From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8C749C5CFCF for ; Fri, 14 Aug 2026 03:08:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=idqLD/pOBeVMInrukeBn3XEMpFDV8Dxk68bM2zpQZ9M=; b=4bvHrwK4lSzjh3 VYbA3JdfaxNVW+XWGlRzfZ18Fpe6LMtjXswkam4NkZFACJcY83VDT8urbIqnPGzveXVN/SKrS4UCJ Ajf9SkMqyaB36n17lmtUPixB936XEgMCSE58s3ZHGywwhEH4pKEICzBKDZ4+GpY3YB/VqbxuS1asP 7FDuNKjKDobMwpg3v5mP4xfhWZi4EO02giBku9JrwVdr1MfXDaT+Ge+n2jxKCoqIbPKyusvhkfEyc TclVU1ESsw7PugsmwWUeC4/969VhZ4QcdEIBpt2X5Z30N1BElm+ClrdoPoTgRS4Zk93KcO3OATQto 98kTLPLZXtT4bg8wrt4Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1wuiH5-00000001t9Y-0Jtz; Fri, 14 Aug 2026 03:08:03 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1wuiH3-00000001t9I-2lut for linux-phy@lists.infradead.org; Fri, 14 Aug 2026 03:08:01 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id EBDCC600AD; Fri, 14 Aug 2026 03:08:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D0A241F000E9; Fri, 14 Aug 2026 03:07:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786676880; bh=H+57uzBO/+u4CbYOIrLJkex0sLfHfhA3xOTphcq+F1I=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=m/qnC8TUy8ftjtmFI897CP/8XUoOTJVhyV9qVqzyFE2ZNKKUOyh0eazel8DPUk3i2 Kyq5Cv0DBzrj1fZTFUtUTBbxVrnPEcoSvFpHiZCTVchmGhAY8+8pvNSG59MZb0E488 NNKfSXYH5ZgHdbhEgMbKDiKPNn8ccgdgF+6Z/9TcC8E7MhACMPGgXAv1O/uEqGDgAt kAGorkXjdBwpdGUzn+a6Oy1E2CQzsEtRZt0nmZey28GccEM5Tj920k9BIr9OL6dQuh /HtI3LGAFWmleCVrq9L4+r/XoovuIaFWM8E0q38f9hdLLHV5CpXoc2hSZvC29bMNlU T/pQiDA9aNadA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v14 12/38] phy: rockchip: usbdp: Limit DP lane count to muxed lanes To: "Sebastian Reichel" Cc: neil.armstrong@linaro.org, olteanv@gmail.com, linux-phy@lists.infradead.org, robh@kernel.org, vkoul@kernel.org, conor+dt@kernel.org, devicetree@vger.kernel.org In-Reply-To: <20260813-rockchip-usbdp-cleanup-v14-12-b5ad9c68fa11@collabora.com> References: <20260813-rockchip-usbdp-cleanup-v14-0-b5ad9c68fa11@collabora.com> <20260813-rockchip-usbdp-cleanup-v14-12-b5ad9c68fa11@collabora.com> Date: Fri, 14 Aug 2026 03:07:59 +0000 Message-Id: <20260814030759.D0A241F000E9@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6CgpQcmUtZXhpc3RpbmcgaXNzdWVzOgot IFtIaWdoXSBJbmNvbXBsZXRlIGZpeCBhbGxvd3MgVVNCMyBjb3JydXB0aW9uIHdoZW4gcGh5X2Nv bmZpZ3VyZSBpcyBjYWxsZWQgd2l0aG91dCBzZXRfbGFuZXMuCi0gW0hpZ2hdIE1pc3NpbmcgbXV0 ZXggaW4gcmtfdWRwaHlfZHBfcGh5X2NvbmZpZ3VyZSBjYXVzZXMgYSBUT0NUT1UgZGF0YSByYWNl