From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 650FBC55167 for ; Fri, 31 Jul 2026 08:19:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=kibm11xb5+UjWuuTt7o7/GQOdQw1QC7gJzSUE8SqatM=; b=Ye0v63mLlZZgPV nch9pyG9wUP2YFo0osK5a/cALSb5EdNkZKPYkbarb1buY4RQr3BxA+dWuFSz54JrpM8Dp/jhZqg5k 5+8QQKaRIb5/Y0bIpHuAzIll+iVOIw6o/PNsKBpjIrZPwYfiDrDQieHCuFxwhKTVVwltfAx7Ua/Cs FuO2fGdaf+jP9hgIkLxhecAkX4puWSg/tMS7NZNQO7lmzHfmA0NPmwZgVKS1s2cufBy70LP7c6F4x 7Ii9yvqMmHyYM+n44nkxdNKcGVygWVLvWYhoaOVTsPJjzpOrnCC46Tn0SycfGowQ1QuIsXpVDAsoB 1oCJxOon277yCWZs/Agw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wpiSu-0000000C38A-3a1u; Fri, 31 Jul 2026 08:19:36 +0000 Received: from tor.source.kernel.org ([172.105.4.254]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wpiSt-0000000C384-2lvk for linux-phy@lists.infradead.org; Fri, 31 Jul 2026 08:19:35 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id C86B3600AD; Fri, 31 Jul 2026 08:19:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1ABF41F000E9; Fri, 31 Jul 2026 08:19:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785485974; bh=Sm1aurHLJz4Ko3R6CdTMGHXFMOX+9IYL+HfV7dGOgE8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=d5IFK89Qtt/iFMGuo8sJheqlXVM46rKycLPsjQnhwD5y68mik0Tv/xIYgT+ewW+06 Fqr0B4yzbEI0UBuvrVh0X3AufdHhr/N8Og/5nlQXc044g1vHutwpHEyns2acmomTqH 9fWm1pqCZEdIAPSoa5T0m+mZOY2tEyrddH4jXFT/szoYnpeqACm0bLKhBwIbdI6VYt 728hhwt56+62R51iiTq+k3EeuU7sfA/wpxTbS0MkG66hVZu3bDLU+hBzuAdwI1cZwu 9tvuFRiTQGIxzofYZpUvHEE0wQxCbeKYKR05P+a7NfBQukTuiooHqWCpCa/51+WUGv H3w4YnjThinWg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v8 1/6] phy: fsl-imx8mq-usb: fix typec switch leak on probe error path To: "Xu Yang" Cc: Frank.Li@kernel.org, linux-phy@lists.infradead.org, vkoul@kernel.org, imx@lists.linux.dev, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20260731-imx8mp-usb-phy-improvement-v8-1-2ec8d6b3854d@nxp.com> References: <20260731-imx8mp-usb-phy-improvement-v8-0-2ec8d6b3854d@nxp.com> <20260731-imx8mp-usb-phy-improvement-v8-1-2ec8d6b3854d@nxp.com> Date: Fri, 31 Jul 2026 08:19:33 +0000 Message-Id: <20260731081934.1ABF41F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpQcmUtZXhpc3RpbmcgaXNzdWVzOgot IFtIaWdoXSBQcmUtZXhpc3RpbmcgcmFjZSBjb25kaXRpb24gd2hlcmUgYGlteF9waHktPnRjYWAg aXMgZGVyZWZlcmVuY2VkIGJ5IHRoZSBUeXBlLUMgc3dpdGNoJ3MgYC5zZXQoKWAgY2FsbGJhY2sg