 Jun 2026 09:46:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Nh9pb8jfBBAykFNzktnuDd/4oTvTxSpOGellWErXHMA=; b=ERlZkyjIvcwmuW PRaoPenc7jLgam/AOQLuDembyUG/X15gV6l8UIHKQzPrx11qdtodNTM2ztQAnTXon5GtkdRb651Rl ogci4xYvEsdCzxtWLKjEztzCGW4m3Z0KBziK3NsjWZJRXMvmqx8OAgUUpvM7hfA1CVUq6cMmWngmt JEOyrHSdQDE7wekMI0/+sVqVylRp+SrWjBDwnuyxs0xThAsyd6rFGLSGQnfnr7lFLxYGqHMWZ8Cq+ pU9e4y2/OKC8x2ozLurEchbawhizaXFhxmUMxqn4lGf6fPnKsZ4RY+nKp9FBfmVp3ep8Oua4snLAQ STj1Fe7oqGQzFwE401aw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1we8Za-0000000EE6s-27Kb; Mon, 29 Jun 2026 09:46:38 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1we8ZZ-0000000EE6d-04Dv for linux-phy@lists.infradead.org; Mon, 29 Jun 2026 09:46:37 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 7795660008; Mon, 29 Jun 2026 09:46:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2C7C1F000E9; Mon, 29 Jun 2026 09:46:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782726396; bh=vTfaRO0O+EoSSgx3wjKo0Drw4ZNRS7c0IZDEV4C2oW8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=CI6Jp7BBoh2pKc71ItdrOaspn8n+otgS2RoZqhqOVkVKVjRP9ZVFEX4ypwltESm73 SXValJYPV+7qdHZkBhg1T4n4Z3GpHaqOCVBeXlucdyRy8DVV4UjNgQPgO8ffXwDa1K ko77fuLgsnFJ5PM4O75VD1JiYtG99ykqH5u8nRl2AoRA+FXNZBPxP97uJmahvO+Ypi VUuJZdBCyDKWg2lxyO/aa77nduqXACXoTFGHXecun9d2m2//A+vk3Q6NYzo6L6qV90 4YUZ6OwfFO61FK0M40DZSeAYfuhVjk6n7AfkrCRu1bHalkETZR3oYM8vDRmaHbEk6c 02SdeW9nU1WGg== From: sashiko-bot@kernel.org Subject: Re: [PATCH 4/8] phy: tegra: xusb: Use devm_clk_get_optional to fetch USB2 tracking clock To: "Wayne Chang" Cc: neil.armstrong@linaro.org, linux-phy@lists.infradead.org, vkoul@kernel.org, devicetree@vger.kernel.org, olteanv@gmail.com, robh@kernel.org, conor+dt@kernel.org In-Reply-To: <20260629093406.1118594-5-waynec@nvidia.com> References: <20260629093406.1118594-1-waynec@nvidia.com> <20260629093406.1118594-5-waynec@nvidia.com> Date: Mon, 29 Jun 2026 09:46:35 +0000 Message-Id: <20260629094635.B2C7C1F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpQcmUtZXhpc3RpbmcgaXNzdWVzOgot IFtIaWdoXSBEb3VibGUgZnJlZSBvZiBwYWQgYWxsb2NhdGlvbnMgb24gYHRlZ3JhX3h1c2JfcGFk X2luaXQoKWAgZmFpbHVyZSBkdWUgdG8gaW5jb3JyZWN0IGRldmljZSBjbGVhbnVwLgotIFtIaWdo XSBLZXJuZWwgcGFuaWMgZHVlIHRvIE5VTEwgcG9pbnRlciBkZXJlZmVyZW5jZSBpbiBgdGVncmFf eHVzYl9wb3J0X3JlbGVhc2UoKWAgd2hlbiBwb3J0IGluaXRpYWxpemF0aW9uIGZhaWxzLgotLQoK Y29tbWl0IDlhN2ViNjZjNjIwNmMxYjhlYWI0MjBlZTAwYzdhMWQyNzNhNzA4ZmUKQXV0aG9yOiBT aW5nLUhhbiBDaGVuIDxzaW5naGFuY0BudmlkaWEuY29tPgpTdWJqZWN0OiBwaHk6IHRlZ3JhOiB4 dXNiOiBVc2UgZGV2bV9jbGtfZ2V0X29wdGlvbmFsIHRvIGZldGNoIFVTQjIgdHJhY2tpbmcgY2xv Y2sKClRoaXMgcGF0Y2ggc3dpdGNoZXMgdGhlIFVTQjIgdHJhY2tpbmcgY2xvY2sgcmV0cmlldmFs IHRvIHVzZQpkZXZtX2Nsa19nZXRfb3B0aW9uYWwuIFRoaXMgYWxsb3dzIHRoZSBwcm9iZSBzZXF1 ZW5jZSB0byBwcm9jZWVkIHNhZmVseQp3aGVuIHRoZSBjbG9jayBpcyBvbWl0dGVkIGZyb20gdGhl IGRldmljZXRyZWUuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL3BoeS90ZWdyYS94dXNiLXRlZ3Jh MTg2LmMgYi9kcml2ZXJzL3BoeS90ZWdyYS94dXNiLXRlZ3JhMTg2LmMKPiBpbmRleCA2MDE1NmFl YTI3MDcxLi44MDBiZTBjYmIzZjlmIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvcGh5L3RlZ3JhL3h1 c2ItdGVncmExODYuYwo+ICsrKyBiL2RyaXZlcnMvcGh5L3RlZ3JhL3h1c2ItdGVncmExODYuYwo+ IEBAIC0xMDQ1LDcgKzEwNDUsNyBAQCB0ZWdyYTE4Nl91c2IyX3BhZF9wcm9iZShzdHJ1Y3QgdGVn cmFfeHVzYl9wYWRjdGwgKnBhZGN0bCwKPiAgCQlnb3RvIG91dDsKPiAgCX0KCltTZXZlcml0eTog SGlnaF0KVGhpcyBpc24ndCBhIGJ1ZyBpbnRyb2R1Y2VkIGJ5IHRoaXMgcGF0Y2gsIGJ1dCBkb2Vz IHRoZSBlcnJvciBwYXRoIGZvcgp0ZWdyYV94dXNiX3BhZF9pbml0KCkganVzdCBhYm92ZSB0aGlz IGNoYW5nZSBjYXVzZSBhIGRvdWJsZSBmcmVlPwoKTG9va2luZyBhdCB0ZWdyYTE4Nl91c2IyX3Bh ZF9wcm9iZSgpLCBpZiB0ZWdyYV94dXNiX3BhZF9pbml0KCkgZmFpbHMsIGl0CmNhbGxzIGtmcmVl KHVzYjIpLgoKSG93ZXZlciwgaW5zaWRlIHRlZ3JhX3h1c2JfcGFkX2luaXQoKSwgYW4gZXJyb3Ig Y2F1c2VzIGl0IHRvIGp1bXAgdG8gdGhlCnVucmVnaXN0ZXIgbGFiZWwgYW5kIGNhbGwgZGV2aWNl X3VucmVnaXN0ZXIoJnBhZC0+ZGV2KS4gVGhpcyBkcm9wcyB0aGUKZGV2aWNlIHJlZmVyZW5jZSBh bmQgaW52b2tlcyB0aGUgcmVsZWFzZSBjYWxsYmFjayB0ZWdyYV94dXNiX3BhZF9yZWxlYXNlKCks CndoaWNoIGZyZWVzIHRoZSBwYWQgb2JqZWN0LgoKV2hlbiB0ZWdyYV94dXNiX3BhZF9pbml0KCkg cmV0dXJucyB0aGUgZXJyb3IgYmFjayB0byB0aGUgcHJvYmUgZnVuY3Rpb24sIHRoZQpleHBsaWNp dCBrZnJlZSh1c2IyKSBpcyBleGVjdXRlZC4gQ291bGQgdGhpcyBsZWFkIHRvIG1lbW9yeSBjb3Jy dXB0aW9uIHdoZW4KaW5pdGlhbGl6YXRpb24gZmFpbHM/Cgo+ICAKPiAtCXByaXYtPnVzYjJfdHJr X2NsayA9IGRldm1fY2xrX2dldCgmcGFkLT5kZXYsICJ0cmsiKTsKPiArCXByaXYtPnVzYjJfdHJr X2NsayA9IGRldm1fY2xrX2dldF9vcHRpb25hbCgmcGFkLT5kZXYsICJ0cmsiKTsKPiAgCWlmIChJ U19FUlIocHJpdi0+dXNiMl90cmtfY2xrKSkgewo+ICAJCWVyciA9IFBUUl9FUlIocHJpdi0+dXNi Ml90cmtfY2xrKTsKPiAgCQlkZXZfZGJnKCZwYWQtPmRldiwgImZhaWxlZCB0byBnZXQgdXNiMiB0 cmsgY2xvY2s6ICVkXG4iLCBlcnIpOwoKWyAuLi4gXQoKW1NldmVyaXR5OiBIaWdoXQpUaGlzIGlz IGFub3RoZXIgcHJlLWV4aXN0aW5nIGlzc3VlIGluIGEgcmVsYXRlZCBmaWxlLCBidXQgZG9lcwp0 ZWdyYV94dXNiX3BvcnRfcmVsZWFzZSgpIHRyaWdnZXIgYSBOVUxMIHBvaW50ZXIgZGVyZWZlcmVu Y2Ugb24KaW5pdGlhbGl6YXRpb24gZmFpbHVyZT8KCkluIGRyaXZlcnMvcGh5L3RlZ3JhL3h1c2Iu Yzp0ZWdyYV94dXNiX2FkZF91c2IyX3BvcnQoKSwgdGhlIHBvcnQgaXMKYWxsb2NhdGVkIHZpYSBr emFsbG9jKCkgYW5kIHRoZW4gaW5pdGlhbGl6ZWQ6CgogICAgZXJyID0gdGVncmFfeHVzYl9wb3J0 X2luaXQoJnVzYjItPmJhc2UsIHBhZGN0bCwgbnAsICJ1c2IyIiwgaW5kZXgpOwogICAgaWYgKGVy ciA8IDApCiAgICAgICAgZ290byBvdXQ7CgogICAgdXNiMi0+YmFzZS5vcHMgPSBwYWRjdGwtPnNv Yy0+cG9ydHMudXNiMi5vcHM7CgpOb3RpY2UgdGhhdCB0aGUgb3BzIHBvaW50ZXIgaXMgYXNzaWdu ZWQgYWZ0ZXIgaW5pdGlhbGl6YXRpb24gY29tcGxldGVzLgoKSWYgdGVncmFfeHVzYl9wb3J0X2lu aXQoKSBmYWlscywgaXQgZHJvcHMgdGhlIGRldmljZSByZWZjb3VudCBhbmQgY2FsbHMKdGVncmFf eHVzYl9wb3J0X3JlbGVhc2UoKS4gVGhhdCByZWxlYXNlIGZ1bmN0aW9uIGF0dGVtcHRzIHRvIGV2 YWx1YXRlIHRoZQpvcHMgcG9pbnRlcjoKCiAgICBpZiAocG9ydC0+b3BzLT5yZWxlYXNlKQogICAg