Re: [PATCH RFC 06/12] usb: typec: qcom: Add gen1 Type-C port support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] usb: typec: qcom: data race on port->tcpm_port causes NULL dereference
--

commit c724ae85ceb0ca42ea62d9d3f8a3d994453a3cf9
Author: David Heidelberg <david@ixit.cz>

usb: typec: qcom: Add gen1 Type-C port support

Add a port backend for the first generation of the Qualcomm PMIC Type-C
block, found on PM660 and PMI8998.

> diff --git a/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c
> new file mode 100644
> index 0000000000000..b4e3e49664f9d
> --- /dev/null
> +++ b/drivers/usb/typec/tcpm/qcom/qcom_pmic_typec_port_gen1.c

[ ... ]

> +static int gen1_typec_set_vbus(struct tcpc_dev *tcpc, bool on, bool sink)
> +{
> +	struct pmic_typec *tcpm = tcpc_to_tcpm(tcpc);
> +	struct gen1_typec_port *port = tcpm->pmic_typec_port;
> +	bool changed = false;
> +	int ret = 0;

[ ... ]

> +	/*
> +	 * set_vbus() may run during tcpm_register_port() before port_start()
> +	 * provides tcpm_port. Once registered, notify TCPM whenever the
> +	 * source regulator actually changes state. get_vbus() also accounts
> +	 * for vbus_enabled when GEN1 does not reflect sourced VBUS in
> +	 * TYPEC_VBUS_STATUS.
> +	 */
> +	if (changed && port->tcpm_port)
> +		tcpm_vbus_change(port->tcpm_port);

[Severity: High]
Could this sequence lead to a NULL pointer dereference if device teardown
occurs concurrently?

It appears port->tcpm_port is evaluated outside port->lock. Without
READ_ONCE(), the compiler could emit a double fetch (TOCTOU) here.

If the TCPM worker thread (driven by external cable events) executes a VBUS
state transition concurrently with unbind, the pointer could become NULL
between the condition check and the function call, causing
tcpm_vbus_change(NULL) to crash.

[ ... ]

> +static void gen1_typec_port_stop(struct pmic_typec *tcpm)
> +{
> +	struct gen1_typec_port *port = tcpm->pmic_typec_port;
> +
> +	disable_irq(port->irq);
> +	port->tcpm_port = NULL;

[Severity: High]
Is it safe to clear port->tcpm_port locklessly here?

During unbind, qcom_pmic_typec_remove() calls gen1_typec_port_stop(),
which executes port->tcpm_port = NULL without holding a lock. This appears
to be what creates the potential race with gen1_typec_set_vbus() shown above.

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260926-typec-v1-0-31adc19f32c6@ixit.cz?part=6