YmVmb3JlIGl0IGlzIGFjdHVhbGx5IGFzc2lnbmVkIGluIHRoZSBwcm9iZSBwYXRoLgotIFtIaWdo XSBMaWZldGltZSBtaXNtYXRjaCBiZXR3ZWVuIHRoZSBkZXZyZXMtYWxsb2NhdGVkIHByb3ZpZGVy IGRhdGEgYW5kIHRoZSByZWdpc3RlcmVkIHR5cGVjIHN3aXRjaCBjYWxsYmFjaywgbGVhZGluZyB0 byBVc2UtQWZ0ZXItRnJlZS4KLS0KCi0tLSBQYXRjaCBbMV06IFtQQVRDSCB2OCAxLzZdIHBoeTog ZnNsLWlteDhtcS11c2I6IGZpeCB0eXBlYyBzd2l0Y2ggbGVhayBvbiBwcm9iZSBlcnJvciBwYXRo IC0tLQpjb21taXQgYzQ2NGQ3YTEzZjA1ZDkxNTNmYjEwMDdhNjFkOGY0MjkwZDFhMTk2ZgpBdXRo b3I6IEZlbGl4IEd1IDx1c3RjLmd1QGdtYWlsLmNvbT4KCnBoeTogZnNsLWlteDhtcS11c2I6IGZp eCB0eXBlYyBzd2l0Y2ggbGVhayBvbiBwcm9iZSBlcnJvciBwYXRoCgpUaGlzIGNvbW1pdCBmaXhl cyBhIHR5cGVjIHN3aXRjaCBsZWFrIHdoZW4gcHJvYmUgZmFpbHMgYWZ0ZXIKaW14OTVfdXNiX3Bo eV9nZXRfdGNhKCkgc3VjY2VlZHMuIEl0IHVzZXMgZGV2bV9hZGRfYWN0aW9uX29yX3Jlc2V0KCkK c28gdGhlIHN3aXRjaCBpcyBjbGVhbmVkIHVwIG9uIGJvdGggcHJvYmUgZmFpbHVyZSBhbmQgZHJp dmVyIHJlbW92YWwuCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL3BoeS9mcmVlc2NhbGUvcGh5LWZz bC1pbXg4bXEtdXNiLmMgYi9kcml2ZXJzL3BoeS9mcmVlc2NhbGUvcGh5LWZzbC1pbXg4bXEtdXNi LmMKPiBpbmRleCBiMDVkODBlODQ5YTE0Li45YTMzYzA2ZDZmYzM5IDEwMDY0NAo+IC0tLSBhL2Ry aXZlcnMvcGh5L2ZyZWVzY2FsZS9waHktZnNsLWlteDhtcS11c2IuYwo+ICsrKyBiL2RyaXZlcnMv cGh5L2ZyZWVzY2FsZS9waHktZnNsLWlteDhtcS11c2IuYwoKWyAuLi4gXQoKPiBAQCAtMjY2LDE3 ICsyNjcsMTEgQEAgc3RhdGljIHN0cnVjdCB0Y2FfYmxrICppbXg5NV91c2JfcGh5X2dldF90Y2Eo c3RydWN0IHBsYXRmb3JtX2RldmljZSAqcGRldiwKPiAgCXRjYS0+b3JpZW50YXRpb24gPSBUWVBF Q19PUklFTlRBVElPTl9OT1JNQUw7Cj4gIAl0Y2EtPnN3ID0gdGNhX2Jsa19nZXRfdHlwZWNfc3dp dGNoKHBkZXYsIGlteF9waHkpOwoKW1NldmVyaXR5OiBIaWdoXQpUaGlzIGlzIGEgcHJlLWV4aXN0 aW5nIGlzc3VlLCBidXQgZG9lcyByZWdpc3RlcmluZyB0aGUgc3dpdGNoIGhlcmUgZXhwb3NlIGl0 IAp0byBjb25zdW1lcnMgYmVmb3JlIHdlIGFyZSBmdWxseSBpbml0aWFsaXplZD8KCkJ5IHJlZ2lz dGVyaW5nIHRoZSBzd2l0Y2ggaW4gdGNhX2Jsa19nZXRfdHlwZWNfc3dpdGNoKCksIHRoZSBkZXZp Y2UgYmVjb21lcwppbW1lZGlhdGVseSBkaXNjb3ZlcmFibGUuIElmIGEgY29uc3VtZXIgYWNxdWly ZXMgaXQgYW5kIGludm9rZXMgdGhlIGNhbGxiYWNrOgoKdGNhX2Jsa190eXBlY19zd2l0Y2hfc2V0 KCkKICAgc3RydWN0IHRjYV9ibGsgKnRjYSA9IGlteF9waHktPnRjYTsKICAgLi4uCiAgIGlmICh0 Y2EtPm9yaWVudGF0aW9uID09IG9yaWVudGF0aW9uKQoKU2luY2UgaW14X3BoeS0+dGNhIGlzIG5v dCBhc3NpZ25lZCB1bnRpbCBpbXg4bXFfdXNiX3BoeV9wcm9iZSgpIGZpbmlzaGVzCmhhbmRsaW5n IHRoZSByZXR1cm4gZnJvbSBpbXg5NV91c2JfcGh5X2dldF90Y2EoKSwgd29uJ3QgdGhpcyBjYXVz ZSBhIE5VTEwKcG9pbnRlciBkZXJlZmVyZW5jZSBpZiB0aGUgY2FsbGJhY2sgaXMgaW52b2tlZCBk dXJpbmcgdGhpcyB3aW5kb3c/Cgo+ICAKPiAtCXJldHVybiB0Y2E7Cj4gLX0KPiAtCj4gLXN0YXRp