From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 48EC1C982DA for ; Sun, 20 Sep 2026 12:53:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: References:In-Reply-To:Cc:To:Subject:From:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=WEVjhP+9s46sDddWKIlmuPaejMJroEdDDlPCr8FWjEA=; b=dZ8Cg0UjibKSdf Pcd+sGiyAV1IAiJiMcXgQ1879w6r/6DkhWsK0/ljmK9D2G9D2qkJIdbBCvBKQvekquA6l8P1B8hPQ oU4fUJErpDyiBeV9amvUujx2vacaTi6um7TITPwW6ZyswGJTTLRNm+U2L59vXGpjlatUtbeR5sl7w XSRT943jILlgTYUmz173489e6h48FzfBxZiHMnaRUa297US807KU/YFyVQpVOx5uCDAsUmPjmnlpF HuCV9DXcmTUxhvKHwgBHG64iXSudpEKTaQ2VOVaK8nq+C4ZKAc7s09f6K43qQe993agQhbhBa8n2b YBBDigqSMOwwH+cxo8DA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x8H2o-0000000HTCU-0CXh; Sun, 20 Sep 2026 12:53:22 +0000 Received: from tor.source.kernel.org ([2600:3c04:e001:324:0:1991:8:25]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x8H2n-0000000HTC2-0eKF for linux-phy@lists.infradead.org; Sun, 20 Sep 2026 12:53:21 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 3BB4C601FF; Sun, 20 Sep 2026 12:53:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D9001F00893; Sun, 20 Sep 2026 12:53:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789908799; bh=v2l60P4XbYSqxLiNQ8qMCT/wM2wFsRk4MS6VFdhfcT8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=aY6ZDoRuX5g8Q/4j1I9SAc4qGTr7860RAN/xeYOYo+gu3Rap5/2T3zmNv6ICaVRhR xJRoA3FjUvBtCtwrcMM0L91UzN9gJdDCKxge7r2uHeFD4b7wCbjWdtU4xPVV5Dkacp OfpuLpAQAVPZT1spzrL0pVeDIwgiOvXe5m9l4PS9eA5D2kaDf/ceUpBnLUioCT99In pscJU3xTvnlID9ljUMm7f9F0ZNBS00pevyK0z4NRRwZM3dFF91BcRMF+0Us928tYUQ /Vn9n1SCIrVkEFVRWP+4zgFa6RUXYNoo4Xt4hfLGDwGmvU2y+aPtNI0vSxtcmv3/aw 51IiYUpY7h79Q== From: sashiko-bot@kernel.org Subject: Re: [PATCH net-next v8 07/11] net: pcs: xpcs: add Rockchip RK3568 platform glue driver To: "Coia Prant" Cc: conor+dt@kernel.org, wsa+renesas@sang-engineering.com, linux-phy@lists.infradead.org, neil.armstrong@linaro.org, robh@kernel.org, vkoul@kernel.org, olteanv@gmail.com, devicetree@vger.kernel.org In-Reply-To: <20260919125119.2107089-8-coiaprant@gmail.com> References: <20260919125119.2107089-1-coiaprant@gmail.com> <20260919125119.2107089-8-coiaprant@gmail.com> Date: Sun, 20 Sep 2026 12:53:19 +0000 Message-Id: <20260920125319.8D9001F00893@smtp.kernel.org> X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MSBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIG5ldDogcGNzOiB4cGNz LXJrOiBVQUYgaW4geHBjc19ya19jcmVhdGUgZHVlIHRvIFRPQ1RPVSBhbmQgdW5wcm90ZWN0ZWQg ZGV2cmVzIGFjY2VzcwotLQoKY29tbWl0IDJlN2Y0OTA5MDdlODM3ODg0ODEzNjliZjQzYWQzNWFi ZTBkNTY1MDQKQXV0aG9yOiBDb2lhIFByYW50IDxjb2lhcHJhbnRAZ21haWwuY29tPgoKbmV0OiBw Y3M6IHhwY3M6IGFkZCBSb2NrY2hpcCBSSzM1NjggcGxhdGZvcm0gZ2x1ZSBkcml2ZXIKClRoaXMg