IHdpdGggVHlwZS1DIGV2ZW50cy4KLS0KCi0tLSBQYXRjaCBbMTJdOiBbUEFUQ0ggdjE0IDEyLzM4 XSBwaHk6IHJvY2tjaGlwOiB1c2JkcDogTGltaXQgRFAgbGFuZSBjb3VudCB0byBtdXhlZCBsYW5l cyAtLS0KY29tbWl0IDhjYzI4ZTgxY2QzNjg2ODJhMjdiZDE4MGNjY2MzZmFlNmZhYWVjOTUKQXV0 aG9yOiBTZWJhc3RpYW4gUmVpY2hlbCA8c2ViYXN0aWFuLnJlaWNoZWxAY29sbGFib3JhLmNvbT4K CnBoeTogcm9ja2NoaXA6IHVzYmRwOiBMaW1pdCBEUCBsYW5lIGNvdW50IHRvIG11eGVkIGxhbmVz CgpUaGlzIGNvbW1pdCBhZGRzIGEgYm91bmRzIGNoZWNrIHRvIHByZXZlbnQgdGhlIERpc3BsYXlQ b3J0IGNvbnRyb2xsZXIgZnJvbQpyZXF1ZXN0aW5nIG1vcmUgbGFuZXMgdGhhbiB0aGUgUEhZIGN1 cnJlbnRseSBoYXMgbXVsdGlwbGV4ZWQgZm9yIERQLiBCeQpyZWplY3RpbmcgaW52YWxpZCByZXF1 ZXN0cywgaXQgYWltcyB0byBwcm90ZWN0IFVTQjMgZnVuY3Rpb25hbGl0eSBmcm9tIGJlaW5nCmNv cnJ1cHRlZCBieSBpbmNvcnJlY3Qgdm9sdGFnZSBjb25maWd1cmF0aW9ucy4KCkxpbms6IGh0dHBz Oi8vbG9yZS5rZXJuZWwub3JnL2xpbnV4LXBoeS8yMDI2MDYxMjE2NTU0Ni45OEUxRjFGMDAwRTlA c210cC5rZXJuZWwub3JnLwoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9waHkvcm9ja2NoaXAvcGh5 LXJvY2tjaGlwLXVzYmRwLmMgYi9kcml2ZXJzL3BoeS9yb2NrY2hpcC9waHktcm9ja2NoaXAtdXNi ZHAuYwo+IGluZGV4IGM0ZDYyYjIzNGVhODAuLmIxNzJjZTZhNzIyZWUgMTAwNjQ0Cj4gLS0tIGEv ZHJpdmVycy9waHkvcm9ja2NoaXAvcGh5LXJvY2tjaGlwLXVzYmRwLmMKPiArKysgYi9kcml2ZXJz L3BoeS9yb2NrY2hpcC9waHktcm9ja2NoaXAtdXNiZHAuYwo+IEBAIC0xMDk5LDYgKzEwOTksOSBA QCBzdGF0aWMgaW50IHJrX3VkcGh5X2RwX3BoeV92ZXJpZnlfbGlua19yYXRlKHN0cnVjdCBya191 ZHBoeSAqdWRwaHksCj4gIHN0YXRpYyBpbnQgcmtfdWRwaHlfZHBfcGh5X3ZlcmlmeV9sYW5lcyhz dHJ1Y3QgcmtfdWRwaHkgKnVkcGh5LAo+ICAJCQkJCXN0cnVjdCBwaHlfY29uZmlndXJlX29wdHNf ZHAgKmRwKQo+ICB7Cj4gKwlpZiAoZHAtPmxhbmVzID4gdWRwaHktPmRwX2xhbmVzKQoKW1NldmVy aXR5OiBIaWdoXQpUaGlzIGlzIGEgcHJlLWV4aXN0aW5nIGlzc3VlLCBidXQgZG9lcyB0aGlzIHVu bG9ja2VkIHJlYWQgb2YKdWRwaHktPmRwX2xhbmVzIHJhY2Ugd2l0aCBjb25jdXJyZW50IFR5cGUt QyBldmVudHM/CgpMb29raW5nIGF0IHJrX3VkcGh5X2RwX3BoeV9jb25maWd1cmUoKSwgaXQgcGVy Zm9ybXMgdmFsaWRhdGlvbiBhbmQgc3RhdGUKdXBkYXRlcyB3aXRob3V0IGFjcXVpcmluZyB0aGUg ZHJpdmVyJ3MgdWRwaHktPm11dGV4OgoKZHJpdmVycy9waHkvcm9ja2NoaXAvcGh5LXJvY2tjaGlw LXVzYmRwLmM6cmtfdWRwaHlfZHBfcGh5X2NvbmZpZ3VyZSgpIHsKICAgICAgICBzdHJ1Y3Qgcmtf dWRwaHkgKnVkcGh5ID0gcGh5X2dldF9kcnZkYXRhKHBoeSk7CiAgICAgICAgLi4uCn0KCk1lYW53 aGlsZSwgYXN5bmNocm9ub3VzIFR5cGUtQyBjYWxsYmFja3MgbGlrZSBya191ZHBoeV90eXBlY19t dXhfc2V0KCkKbXV0YXRlIHRoZXNlIHNhbWUgZmllbGRzIGNvbmN1cnJlbnRseSB3aGlsZSBjb3Jy ZWN0bHkgaG9sZGluZyB1ZHBoeS0+bXV0ZXguCgpJZiBhIFR5cGUtQyBldmVudCBjaGFuZ2VzIHVk cGh5LT5kcF9sYW5lcyBpbW1lZGlhdGVseSBhZnRlciB0aGlzIHVubG9ja2VkCmNoZWNrIHBhc3Nl