YyB2b2lkIGlteDk1X3VzYl9waHlfcHV0X3RjYShzdHJ1Y3QgaW14OG1xX3VzYl9waHkgKmlteF9w aHkpCj4gLXsKPiAtCXN0cnVjdCB0Y2FfYmxrICp0Y2EgPSBpbXhfcGh5LT50Y2E7Cj4gLQo+IC0J aWYgKCF0Y2EpCj4gLQkJcmV0dXJuOwo+ICsJcmV0ID0gZGV2bV9hZGRfYWN0aW9uX29yX3Jlc2V0 KCZwZGV2LT5kZXYsIHRjYV9ibGtfcHV0X3R5cGVjX3N3aXRjaCwgdGNhLT5zdyk7CgpbU2V2ZXJp dHk6IEhpZ2hdClRoaXMgaXMgYWxzbyBhIHByZS1leGlzdGluZyBpc3N1ZSwgYnV0IGRvZXMgdXNp bmcgZGV2cmVzIHRvIHVucmVnaXN0ZXIgdGhlIApzd2l0Y2ggaW50cm9kdWNlIGEgcG90ZW50aWFs IHVzZS1hZnRlci1mcmVlPwoKSWYgYSBjb25zdW1lciBkcml2ZXIgKGxpa2UgVENQTSkgb2J0YWlu cyBhIHJlZmVyZW5jZSB0byB0aGUgc3dpdGNoLCBhbmQgdGhlClBIWSBkcml2ZXIgaXMgc3Vic2Vx dWVudGx5IHVuYm91bmQgb3IgcHJvYmUgZmFpbHM6CgoxLiBkZXZyZXMgY2FsbHMgdGNhX2Jsa19w dXRfdHlwZWNfc3dpdGNoKCkgdG8gdW5yZWdpc3RlciB0aGUgc3dpdGNoLgoKMi4gdHlwZWNfc3dp dGNoX3VucmVnaXN0ZXIoKSByZW1vdmVzIHRoZSBkZXZpY2UgZnJvbSBzeXNmcyBhbmQgZHJvcHMg dGhlIAogICBwcm92aWRlcidzIHJlZmVyZW5jZSwgYnV0IHRoZSBjb25zdW1lcidzIHJlZmVyZW5j ZSBrZWVwcyB0aGUgc3dfZGV2IAogICBhbGl2ZS4KCjMuIGRldnJlcyB0aGVuIGZyZWVzIHRoZSBw cm92aWRlciBkYXRhIChpbXhfcGh5KSB3aGljaCB3YXMgYWxsb2NhdGVkIHdpdGggCiAgIGRldm1f a3phbGxvYygpLgoKSWYgdGhlIGNvbnN1bWVyIGxhdGVyIGNhbGxzIHR5cGVjX3N3aXRjaF9zZXQo KSwgdGhlIGNhbGxiYWNrIHdpbGwgYWNjZXNzCmlteF9waHktPnRjYSwgd2hpY2ggaGFzIGFscmVh ZHkgYmVlbiBmcmVlZC4gQ291bGQgdGhpcyBsZWFkIHRvIG1lbW9yeQpjb3JydXB0aW9uPwoKPiAr CWlmIChyZXQpCj4gKwkJcmV0dXJuIEVSUl9QVFIocmV0KTsKPiAgCj4gLQl0Y2FfYmxrX3B1dF90 eXBlY19zd2l0Y2godGNhLT5zdyk7Cj4gKwlyZXR1cm4gdGNhOwo+ICB9CgotLSAKU2FzaGlrbyBB SSByZXZpZXcgwrcgaHR0cHM6Ly9zYXNoaWtvLmRldi8jL3BhdGNoc2V0LzIwMjYwNzMxLWlteDht cC11c2ItcGh5LWltcHJvdmVtZW50LXY4LTAtMmVjOGQ2YjM4NTRkQG54cC5jb20/cGFydD0xCgot LSAKbGludXgtcGh5IG1haWxpbmcgbGlzdApsaW51eC1waHlAbGlzdHMuaW5mcmFkZWFkLm9yZwpo dHRwczovL2xpc3RzLmluZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1waHkK From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D59EE3128D7 for ; Fri, 31 Jul 2026 08:19:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785485977; cv=none; b=ibRMvDxGYeisSHtSrlYdWYX+kcg+Gp26NigxsJb8dDoG+ygYCQeO0ZD8YI8V2cxmpd1pN5rULkqoVJCh1UPF10cgkCGFTQhmF2iuXH78Pjx63I71MVpMo5jLNB1QAM/P1umtwyGqnuMvIzlkWMe/mGaSsRMjGdm0jRw7VwCirHU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785485977; c=relaxed/simple; bh=5k9Dvuq5L5JdbLos/gBglhe0V7o/rcPH6IRWTDAVxqQ=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=LQvw5UR4uXV9HMqkGUf/5E7FyXz+RuDssPg8SwRoWtVnTks3UIcqbwgi3BZKpa2d8SXQRvaqcnzKDsFDpqu9J1Xn89+ZJPk/HpJSNOxJ0EPaVFW6yGsZ/5hJAe20lxusp+E/wwhIt9hvsschoh84uzDVD3xkDZwrsf0TGayJwZs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=d5IFK89Q; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="d5IFK89Q" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1ABF41F000E9; Fri, 