From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 467F25632BD for ; Tue, 8 Sep 2026 15:41:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788882071; cv=none; b=J257bzo8Uz3mvXAWeT1nOqUNPjriLQeAESys0zi0by7qVIyX0XfzWsr+RM13NUK5fRSlznjR4GF9j7kjBAawsnCPhXtFU+/CaEz+eC3tsqhBmBec2qZu2FKgHBJ20LrPrF8AN1fTNZYwS6nJlCVzY3Bk9r0qMuH2vDlSKIkcZuQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788882071; c=relaxed/simple; bh=ntpO5YCLn3VWli7WOkIQylmHtO+Qq+c25w3mF6Jt+Jc=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=AXFyYJu8I9hp9yFMNIjVM/z7jYwzcUaZwVZ/yoVlXUC5h2iYAZkgdZ/etB4QKxIWZTB1tKZQMMgnmjSALUmkvAeGhPvfibZU8SaNPnTZc8h0XDTg84vbblZQLcvwPOU5waodVgrpLDH2ouvvBx/vq+Y7L3tMJYI5q7I2utJTy2k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6864E1F00A3A; Tue, 8 Sep 2026 15:41:08 +0000 (UTC) From: sashiko-bot@kernel.org Subject: Re: [PATCH net-next v4 07/10] net: pcs: xpcs: add Rockchip RK3568 platform glue driver Reply-To: sashiko-reviews@lists.linux.dev To: "Coia Prant" Cc: olteanv@gmail.com, linux-phy@lists.infradead.org, neil.armstrong@linaro.org, devicetree@vger.kernel.org, robh@kernel.org, vkoul@kernel.org, conor+dt@kernel.org, wsa+renesas@sang-engineering.com In-Reply-To: <20260907153713.2572547-9-coiaprant@gmail.com> References: <20260907153713.2572547-2-coiaprant@gmail.com> <20260907153713.2572547-9-coiaprant@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Tue, 08 Sep 2026 15:40:50 +0000 Message-Id: <20260908154108.6864E1F00A3A@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 2 potential issue(= s) to consider: - [High] A Time-of-Check to Time-of-Use (TOCTOU) race condition in xpcs_rk_= create allows a concurrent unbind of the supplier to free the MDIO bus, lea= ding to a Use-After-Free. - [Medium] Incorrect LIFO teardown ordering in devres clock cleanup action = violates proper device initialization and PM hierarchy rules. -- commit 7142dbf6b28b5ee94d0edc969bcf16d1183a5f41 Author: Coia Prant net: pcs: xpcs: add Rockchip RK3568 platform glue driver This commit adds a platform glue driver for the Synopsys DesignWare xpcs integrated in the Rockchip RK3568 SoC. It creates a virtual mdio bus to translate mdio operations to apb3 memory-mapped register accesses. Link: https://dl.radxa.com/rock3/docs/hw/datasheet/Rockchip%20RK3568%20TRM%= 