cywgY291bGQgcmtfdWRwaHlfZHBfcGh5X2NvbmZpZ3VyZSgpIHByb2NlZWQgdXNpbmcgb3V0ZGF0 ZWQKdmFsdWVzIGFuZCB3cml0ZSBEUCBzZXR0aW5ncyB0byBVU0IzIGxhbmVzPwoKW1NldmVyaXR5 OiBIaWdoXQpUaGlzIGlzIGFsc28gYSBwcmUtZXhpc3RpbmcgaXNzdWUsIGJ1dCBkb2VzIHRoaXMg Y2hlY2sgZnVsbHkgcHJvdGVjdAp0aGUgdm9sdGFnZSBjb25maWd1cmF0aW9uIGxvb3BzIGlmIHBo eV9jb25maWd1cmUoKSBpcyBjYWxsZWQgd2l0aApzZXRfdm9sdGFnZXM9MSBidXQgc2V0X2xhbmVz PTA/CgpJZiBhIFR5cGUtQyBldmVudCByZWR1Y2VzIHRoZSBhdmFpbGFibGUgRFAgbGFuZXMsIHJr X3VkcGh5X3R5cGVjX211eF9zZXQoKQp1cGRhdGVzIHVkcGh5LT5kcF9sYW5lcyBidXQgbm90IHRo ZSBjYWNoZWQgdWRwaHktPmxhbmVzLiBJZiB0aGUgRFAKY29udHJvbGxlciBsYXRlciBhZGp1c3Rz IHZvbHRhZ2VzIGR1cmluZyBsaW5rIHRyYWluaW5nICh3aXRob3V0IHNldHRpbmcKbGFuZXMpLCB0 aGlzIGNoZWNrIGluIHJrX3VkcGh5X2RwX3BoeV92ZXJpZnlfbGFuZXMoKSBpcyBza2lwcGVkLgoK VGhlIGNvZGUgdGhlbiBsb29wcyBvdmVyIHRoZSBzdGFsZSB1ZHBoeS0+bGFuZXMgdmFsdWUgaW4g Ym90aApya191ZHBoeV9kcF9waHlfdmVyaWZ5X3ZvbHRhZ2VzKCkgYW5kIHJrX3VkcGh5X2RwX3Bo eV9jb25maWd1cmUoKToKCmRyaXZlcnMvcGh5L3JvY2tjaGlwL3BoeS1yb2NrY2hpcC11c2JkcC5j OnJrX3VkcGh5X2RwX3BoeV9jb25maWd1cmUoKSB7CiAgICAgICAgLi4uCiAgICAgICAgZm9yIChp ID0gMDsgaSA8IHVkcGh5LT5sYW5lczsgaSsrKSB7CiAgICAgICAgICAgICAgICBsYW5lID0gdWRw aHktPmRwX2xhbmVfc2VsW2ldOwogICAgICAgIC4uLgp9CgpXaWxsIHRoaXMgcmVzdWx0IGluIGFw cGx5aW5nIERQIHZvbHRhZ2UgY29uZmlndXJhdGlvbnMgdG8gbGFuZXMgdGhhdCBoYXZlCmFscmVh ZHkgYmVlbiByZWFzc2lnbmVkIHRvIFVTQjMsIGJ5cGFzc2luZyB0aGUgbmV3bHkgYWRkZWQgcHJv dGVjdGlvbj8KCj4gKwkJcmV0dXJuIC1FSU5WQUw7Cj4gKwo+ICAJc3dpdGNoIChkcC0+bGFuZXMp IHsKPiAgCWNhc2UgMToKPiAgCWNhc2UgMjoKCi0tIApTYXNoaWtvIEFJIHJldmlldyDCtyBodHRw czovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA4MTMtcm9ja2NoaXAtdXNiZHAtY2xlYW51 cC12MTQtMC1iNWFkOWM2OGZhMTFAY29sbGFib3JhLmNvbT9wYXJ0PTEyCgotLSAKbGludXgtcGh5 IG1haWxpbmcgbGlzdApsaW51eC1waHlAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwczovL2xpc3Rz LmluZnJhZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1waHkK From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0350B3D301A for ; Fri, 14 Aug 2026 03:08:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786676882; cv=none; b=SD0aqUXfUrow1pc7xzHIRok16epE72QF9pu1dBf7+zKtSvGSlR9jrd71YVR4gSx82ym4/GoL7xN1qm24exBO5o0FFXjCcUeezQnAOZ7MuShM7OkeS1ZtwH8T6jXiqTtP/nMG3nYtkR7HvYchYPJfR+0asiWhqUEJwgRl+Mb5Ztg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786676882; c=relaxed/simple; bh=40nKHc2Pycv5JTNuAemhXI6C1dLlE1j52LX0KXirv1o=