ICAgIHBvcnQtPm9wcy0+cmVsZWFzZShwb3J0KTsKClNpbmNlIHBvcnQtPm9wcyBpcyBub3QgeWV0 IGFzc2lnbmVkIGR1cmluZyB0aGUgaW5pdCBlcnJvciBwYXRoLCBpdCB3aWxsCnN0aWxsIGJlIE5V TEwgZnJvbSB0aGUga3phbGxvYygpIGFsbG9jYXRpb24uIENvdWxkIHRoaXMgY2F1c2UgYSBwYW5p YyB3aGVuCmluaXRpYWxpemF0aW9uIGZhaWxzPwoKLS0gClNhc2hpa28gQUkgcmV2aWV3IMK3IGh0 dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDYyOTA5MzQwNi4xMTE4NTk0LTEtd2F5 bmVjQG52aWRpYS5jb20/cGFydD00CgotLSAKbGludXgtcGh5IG1haWxpbmcgbGlzdApsaW51eC1w aHlAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwczovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFpbG1h bi9saXN0aW5mby9saW51eC1waHkK From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8354915746F for ; Mon, 29 Jun 2026 09:46:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782726397; cv=none; b=iMbGXxphoT0Kut8dKH4wwgvMyHk/6TJUU2lVRPvKMFadW3Qc76AP/StFRlZmt776T+Mhw3FbFcrKRkw/KRFdwKAw+ny8HpweO5I2YdxOJu+kLLqih+V9F1vxIPRFwmddzCXKHRpRVJhPHQD1T7pLZM5chlYucPZYMqDo+AbR8Jg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782726397; c=relaxed/simple; bh=LYTJC+vPGauKEpp4o54N5cxjuIvuLt2BeVICg5U8E5U=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=CRceUqCvJUHlli1ywayekunECs49ikuJ7+C/Y30JHKVAYPqpNIIlLklSW3zvAeEcVhow3YawjOKzw/kCSvUXowIZoyBV44bgDPZUXk/nsjHTpZ0Y8sK8diudIe6Snb8Vi7kZRpCn7bSfpD7iTJK9Jq77JjTPGHq0/0MreUsTTY8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CI6Jp7BB; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CI6Jp7BB" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B2C7C1F000E9; Mon, 29 Jun 2026 09:46:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1782726396; bh=vTfaRO0O+EoSSgx3wjKo0Drw4ZNRS7c0IZDEV4C2oW8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=CI6Jp7BBoh2pKc71ItdrOaspn8n+otgS2RoZqhqOVkVKVjRP9ZVFEX4ypwltESm73 SXValJYPV+7qdHZkBhg1T4n4Z3GpHaqOCVBeXlucdyRy8DVV4UjNgQPgO8ffXwDa1K ko77fuLgsnFJ5PM4O75VD1JiYtG99ykqH5u8nRl2AoRA+FXNZBPxP97uJmahvO+Ypi VUuJZdBCyDKWg2lxyO/aa77nduqXACXoTFGHXecun9d2m2//A+vk3Q6NYzo6L6qV90 4YUZ6OwfFO61FK0M40DZSeAYfuhVjk6n7AfkrCRu1bHalkETZR3oYM8vDRmaHbEk6c 02SdeW9nU1WGg== From: sashiko-bot@kernel.org Subject: Re: [PATCH 4/8] phy: tegra: xusb: Use devm_clk_get_optional to fetch USB2 tracking clock Reply-To: sashiko-reviews@lists.linux.dev To: "Wayne Chang" Cc: neil.armstrong@linaro.org, linux-phy@lists.infradead.org, vkoul@kernel.org, devicetree@vger.kernel.org, olteanv@gmail.com, robh@kernel.org, conor+dt@kernel.org In-Reply-To: <20260629093406.1118594-5-waynec@nvidia.com> References: <20260629093406.1118594-1-waynec@nvidia.com> <20260629093406.1118594-5-waynec@nvidia.