20Part2%20V1.1-20210301.pdf (Page 2078) > diff --git a/drivers/net/pcs/pcs-xpcs-rk.c b/drivers/net/pcs/pcs-xpcs-rk.c > new file mode 100644 > index 0000000000000..68bcaa1a5cbbf > --- /dev/null > +++ b/drivers/net/pcs/pcs-xpcs-rk.c [ ... ] > +static void xpcs_rk_exit_clk(void *data) > +{ > + struct dw_xpcs_rk *pxpcs =3D data; > + struct device *dev =3D &pxpcs->pdev->dev; > + > + clk_disable_unprepare(pxpcs->eee_clk); > + > + pm_runtime_force_suspend(dev); [Severity: Medium] Does this sequence result in the clock being disabled before the device is suspended? In xpcs_rk_init_clk(), eee_clk is enabled first, followed by a call to pm_runtime_enable(), allowing the device to become runtime active. During=20 teardown, pm_runtime_force_suspend() invokes xpcs_rk_pm_runtime_suspend() to disable csr_clk. Calling clk_disable_unprepare() for eee_clk before pm_runtime_force_suspend= ()=20 violates last-in, first-out ordering, disabling the prerequisite clock while the device is still considered active. Should pm_runtime_force_suspend() be called prior to disabling the eee_clk? > +} [ ... ] > +struct dw_xpcs *xpcs_rk_create(struct device *dev, struct device_node *n= p) > +{ [ ... ] > + device_lock(&pdev->dev); > + pxpcs =3D platform_get_drvdata(pdev); > + if (!pxpcs || !pxpcs->bus) { > + device_unlock(&pdev->dev); > + put_device(&pdev->dev); > + return ERR_PTR(-EPROBE_DEFER); > + } > + > + xpcs =3D xpcs_create_mdiodev(pxpcs->bus, (int)port); > + device_unlock(&pdev->dev); [Severity: High] Does dropping the device lock here introduce a time-of-check to time-of-use race condition? If a concurrent unbind of the rk_xpcs-dwxpcs supplier driver occurs=20 immediately after device_unlock() but before device_link_add(), the unbind= =20 would trigger devres cleanup, freeing the mdio bus. > + if (IS_ERR(xpcs)) { > + put_device(&pdev->dev); > + return xpcs; > + } > + > + if (!device_link_add(dev, &pdev->dev, DL_FLAG_AUTOREMOVE_CONSUMER)) { Since device_link_add() permits linking to devices without drivers, it could succeed even if the supplier was just unbound. The consumer driver would th= en resume probing with the returned xpcs pointer referencing a freed mdio bus, leading to a use-after-free when the mac driver attempts to read or write pcs registers. Could the