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=tspMy84fEnVDYwWs34nHhQqatDIi++dwAA9yfGVspmgIUG0dfCSAqeIPWvv5JuWURJW1741EG7JTT9alRRuyymA5hMi3ifC7SKARPW6fkhZZkyW4phrG8aHDAmeCnbAcW4lMV+tdvkobvgzINudt6y5dYdbzm0SF4II/lZGxkqA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=m/qnC8TU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="m/qnC8TU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D0A241F000E9; Fri, 14 Aug 2026 03:07:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786676880; bh=H+57uzBO/+u4CbYOIrLJkex0sLfHfhA3xOTphcq+F1I=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=m/qnC8TUy8ftjtmFI897CP/8XUoOTJVhyV9qVqzyFE2ZNKKUOyh0eazel8DPUk3i2 Kyq5Cv0DBzrj1fZTFUtUTBbxVrnPEcoSvFpHiZCTVchmGhAY8+8pvNSG59MZb0E488 NNKfSXYH5ZgHdbhEgMbKDiKPNn8ccgdgF+6Z/9TcC8E7MhACMPGgXAv1O/uEqGDgAt kAGorkXjdBwpdGUzn+a6Oy1E2CQzsEtRZt0nmZey28GccEM5Tj920k9BIr9OL6dQuh /HtI3LGAFWmleCVrq9L4+r/XoovuIaFWM8E0q38f9hdLLHV5CpXoc2hSZvC29bMNlU T/pQiDA9aNadA== From: sashiko-bot@kernel.org Subject: Re: [PATCH v14 12/38] phy: rockchip: usbdp: Limit DP lane count to muxed lanes Reply-To: sashiko-reviews@lists.linux.dev To: "Sebastian Reichel" Cc: neil.armstrong@linaro.org, olteanv@gmail.com, linux-phy@lists.infradead.org, robh@kernel.org, vkoul@kernel.org, conor+dt@kernel.org, devicetree@vger.kernel.org In-Reply-To: <20260813-rockchip-usbdp-cleanup-v14-12-b5ad9c68fa11@collabora.com> References: <20260813-rockchip-usbdp-cleanup-v14-0-b5ad9c68fa11@collabora.com> <20260813-rockchip-usbdp-cleanup-v14-12-b5ad9c68fa11@collabora.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 14 Aug 2026 03:07:59 +0000 Message-Id: <20260814030759.D0A241F000E9@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: Pre-existing issues: - [High] Incomplete fix allows USB3 corruption when phy_configure is called= without set_lanes. - [High] Missing mutex in rk_udphy_dp_phy_configure causes a TOCTOU data ra= ce with Type-C events. -- --- Patch [12]: [PATCH v14 12/38] phy: rockchip: usbdp: Limit DP lane count= to muxed lanes --- commit 8cc28e81cd368682a27bd180cccc3fae6faaec95 Author: Sebastian Reichel phy: rockchip: usbdp: Limit DP lane count to muxed lanes This commit adds a bounds check to prevent the DisplayPort controller from requesting more lanes than the PHY currently has multiplexed for DP. By rejecting invalid requests, it aims to protect USB3 functionality from being corrupted by incorrect voltage