Y29tbWl0IGludHJvZHVjZXMgYSBnZW5lcmljIHBsYXRmb3JtIGdsdWUgZHJpdmVyIGZvciB0aGUg U3lub3BzeXMKRGVzaWduV2FyZSBYUENTIG9uIFJvY2tjaGlwIFJLMzU2OCBTb0NzLiBJdCB0cmFu c2xhdGVzIHN0YW5kYXJkIE1ESU8Kb3BlcmF0aW9ucyBpbnRvIEFQQjMgbWVtb3J5LW1hcHBlZCBy ZWdpc3RlciBhY2Nlc3NlcyBieSBjcmVhdGluZyBhCnZpcnR1YWwgTURJTyBidXMuCgpMaW5rOiBo dHRwczovL2RsLnJhZHhhLmNvbS9yb2NrMy9kb2NzL2h3L2RhdGFzaGVldC9Sb2NrY2hpcCUyMFJL MzU2OCUyMFRSTSUyMFBhcnQxJTIwVjEuMS0yMDIxMDMwMS5wZGYKTGluazogaHR0cHM6Ly9kbC5y YWR4YS5jb20vcm9jazMvZG9jcy9ody9kYXRhc2hlZXQvUm9ja2NoaXAlMjBSSzM1NjglMjBUUk0l MjBQYXJ0MiUyMFYxLjEtMjAyMTAzMDEucGRmCgo+IGRpZmYgLS1naXQgYS9kcml2ZXJzL25ldC9w Y3MvcGNzLXhwY3MtcmsuYyBiL2RyaXZlcnMvbmV0L3Bjcy9wY3MteHBjcy1yay5jCj4gbmV3IGZp bGUgbW9kZSAxMDA2NDQKPiBpbmRleCAwMDAwMDAwMDAwMDAwLi44NGY4ZWE3ZmE1N2U4Cj4gLS0t IC9kZXYvbnVsbAo+ICsrKyBiL2RyaXZlcnMvbmV0L3Bjcy9wY3MteHBjcy1yay5jCgpbIC4uLiBd Cgo+ICtzdHJ1Y3QgZHdfeHBjcyAqeHBjc19ya19jcmVhdGUoc3RydWN0IGRldmljZSAqZGV2LCBz dHJ1Y3QgZGV2aWNlX25vZGUgKm5wKQo+ICt7Cj4gKwlzdHJ1Y3QgcGxhdGZvcm1fZGV2aWNlICpw ZGV2OwoKWyAuLi4gXQoKPiArCWlmICghZGV2aWNlX2xpbmtfYWRkKGRldiwgJnBkZXYtPmRldiwg RExfRkxBR19BVVRPUkVNT1ZFX0NPTlNVTUVSKSkgewo+ICsJCXB1dF9kZXZpY2UoJnBkZXYtPmRl dik7Cj4gKwkJcmV0dXJuIEVSUl9QVFIoLUVQUk9CRV9ERUZFUik7Cj4gKwl9Cj4gKwo+ICsJZGV2 aWNlX2xvY2soJnBkZXYtPmRldik7Cj4gKwlpZiAoIWRldmljZV9pc19ib3VuZCgmcGRldi0+ZGV2 KSkgewo+ICsJCWRldmljZV91bmxvY2soJnBkZXYtPmRldik7Cj4gKwkJcHV0X2RldmljZSgmcGRl di0+ZGV2KTsKPiArCQlyZXR1cm4gRVJSX1BUUigtRVBST0JFX0RFRkVSKTsKPiArCX0KPiArCWRl dmljZV91bmxvY2soJnBkZXYtPmRldik7Cj4gKwo+ICsJcHhwY3MgPSBwbGF0Zm9ybV9nZXRfZHJ2 ZGF0YShwZGV2KTsKPiArCWlmICghcHhwY3MgfHwgIXB4cGNzLT5idXMpIHsKCltTZXZlcml0eTog SGlnaF0KQ2FuIHRoaXMgcmVzdWx0IGluIGEgdXNlLWFmdGVyLWZyZWUgb2YgdGhlIHN1cHBsaWVy IGRldnJlcyBkYXRhPwoKSWYgdGhlIFhQQ1MgZHJpdmVyIHVuYmluZHMgd2hpbGUgYSBzZWNvbmQg TUFDIGNvbnN1bWVyIHByb2JlcywgdGhlIG5ld2x5CmNyZWF0ZWQgZGV2aWNlIGxpbmsgd2lsbCBi ZSBpbiB0aGUgRExfU1RBVEVfU1VQUExJRVJfVU5CSU5EIHN0YXRlLiBCZWNhdXNlCm9mIHRoaXMg c3RhdGUsIGRldmljZV9saW5rc191bmJpbmRfY29uc3VtZXJzKCkgaWdub3JlcyBpdCBhbmQgZG9l cyBub3Qgd2FpdC4KClNpbmNlIHRoZSBkZXZpY2VfbG9jaygpIGlzIGRyb3BwZWQgYmVmb3JlIGNh bGxpbmcgcGxhdGZvcm1fZ2V0X2RydmRhdGEoKSwKY291bGQgdGhlIHVuYmluZCBmaW5pc2ggYW5k IGZyZWUgdGhlIHB4cGNzIGRldnJlcyBhbGxvY2F0aW9uIGJlZm9yZSB3ZQpkZXJlZmVyZW5jZSBw eHBjcy0+YnVzIGJlbG93PwoKQ1BVMSAoU3VwcGxpZXIgVW5iaW5kaW5nKSAgICAgICAgICAgICBD UFUyIChDb25zdW1lciBQcm9iaW5nKQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIGRldmljZV9saW5rX2FkZCgpCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgZGV2aWNlX2xvY2soKQogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGRl dmljZV9pc19ib3VuZCgpIHJldHVybnMgdHJ1ZQogICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgIGRldmljZV91bmxvY2soKQp1bmJpbmQgY29tcGxldGVzCmRldnJlcyBmcmVlcyBw eHBjcwogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHB4cGNzID0gcGxhdGZv