device_link_add() call be moved inside the lock block protected by device_lock() to safely establish the dependency before the lock is released? > + xpcs_destroy(xpcs); > + put_device(&pdev->dev); > + return ERR_PTR(-ENOMEM); > + } > + > + put_device(&pdev->dev); > + return xpcs; > +} --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260907153713.2572= 547-2-coiaprant@gmail.com?part=3D7 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 2FBAEC79F82 for ; Tue, 8 Sep 2026 15:41:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=wlqYMxpmV881uDYpUWh8y1v+1t26Esf6qtbP2PiUh38=; b=AfL8z5RGN+P3TE ux/NKa+kTAEVSuuhF/TM+Z0f98KhySwhEhqiX9daMuSqqRaXoVQ02g/B2Tx0qxm0oQey/Ou08CzoA BOZd4pflCE+UlCPjaPXUqAI3XL0KhPbgvHPR7oVZdah5PHl214msMz/MxGFf0opIZN9SH77t8bN2o tcPgBnIL8HStF4HP8nmpk7cMWErXcIw7E1GjaYTAz8hx1a9hKIAxq92khi4ATZ1o19glB6ELK+4S+ CVCZprlB3XmLI+mUJtCppyvC+fKlcIRVQ8H56xkH8AaxyGlev2mcnEBlewCBMBEnCOuGTXQA/PZZr 49d5RIUA1/Z2wQ6vrsqQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x3xwd-00000009WPL-3gW3; Tue, 08 Sep 2026 15:41:11 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x3xwb-00000009WOu-1drs for linux-phy@lists.infradead.org; Tue, 08 Sep 2026 15:41:09 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id E958A4118B; Tue, 8 Sep 2026 15:41:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6864E1F00A3A; Tue, 8 Sep 2026 15:41:08 +0000 (UTC) From: sashiko-bot@kernel.org Subject: Re: [PATCH net-next v4 07/10] net: pcs: xpcs: add Rockchip RK3568 platform glue driver To: "Coia Prant" Cc: olteanv@gmail.com, linux-phy@lists.infradead.org, neil.armstrong@linaro.org, devicetree@vger.kernel.org, robh@kernel.org, vkoul@kernel.org, conor+dt@kernel.org, wsa+renesas@sang-engineering.com In-Reply-To: <20260907153713.2572547-9-coiaprant@gmail.com> References: <20260907153713.2572547-2-coiaprant@gmail.com> <20260907153713.2572547-9-coiaprant@gmail.com> Date: Tue, 08 Sep 2026 15:40:50 +0000 Message-Id: <20260908154108.6864E1F00A3A@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MiBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIEEgVGltZS1vZi1DaGVj ayB0byBUaW1lLW9mLVVzZSAoVE9DVE9VKSByYWNlIGNvbmRpdGlvbiBpbiB4cGNzX3JrX2NyZWF0 ZSBhbGxvd3MgYSBjb25jdXJyZW50IHVuYmluZCBvZiB0aGUgc3VwcGxpZXIgdG8gZnJlZSB0aGUg TURJTyBidXMsIGxlYWRpbmcgdG8gYSBVc2UtQWZ0ZXItRnJlZS4KLSBbTWVkaXVtXSBJbmNvcnJl