All of lore.kernel.org
 help / color / mirror / Atom feed
From: sashiko-bot@kernel.org
To: "Joey Lu" <a0987203069@gmail.com>
Cc: vkoul@kernel.org, robh@kernel.org, neil.armstrong@linaro.org,
	devicetree@vger.kernel.org, conor+dt@kernel.org,
	olteanv@gmail.com, linux-phy@lists.infradead.org
Subject: Re: [PATCH v6 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support
Date: Tue, 29 Sep 2026 02:16:12 +0000	[thread overview]
Message-ID: <20260929021612.7EB891F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260929020854.1282339-4-a0987203069@gmail.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] phy: nuvoton: uninitialized stack variable usage in ma35_role_sw_get()
--

commit 801a123466a572aa070fd7a885bb27adf3f83110
Author: Joey Lu <a0987203069@gmail.com>

phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support

This commit extends the Nuvoton MA35D1 USB 2.0 PHY driver to manage both
PHY0 and PHY1, handling host and device modes. It introduces a single init
callback instead of separate power_on/power_off callbacks and adds a USB
role switch for PHY0. New device-tree properties for resistor calibration
and over-current polarity are also supported.

> diff --git a/drivers/phy/nuvoton/phy-ma35d1-usb2.c b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> index 9a459b700ed48..547c7d55d8ff4 100644
> --- a/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> +++ b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
[ ... ]
> +static enum usb_role ma35_role_sw_get(struct usb_role_switch *sw)
> +{
> +	struct ma35_usb_phy *p = usb_role_switch_get_drvdata(sw);
> +	u32 val;
> +
> +	regmap_read(p->sysreg, MA35_SYS_PWRONOTP, &val);
> +
> +	return (val & PWRONOTP_USBP0ID) ? USB_ROLE_HOST : USB_ROLE_DEVICE;
> +}

[Severity: Medium]
Does this code use an uninitialized stack variable if regmap_read() fails?

If regmap_read() returns a negative error code, the out-parameter val will
remain uninitialized. The subsequent check of val & PWRONOTP_USBP0ID would
then evaluate uninitialized kernel stack memory.

This could report an unreliable hardware state to the USB role framework and
leak a bit of kernel stack memory to userspace via the sysfs interface.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929020854.1282339-1-a0987203069@gmail.com?part=3

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy

WARNING: multiple messages have this Message-ID (diff)
From: sashiko-bot@kernel.org
To: "Joey Lu" <a0987203069@gmail.com>
Cc: vkoul@kernel.org, robh@kernel.org, neil.armstrong@linaro.org,
	devicetree@vger.kernel.org, conor+dt@kernel.org,
	olteanv@gmail.com, linux-phy@lists.infradead.org
Subject: Re: [PATCH v6 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support
Date: Tue, 29 Sep 2026 02:16:12 +0000	[thread overview]
Message-ID: <20260929021612.7EB891F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260929020854.1282339-4-a0987203069@gmail.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] phy: nuvoton: uninitialized stack variable usage in ma35_role_sw_get()
--

commit 801a123466a572aa070fd7a885bb27adf3f83110
Author: Joey Lu <a0987203069@gmail.com>

phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support

This commit extends the Nuvoton MA35D1 USB 2.0 PHY driver to manage both
PHY0 and PHY1, handling host and device modes. It introduces a single init
callback instead of separate power_on/power_off callbacks and adds a USB
role switch for PHY0. New device-tree properties for resistor calibration
and over-current polarity are also supported.

> diff --git a/drivers/phy/nuvoton/phy-ma35d1-usb2.c b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> index 9a459b700ed48..547c7d55d8ff4 100644
> --- a/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> +++ b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
[ ... ]
> +static enum usb_role ma35_role_sw_get(struct usb_role_switch *sw)
> +{
> +	struct ma35_usb_phy *p = usb_role_switch_get_drvdata(sw);
> +	u32 val;
> +
> +	regmap_read(p->sysreg, MA35_SYS_PWRONOTP, &val);
> +
> +	return (val & PWRONOTP_USBP0ID) ? USB_ROLE_HOST : USB_ROLE_DEVICE;
> +}

[Severity: Medium]
Does this code use an uninitialized stack variable if regmap_read() fails?

If regmap_read() returns a negative error code, the out-parameter val will
remain uninitialized. The subsequent check of val & PWRONOTP_USBP0ID would
then evaluate uninitialized kernel stack memory.

This could report an unreliable hardware state to the USB role framework and
leak a bit of kernel stack memory to userspace via the sysfs interface.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929020854.1282339-1-a0987203069@gmail.com?part=3

  reply	other threads:[~2026-09-29  2:16 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-09-29  2:08 [PATCH v6 0/3] phy: nuvoton: extend MA35D1 USB2 PHY driver for dual-port OTG support Joey Lu
2026-09-29  2:08 ` Joey Lu
2026-09-29  2:08 ` [PATCH v6 1/3] dt-bindings: phy: nuvoton,ma35d1-usb2-phy: extend for dual-port and OTG Joey Lu
2026-09-29  2:08   ` Joey Lu
2026-09-29  2:08 ` [PATCH v6 2/3] arm64: dts: nuvoton: ma35d1: add USB controllers and dual-port PHY node Joey Lu
2026-09-29  2:08   ` Joey Lu
2026-10-01  8:48   ` Jacky Huang
2026-10-01  8:48     ` Jacky Huang
2026-09-29  2:08 ` [PATCH v6 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support Joey Lu
2026-09-29  2:08   ` Joey Lu
2026-09-29  2:16   ` sashiko-bot [this message]
2026-09-29  2:16     ` sashiko-bot
2026-10-05 10:07   ` Vinod Koul
2026-10-05 10:07     ` Vinod Koul
2026-10-06  1:37     ` Joey Lu
2026-10-06  1:37       ` Joey Lu
2026-10-06  8:37       ` Vinod Koul
2026-10-06  8:37         ` Vinod Koul
2026-10-06 10:22         ` Joey Lu
2026-10-06 10:22           ` Joey Lu
2026-10-06 10:39           ` Vinod Koul
2026-10-06 10:39             ` Vinod Koul
2026-10-06 10:43             ` Joey Lu
2026-10-06 10:43               ` Joey Lu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260929021612.7EB891F000FF@smtp.kernel.org \
    --to=sashiko-bot@kernel.org \
    --cc=a0987203069@gmail.com \
    --cc=conor+dt@kernel.org \
    --cc=devicetree@vger.kernel.org \
    --cc=linux-phy@lists.infradead.org \
    --cc=neil.armstrong@linaro.org \
    --cc=olteanv@gmail.com \
    --cc=robh@kernel.org \
    --cc=sashiko-reviews@lists.linux.dev \
    --cc=vkoul@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.