cm1fZ2V0X2RydmRhdGEocGRldik7CiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgeHBjc19jcmVhdGVfbWRpb2RldihweHBjcy0+YnVzLCAuLi4pCgo+ICsJCXB1dF9kZXZpY2Uo JnBkZXYtPmRldik7Cj4gKwkJcmV0dXJuIEVSUl9QVFIoLUVQUk9CRV9ERUZFUik7Cj4gKwl9Cj4g Kwo+ICsJeHBjcyA9IHhwY3NfY3JlYXRlX21kaW9kZXYocHhwY3MtPmJ1cywgKGludClwb3J0KTsK PiArCWlmIChJU19FUlIoeHBjcykpIHsKPiArCQlwdXRfZGV2aWNlKCZwZGV2LT5kZXYpOwo+ICsJ CXJldHVybiB4cGNzOwo+ICsJfQoKWyAuLi4gXQoKLS0gClNhc2hpa28gQUkgcmV2aWV3IMK3IGh0 dHBzOi8vc2FzaGlrby5kZXYvIy9wYXRjaHNldC8yMDI2MDkxOTEyNTExOS4yMTA3MDg5LTEtY29p YXByYW50QGdtYWlsLmNvbT9wYXJ0PTcKCi0tIApsaW51eC1waHkgbWFpbGluZyBsaXN0CmxpbnV4 LXBoeUBsaXN0cy5pbmZyYWRlYWQub3JnCmh0dHBzOi8vbGlzdHMuaW5mcmFkZWFkLm9yZy9tYWls bWFuL2xpc3RpbmZvL2xpbnV4LXBoeQo= From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1D3053C4B64 for ; Sun, 20 Sep 2026 12:53:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789908820; cv=none; b=GMeYWjhs+ocFqY4tQQfQJHAlMSu2xtVPdMeyG593g6M3xe2MvcKblJzOa7YyFY4092kPlWVHAmxollxbDUyBi6rfp1wG7LFZOBu3SdFGZQIHOYI7apAegFIFSbduwLw8MWwH3LP3ju4vbD5boFWq64m4If5tsriXAAX3QRYjUzw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789908820; c=relaxed/simple; bh=R4UcuqzIlFWHBmzfgEM5UeCp1dFiViecARR39DX9uzY=; h=From:Subject:To:Cc:In-Reply-To:References:Content-Type:Date: Message-Id; b=HGZFt7RnZv2vKVgUZGRjG/SY90n9DNOumujmRtQmPkAhJkYLeV63+JTth7aNrPNXl+bKel2LnuMGGxSDY9bLZQAc2zZgNhJC2Lwhela9UH4vJ562100XwHsKpg6at4G2ZMhpWc1+eVwC5Z5aynLaVWYDvFN5oyavxrIbqg9b5Kk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=aY6ZDoRu; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="aY6ZDoRu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D9001F00893; Sun, 20 Sep 2026 12:53:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789908799; bh=v2l60P4XbYSqxLiNQ8qMCT/wM2wFsRk4MS6VFdhfcT8=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=aY6ZDoRuX5g8Q/4j1I9SAc4qGTr7860RAN/xeYOYo+gu3Rap5/2T3zmNv6ICaVRhR xJRoA3FjUvBtCtwrcMM0L91UzN9gJdDCKxge7r2uHeFD4b7wCbjWdtU4xPVV5Dkacp OfpuLpAQAVPZT1spzrL0pVeDIwgiOvXe5m9l4PS9eA5D2kaDf/ceUpBnLUioCT99In pscJU3xTvnlID9ljUMm7f9F0ZNBS00pevyK0z4NRRwZM3dFF91BcRMF+0Us928tYUQ /Vn9n1SCIrVkEFVRWP+4zgFa6RUXYNoo4Xt4hfLGDwGmvU2y+aPtNI0vSxtcmv3/aw 51IiYUpY7h79Q== From: sashiko-bot@kernel.org Subject: Re: [PATCH net-next v8 07/11] net: pcs: xpcs: add Rockchip RK3568 platform glue driver Reply-To: sashiko-reviews@lists.linux.dev To: "Coia Prant" Cc: conor+dt@kernel.org, wsa+renesas@sang-engineering.com, linux-phy@lists.infradead.org, neil.armstrong@linaro.org, robh@kernel.org, vkoul@kernel.org, olteanv@gmail.com, devicetree@vger.kernel.org In-Reply-To: <20260919125119.2107089-8-coiaprant@gmail.com> References: <20260919125119.2107089-1-coiaprant@gmail.com> <20260919125119.2107089-8-coiaprant@gmail.