Re: [PATCH v3 2/2] usb: typec: mux: gpio-sbu: enable when only used for orientation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Use-after-free on driver unbind due to devres-managed objects accessed by registered callbacks.
--

commit ac2f1c36c2a2fd8f5788aba123b30da04e627199
Author: Fabrice Gasnier <fabrice.gasnier@foss.st.com>

usb: typec: mux: gpio-sbu: enable when only used for orientation
    
When used as orientation-switch only (no mode-switch, e.g. no altmode),
the optional enable gpio remains disabled.
Enable it from the switch_set() routine, in this case, when the
orientation is set and the enable-gpios property has been provided.

> diff --git a/drivers/usb/typec/mux/gpio-sbu-mux.c b/drivers/usb/typec/mux/gpio-sbu-mux.c
> index 1834f1a2dd9dd..b1aa976aca240 100644
> --- a/drivers/usb/typec/mux/gpio-sbu-mux.c
> +++ b/drivers/usb/typec/mux/gpio-sbu-mux.c
[ ... ]
> @@ -120,6 +126,7 @@ static int gpio_sbu_mux_probe(struct platform_device *pdev)
>  	sw_desc.fwnode = dev_fwnode(dev);
>  	sw_desc.set = gpio_sbu_switch_set;
>  
> +	sbu_mux->mode_switch = device_property_read_bool(dev, "mode-switch");
>  	sbu_mux->sw = typec_switch_register(dev, &sw_desc);
>  	if (IS_ERR(sbu_mux->sw))
>  		return dev_err_probe(dev, PTR_ERR(sbu_mux->sw),

[Severity: High]
This is a pre-existing issue, but can this lead to a use-after-free during
driver unbind?

The sbu_mux struct is allocated with devres (devm_kzalloc), tying its
lifetime to the platform driver's bind state. However, the driver registers
callbacks with the Type-C subsystem via typec_switch_register().

When the driver unbinds (e.g., via sysfs), typec_switch_unregister() removes
the switch from sysfs but does not wait for active consumers who hold a
reference to the typec_switch_dev to drop their references.

After the driver's remove hook completes, the driver core's devres cleanup
runs and frees sbu_mux and the GPIO descriptors.

If a consumer holding a reference subsequently invokes typec_switch_set(),
it calls into gpio_sbu_switch_set() which blindly dereferences the freed
sbu_mux pointer (e.g., locking its mutex) and accesses freed GPIO structures.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826-usb-fusb340-v1-v3-0-11927682504d@foss.st.com?part=2