31 Jul 2026 08:19:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1785485974; bh=Sm1aurHLJz4Ko3R6CdTMGHXFMOX+9IYL+HfV7dGOgE8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=d5IFK89Qtt/iFMGuo8sJheqlXVM46rKycLPsjQnhwD5y68mik0Tv/xIYgT+ewW+06 Fqr0B4yzbEI0UBuvrVh0X3AufdHhr/N8Og/5nlQXc044g1vHutwpHEyns2acmomTqH 9fWm1pqCZEdIAPSoa5T0m+mZOY2tEyrddH4jXFT/szoYnpeqACm0bLKhBwIbdI6VYt 728hhwt56+62R51iiTq+k3EeuU7sfA/wpxTbS0MkG66hVZu3bDLU+hBzuAdwI1cZwu 9tvuFRiTQGIxzofYZpUvHEE0wQxCbeKYKR05P+a7NfBQukTuiooHqWCpCa/51+WUGv H3w4YnjThinWg== From: sashiko-bot@kernel.org Subject: Re: [PATCH v8 1/6] phy: fsl-imx8mq-usb: fix typec switch leak on probe error path Reply-To: sashiko-reviews@lists.linux.dev To: "Xu Yang" Cc: Frank.Li@kernel.org, linux-phy@lists.infradead.org, vkoul@kernel.org, imx@lists.linux.dev, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20260731-imx8mp-usb-phy-improvement-v8-1-2ec8d6b3854d@nxp.com> References: <20260731-imx8mp-usb-phy-improvement-v8-0-2ec8d6b3854d@nxp.com> <20260731-imx8mp-usb-phy-improvement-v8-1-2ec8d6b3854d@nxp.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 31 Jul 2026 08:19:33 +0000 Message-Id: <20260731081934.1ABF41F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: imx@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: Pre-existing issues: - [High] Pre-existing race condition where `imx_phy->tca` is dereferenced b= y the Type-C switch's `.set()` callback before it is actually assigned in t= he probe path. - [High] Lifetime mismatch between the devres-allocated provider data and t= he registered typec switch callback, leading to Use-After-Free. -- --- Patch [1]: [PATCH v8 1/6] phy: fsl-imx8mq-usb: fix typec switch leak on= probe error path --- commit c464d7a13f05d9153fb1007a61d8f4290d1a196f Author: Felix Gu phy: fsl-imx8mq-usb: fix typec switch leak on probe error path This commit fixes a typec switch leak when probe fails after imx95_usb_phy_get_tca() succeeds. It uses devm_add_action_or_reset() so the switch is cleaned up on both probe