configurations. Link: https://lore.kernel.org/linux-phy/20260612165546.98E1F1F000E9@smtp.ke= rnel.org/ > diff --git a/drivers/phy/rockchip/phy-rockchip-usbdp.c b/drivers/phy/rock= chip/phy-rockchip-usbdp.c > index c4d62b234ea80..b172ce6a722ee 100644 > --- a/drivers/phy/rockchip/phy-rockchip-usbdp.c > +++ b/drivers/phy/rockchip/phy-rockchip-usbdp.c > @@ -1099,6 +1099,9 @@ static int rk_udphy_dp_phy_verify_link_rate(struct = rk_udphy *udphy, > static int rk_udphy_dp_phy_verify_lanes(struct rk_udphy *udphy, > struct phy_configure_opts_dp *dp) > { > + if (dp->lanes > udphy->dp_lanes) [Severity: High] This is a pre-existing issue, but does this unlocked read of udphy->dp_lanes race with concurrent Type-C events? Looking at rk_udphy_dp_phy_configure(), it performs validation and state updates without acquiring the driver's udphy->mutex: drivers/phy/rockchip/phy-rockchip-usbdp.c:rk_udphy_dp_phy_configure() { struct rk_udphy *udphy =3D phy_get_drvdata(phy); ... } Meanwhile, asynchronous Type-C callbacks like rk_udphy_typec_mux_set() mutate these same fields concurrently while correctly holding udphy->mutex. If a Type-C event changes udphy->dp_lanes immediately after this unlocked check passes, could rk_udphy_dp_phy_configure() proceed using outdated values and write DP settings to USB3 lanes? [Severity: High] This is also a pre-existing issue, but does this check fully protect the voltage configuration loops if phy_configure() is called with set_voltages=3D1 but set_lanes=3D0? If a Type-C event reduces the available DP lanes, rk_udphy_typec_mux_set() updates udphy->dp_lanes but not the cached udphy->lanes. If the DP controller later adjusts voltages during link training (without setting lanes), this check in rk_udphy_dp_phy_verify_lanes() is skipped. The code then loops over the stale udphy->lanes value in both rk_udphy_dp_phy_verify_voltages() and rk_udphy_dp_phy_configure(): drivers/phy/rockchip/phy-rockchip-usbdp.c:rk_udphy_dp_phy_configure() { ... for (i =3D 0; i < udphy->lanes; i++) { lane =3D udphy->dp_lane_sel[i]; ... } Will this result in applying DP voltage configurations to lanes that have already been reassigned to USB3, bypassing the newly added protection? > + return -EINVAL; > + > switch (dp->lanes) { > case 1: > case 2: --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260813-rockchip-u= sbdp-cleanup-v14-0-b5ad9c68fa11@collabora.com?part=3D12