Y3QgTElGTyB0ZWFyZG93biBvcmRlcmluZyBpbiBkZXZyZXMgY2xvY2sgY2xlYW51cCBhY3Rpb24g dmlvbGF0ZXMgcHJvcGVyIGRldmljZSBpbml0aWFsaXphdGlvbiBhbmQgUE0gaGllcmFyY2h5IHJ1 bGVzLgotLQoKY29tbWl0IDcxNDJkYmY2YjI4YjVlZTk0ZDBlZGM5NjliY2YxNmQxMTgzYTVmNDEK QXV0aG9yOiBDb2lhIFByYW50IDxjb2lhcHJhbnRAZ21haWwuY29tPgoKbmV0OiBwY3M6IHhwY3M6 IGFkZCBSb2NrY2hpcCBSSzM1NjggcGxhdGZvcm0gZ2x1ZSBkcml2ZXIKClRoaXMgY29tbWl0IGFk ZHMgYSBwbGF0Zm9ybSBnbHVlIGRyaXZlciBmb3IgdGhlIFN5bm9wc3lzIERlc2lnbldhcmUgeHBj cwppbnRlZ3JhdGVkIGluIHRoZSBSb2NrY2hpcCBSSzM1NjggU29DLiBJdCBjcmVhdGVzIGEgdmly dHVhbCBtZGlvIGJ1cyB0bwp0cmFuc2xhdGUgbWRpbyBvcGVyYXRpb25zIHRvIGFwYjMgbWVtb3J5 LW1hcHBlZCByZWdpc3RlciBhY2Nlc3Nlcy4KCkxpbms6IGh0dHBzOi8vZGwucmFkeGEuY29tL3Jv Y2szL2RvY3MvaHcvZGF0YXNoZWV0L1JvY2tjaGlwJTIwUkszNTY4JTIwVFJNJTIwUGFydDIlMjBW MS4xLTIwMjEwMzAxLnBkZiAoUGFnZSAyMDc4KQoKPiBkaWZmIC0tZ2l0IGEvZHJpdmVycy9uZXQv cGNzL3Bjcy14cGNzLXJrLmMgYi9kcml2ZXJzL25ldC9wY3MvcGNzLXhwY3MtcmsuYwo+IG5ldyBm aWxlIG1vZGUgMTAwNjQ0Cj4gaW5kZXggMDAwMDAwMDAwMDAwMC4uNjhiY2FhMWE1Y2JiZgo+IC0t LSAvZGV2L251bGwKPiArKysgYi9kcml2ZXJzL25ldC9wY3MvcGNzLXhwY3MtcmsuYwpbIC4uLiBd Cj4gK3N0YXRpYyB2b2lkIHhwY3NfcmtfZXhpdF9jbGsodm9pZCAqZGF0YSkKPiArewo+ICsJc3Ry dWN0IGR3X3hwY3NfcmsgKnB4cGNzID0gZGF0YTsKPiArCXN0cnVjdCBkZXZpY2UgKmRldiA9ICZw eHBjcy0+cGRldi0+ZGV2Owo+ICsKPiArCWNsa19kaXNhYmxlX3VucHJlcGFyZShweHBjcy0+ZWVl X2Nsayk7Cj4gKwo+ICsJcG1fcnVudGltZV9mb3JjZV9zdXNwZW5kKGRldik7CgpbU2V2ZXJpdHk6 IE1lZGl1bV0KRG9lcyB0aGlzIHNlcXVlbmNlIHJlc3VsdCBpbiB0aGUgY2xvY2sgYmVpbmcgZGlz YWJsZWQgYmVmb3JlIHRoZSBkZXZpY2UgaXMKc3VzcGVuZGVkPwoKSW4geHBjc19ya19pbml0X2Ns aygpLCBlZWVfY2xrIGlzIGVuYWJsZWQgZmlyc3QsIGZvbGxvd2VkIGJ5IGEgY2FsbCB0bwpwbV9y dW50aW1lX2VuYWJsZSgpLCBhbGxvd2luZyB0aGUgZGV2aWNlIHRvIGJlY29tZSBydW50aW1lIGFj dGl2ZS4gRHVyaW5nIAp0ZWFyZG93biwgcG1fcnVudGltZV9mb3JjZV9zdXNwZW5kKCkgaW52b2tl cyB4cGNzX3JrX3BtX3J1bnRpbWVfc3VzcGVuZCgpCnRvIGRpc2FibGUgY3NyX2Nsay4KCkNhbGxp bmcgY2xrX2Rpc2FibGVfdW5wcmVwYXJlKCkgZm9yIGVlZV9jbGsgYmVmb3JlIHBtX3J1bnRpbWVf Zm9yY2Vfc3VzcGVuZCgpIAp2aW9sYXRlcyBsYXN0LWluLCBmaXJzdC1vdXQgb3JkZXJpbmcsIGRp c2FibGluZyB0aGUgcHJlcmVxdWlzaXRlIGNsb2NrIHdoaWxlCnRoZSBkZXZpY2UgaXMgc3RpbGwg Y29uc2lkZXJlZCBhY3RpdmUuIFNob3VsZCBwbV9ydW50aW1lX2ZvcmNlX3N1c3BlbmQoKSBiZQpj YWxsZWQgcHJpb3IgdG8gZGlzYWJsaW5nIHRoZSBlZWVfY2xrPwoKPiArfQpbIC4uLiBdCj4gK3N0 