failure and driver removal. > diff --git a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c b/drivers/phy/fre= escale/phy-fsl-imx8mq-usb.c > index b05d80e849a14..9a33c06d6fc39 100644 > --- a/drivers/phy/freescale/phy-fsl-imx8mq-usb.c > +++ b/drivers/phy/freescale/phy-fsl-imx8mq-usb.c [ ... ] > @@ -266,17 +267,11 @@ static struct tca_blk *imx95_usb_phy_get_tca(struct= platform_device *pdev, > tca->orientation =3D TYPEC_ORIENTATION_NORMAL; > tca->sw =3D tca_blk_get_typec_switch(pdev, imx_phy); [Severity: High] This is a pre-existing issue, but does registering the switch here expose i= t=20 to consumers before we are fully initialized? By registering the switch in tca_blk_get_typec_switch(), the device becomes immediately discoverable. If a consumer acquires it and invokes the callbac= k: tca_blk_typec_switch_set() struct tca_blk *tca =3D imx_phy->tca; ... if (tca->orientation =3D=3D orientation) Since imx_phy->tca is not assigned until imx8mq_usb_phy_probe() finishes handling the return from imx95_usb_phy_get_tca(), won't this cause a NULL pointer dereference if the callback is invoked during this window? > =20 > - return tca; > -} > - > -static void imx95_usb_phy_put_tca(struct imx8mq_usb_phy *imx_phy) > -{ > - struct tca_blk *tca =3D imx_phy->tca; > - > - if (!tca) > - return; > + ret =3D devm_add_action_or_reset(&pdev->dev, tca_blk_put_typec_switch, = tca->sw); [Severity: High] This is also a pre-existing issue, but does using devres to unregister the= =20 switch introduce a potential use-after-free? If a consumer driver (like TCPM) obtains a reference to the switch, and the PHY driver is subsequently unbound or probe fails: 1. devres calls tca_blk_put_typec_switch() to unregister the switch. 2. typec_switch_unregister() removes the device from sysfs and drops the=20 provider's reference, but the consumer's reference keeps the sw_dev=20 alive. 3. devres then frees the provider data (imx_phy) which was allocated with=20 devm_kzalloc(). If the consumer later calls typec_switch_set(), the callback will access imx_phy->tca, which has already been freed. Could this lead to memory corruption? > + if (ret) > + return ERR_PTR(ret); > =20 > - tca_blk_put_typec_switch(tca->sw); > + return tca; > } --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260731-imx8mp-usb= -phy-improvement-v8-0-2ec8d6b3854d@nxp.com?part=3D1