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Sun, 20 Sep 2026 12:53:19 +0000 Message-Id: <20260920125319.8D9001F00893@smtp.kernel.org> Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 1 potential issue(= s) to consider: - [High] net: pcs: xpcs-rk: UAF in xpcs_rk_create due to TOCTOU and unprote= cted devres access -- commit 2e7f490907e83788481369bf43ad35abe0d56504 Author: Coia Prant net: pcs: xpcs: add Rockchip RK3568 platform glue driver This commit introduces a generic platform glue driver for the Synopsys DesignWare XPCS on Rockchip RK3568 SoCs. It translates standard MDIO operations into APB3 memory-mapped register accesses by creating a virtual MDIO bus. Link: https://dl.radxa.com/rock3/docs/hw/datasheet/Rockchip%20RK3568%20TRM%= 20Part1%20V1.1-20210301.pdf Link: https://dl.radxa.com/rock3/docs/hw/datasheet/Rockchip%20RK3568%20TRM%= 20Part2%20V1.1-20210301.pdf > diff --git a/drivers/net/pcs/pcs-xpcs-rk.c b/drivers/net/pcs/pcs-xpcs-rk.c > new file mode 100644 > index 0000000000000..84f8ea7fa57e8 > --- /dev/null > +++ b/drivers/net/pcs/pcs-xpcs-rk.c [ ... ] > +struct dw_xpcs *xpcs_rk_create(struct device *dev, struct device_node *n= p) > +{ > + struct platform_device *pdev; [ ... ] > + if (!device_link_add(dev, &pdev->dev, DL_FLAG_AUTOREMOVE_CONSUMER)) { > + put_device(&pdev->dev); > + return ERR_PTR(-EPROBE_DEFER); > + } > + > + device_lock(&pdev->dev); > + if (!device_is_bound(&pdev->dev)) { > + device_unlock(&pdev->dev); > + put_device(&pdev->dev); > + return ERR_PTR(-EPROBE_DEFER); > + } > + device_unlock(&pdev->dev); > + > + pxpcs =3D platform_get_drvdata(pdev); > + if (!pxpcs || !pxpcs->bus) { [Severity: High] Can this result in a use-after-free of the supplier devres data? If the XPCS driver unbinds while a second MAC consumer probes, the newly created device link will be in the DL_STATE_SUPPLIER_UNBIND state. Because of this state, device_links_unbind_consumers() ignores it and does not wait. Since the device_lock() is dropped before calling platform_get_drvdata(), could the unbind finish and free the pxpcs devres allocation before we dereference pxpcs->bus below? CPU1 (Supplier Unbinding) CPU2 (Consumer Probing) device_link_add() device_lock() device_is_bound() returns true device_unlock() unbind completes devres frees pxpcs pxpcs =3D platform_get_drvdata(pdev); xpcs_create_mdiodev(pxpcs->bus, ...) > + put_device(&pdev->dev); > + return ERR_PTR(-EPROBE_DEFER); > + } > + > + xpcs =3D xpcs_create_mdiodev(pxpcs->bus, (int)port); > + if (IS_ERR(xpcs)) { > + put_device(&pdev->dev); > + return xpcs; > + } [ ... ] --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260919125119.2107= 089-1-coiaprant@gmail.com?part=3D7