cnVjdCBkd194cGNzICp4cGNzX3JrX2NyZWF0ZShzdHJ1Y3QgZGV2aWNlICpkZXYsIHN0cnVjdCBk ZXZpY2Vfbm9kZSAqbnApCj4gK3sKWyAuLi4gXQo+ICsJZGV2aWNlX2xvY2soJnBkZXYtPmRldik7 Cj4gKwlweHBjcyA9IHBsYXRmb3JtX2dldF9kcnZkYXRhKHBkZXYpOwo+ICsJaWYgKCFweHBjcyB8 fCAhcHhwY3MtPmJ1cykgewo+ICsJCWRldmljZV91bmxvY2soJnBkZXYtPmRldik7Cj4gKwkJcHV0 X2RldmljZSgmcGRldi0+ZGV2KTsKPiArCQlyZXR1cm4gRVJSX1BUUigtRVBST0JFX0RFRkVSKTsK PiArCX0KPiArCj4gKwl4cGNzID0geHBjc19jcmVhdGVfbWRpb2RldihweHBjcy0+YnVzLCAoaW50 KXBvcnQpOwo+ICsJZGV2aWNlX3VubG9jaygmcGRldi0+ZGV2KTsKCltTZXZlcml0eTogSGlnaF0K RG9lcyBkcm9wcGluZyB0aGUgZGV2aWNlIGxvY2sgaGVyZSBpbnRyb2R1Y2UgYSB0aW1lLW9mLWNo ZWNrIHRvIHRpbWUtb2YtdXNlCnJhY2UgY29uZGl0aW9uPwoKSWYgYSBjb25jdXJyZW50IHVuYmlu ZCBvZiB0aGUgcmtfeHBjcy1kd3hwY3Mgc3VwcGxpZXIgZHJpdmVyIG9jY3VycyAKaW1tZWRpYXRl bHkgYWZ0ZXIgZGV2aWNlX3VubG9jaygpIGJ1dCBiZWZvcmUgZGV2aWNlX2xpbmtfYWRkKCksIHRo ZSB1bmJpbmQgCndvdWxkIHRyaWdnZXIgZGV2cmVzIGNsZWFudXAsIGZyZWVpbmcgdGhlIG1kaW8g YnVzLgoKPiArCWlmIChJU19FUlIoeHBjcykpIHsKPiArCQlwdXRfZGV2aWNlKCZwZGV2LT5kZXYp Owo+ICsJCXJldHVybiB4cGNzOwo+ICsJfQo+ICsKPiArCWlmICghZGV2aWNlX2xpbmtfYWRkKGRl diwgJnBkZXYtPmRldiwgRExfRkxBR19BVVRPUkVNT1ZFX0NPTlNVTUVSKSkgewoKU2luY2UgZGV2 aWNlX2xpbmtfYWRkKCkgcGVybWl0cyBsaW5raW5nIHRvIGRldmljZXMgd2l0aG91dCBkcml2ZXJz LCBpdCBjb3VsZApzdWNjZWVkIGV2ZW4gaWYgdGhlIHN1cHBsaWVyIHdhcyBqdXN0IHVuYm91bmQu IFRoZSBjb25zdW1lciBkcml2ZXIgd291bGQgdGhlbgpyZXN1bWUgcHJvYmluZyB3aXRoIHRoZSBy ZXR1cm5lZCB4cGNzIHBvaW50ZXIgcmVmZXJlbmNpbmcgYSBmcmVlZCBtZGlvIGJ1cywKbGVhZGlu ZyB0byBhIHVzZS1hZnRlci1mcmVlIHdoZW4gdGhlIG1hYyBkcml2ZXIgYXR0ZW1wdHMgdG8gcmVh ZCBvciB3cml0ZQpwY3MgcmVnaXN0ZXJzLgoKQ291bGQgdGhlIGRldmljZV9saW5rX2FkZCgpIGNh bGwgYmUgbW92ZWQgaW5zaWRlIHRoZSBsb2NrIGJsb2NrIHByb3RlY3RlZApieSBkZXZpY2VfbG9j aygpIHRvIHNhZmVseSBlc3RhYmxpc2ggdGhlIGRlcGVuZGVuY3kgYmVmb3JlIHRoZSBsb2NrIGlz CnJlbGVhc2VkPwoKPiArCQl4cGNzX2Rlc3Ryb3koeHBjcyk7Cj4gKwkJcHV0X2RldmljZSgmcGRl di0+ZGV2KTsKPiArCQlyZXR1cm4gRVJSX1BUUigtRU5PTUVNKTsKPiArCX0KPiArCj4gKwlwdXRf ZGV2aWNlKCZwZGV2LT5kZXYpOwo+ICsJcmV0dXJuIHhwY3M7Cj4gK30KCi0tIApTYXNoaWtvIEFJ IHJldmlldyDCtyBodHRwczovL3Nhc2hpa28uZGV2LyMvcGF0Y2hzZXQvMjAyNjA5MDcxNTM3MTMu MjU3MjU0Ny0yLWNvaWFwcmFudEBnbWFpbC5jb20/cGFydD03CgotLSAKbGludXgtcGh5IG1haWxp bmcgbGlzdApsaW51eC1waHlAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwczovL2xpc3RzLmluZnJh ZGVhZC5vcmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1waHkK