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 29 Jun 2026 09:46:35 +0000 Message-Id: <20260629094635.B2C7C1F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: Pre-existing issues: - [High] Double free of pad allocations on `tegra_xusb_pad_init()` failure = due to incorrect device cleanup. - [High] Kernel panic due to NULL pointer dereference in `tegra_xusb_port_r= elease()` when port initialization fails. -- commit 9a7eb66c6206c1b8eab420ee00c7a1d273a708fe Author: Sing-Han Chen Subject: phy: tegra: xusb: Use devm_clk_get_optional to fetch USB2 tracking= clock This patch switches the USB2 tracking clock retrieval to use devm_clk_get_optional. This allows the probe sequence to proceed safely when the clock is omitted from the devicetree. > diff --git a/drivers/phy/tegra/xusb-tegra186.c b/drivers/phy/tegra/xusb-t= egra186.c > index 60156aea27071..800be0cbb3f9f 100644 > --- a/drivers/phy/tegra/xusb-tegra186.c > +++ b/drivers/phy/tegra/xusb-tegra186.c > @@ -1045,7 +1045,7 @@ tegra186_usb2_pad_probe(struct tegra_xusb_padctl *p= adctl, > goto out; > } [Severity: High] This isn't a bug introduced by this patch, but does the error path for tegra_xusb_pad_init() just above this change cause a double free? Looking at tegra186_usb2_pad_probe(), if tegra_xusb_pad_init() fails, it calls kfree(usb2). However, inside tegra_xusb_pad_init(), an error causes it to jump to the unregister label and call device_unregister(&pad->dev). This drops the device reference and invokes the release callback tegra_xusb_pad_release(), which frees the pad object. When tegra_xusb_pad_init() returns the error back to the probe function, the explicit kfree(usb2) is executed. Could this lead to memory corruption when initialization fails? > =20 > - priv->usb2_trk_clk =3D devm_clk_get(&pad->dev, "trk"); > + priv->usb2_trk_clk =3D devm_clk_get_optional(&pad->dev, "trk"); > if (IS_ERR(priv->usb2_trk_clk)) { > err =3D PTR_ERR(priv->usb2_trk_clk); > dev_dbg(&pad->dev, "failed to get usb2 trk clock: %d\n", err); [ ... ] [Severity: High] This is another pre-existing issue in a related file, but does tegra_xusb_port_release() trigger a NULL pointer dereference on initialization failure? In drivers/phy/tegra/xusb.c:tegra_xusb_add_usb2_port(), the port is allocated via kzalloc() and then initialized: err =3D tegra_xusb_port_init(&usb2->base, padctl, np, "usb2", index); if (err < 0) goto out; usb2->base.ops =3D padctl->soc->ports.usb2.ops; Notice that the ops pointer is assigned after initialization completes. If tegra_xusb_port_init() fails, it drops the device refcount and calls tegra_xusb_port_release(). That release function attempts to evaluate the ops pointer: if (port->ops->release) port->ops->release(port); Since port->ops is not yet assigned during the init error path, it will still be NULL from the kzalloc() allocation. Could this cause a panic when initialization fails? --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260629093406.1118= 594-1-waynec@nvidia.com?part=3D4