Re: [PATCH v19 2/5] phy: core: Add phy_get_by_of_node()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] phy: core: missing #phy-cells validation in phy_get_by_of_node() causes silent misbehavior
- [Medium] phy: core: missing usb-nop-xceiv compatibility check in phy_get_by_of_node()
--

commit da2f62e45c36c5bbb5ae2340d33b32c34093c095
Author: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

phy: core: Add phy_get_by_of_node()

Add new function phy_get_by_of_node() allowing lookup of a phy by
device_node. Separates existing logic in _of_phy_get() into an internal
helper method _of_phy_get_with_args() to allow for reuse in new method.

> diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
> index 89addd732bff3..4a8e1d3cdfe75 100644
> --- a/drivers/phy/phy-core.c
> +++ b/drivers/phy/phy-core.c

[ ... ]

> @@ -1001,6 +1017,41 @@ struct phy *devm_of_phy_get_by_index(struct device *dev, struct device_node *np,
>  }
>  EXPORT_SYMBOL_GPL(devm_of_phy_get_by_index);
>  
> +/**
> + * phy_get_by_of_node() - lookup and obtain a reference to a phy by device_node
> + * @np: node containing the phy
> + *
> + * Returns the phy associated with the device node or ERR_PTR.
> + */
> +struct phy *phy_get_by_of_node(struct device_node *np)
> +{
> +	struct of_phandle_args args = { .np = np, .args_count = 0 };

[Severity: High]
Does this hardcoded args_count = 0 bypass the #phy-cells validation that
normally happens in of_parse_phandle_with_args()?

If called on a PHY provider node with #phy-cells > 0 (e.g. resolved via an OF
graph endpoint), the provider's of_xlate callback will receive args_count = 0.

Since many callbacks don't check args_count and directly access args->args[0]
(which is initialized to 0), could they silently return PHY 0 instead of
returning an error, causing the caller to operate on the wrong PHY instance?

> +	struct phy *phy;
> +
> +	if (!np)
> +		return ERR_PTR(-EINVAL);
> +
> +	mutex_lock(&phy_provider_mutex);
> +
> +	phy = _of_phy_get_with_args(&args);

[Severity: Medium]
Is this missing a compatibility check for "usb-nop-xceiv"?

In _of_phy_get(), legacy USB PHYs are explicitly checked and return -ENODEV
so they can gracefully fall back to the older usb-phy subsystem.

Because phy_get_by_of_node() directly calls _of_phy_get_with_args() without
this check, could a driver using this API on a legacy USB PHY node fail to
find a generic PHY provider and receive -EPROBE_DEFER, causing an infinite
probe deferral loop?

> +
> +	if (IS_ERR(phy))
> +		goto out_unlock;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260917-b4-linux-next-25-03-13-dtsi-x1e80100-camss-v19-0-21ad8a76e941@linaro.org?part=2