Re: [PATCH v9 5/6] phy: realtek: usb2: add support for RTL9607C USB2 PHY

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] phy: realtek: missing of_iomap() check leads to NULL dereference
--

commit 69e22da529f3cad44ca97c0c6f0a80e03f43ad7e
Author: Rustam Adilov <adilov@disroot.org>

phy: realtek: usb2: add support for RTL9607C USB2 PHY

This commit adds support for the USB2 PHY on RTL9607C series SoCs. It
includes new macros, configuration structures, big-endian access functions,
and logic to clear a force host disconnect bit during initialization.

> diff --git a/drivers/phy/realtek/phy-rtk-usb2.c b/drivers/phy/realtek/phy-rtk-usb2.c
> index 2ddad7be73534..64076938c821d 100644
> --- a/drivers/phy/realtek/phy-rtk-usb2.c
> +++ b/drivers/phy/realtek/phy-rtk-usb2.c

[ ... ]

> @@ -600,6 +617,23 @@ static int do_rtk_phy_init(struct rtk_phy *rtk_phy, int index)
>  		goto do_toggle;
>  	}
>  
> +	if (phy_cfg->force_host_disconnect) {
> +		const struct phy_reg_desc *reg_desc = phy_reg->desc;
> +		void __iomem *vstatus = phy_reg->reg_wrap_vstatus;
> +		u32 temp;
> +
> +		temp = reg_desc->read(vstatus + PHY_9607_FORCE_DISCONNECT_REG);

[Severity: High]
Can this result in a NULL pointer dereference?

If of_iomap() fails to map device memory, it returns NULL which is stored
without validation:

drivers/phy/realtek/phy-rtk-usb2.c:parse_phy_data() {
    ...
    phy_parameter->phy_reg.reg_wrap_vstatus = of_iomap(np, 0);
    ...
}

This new code in do_rtk_phy_init() relies on this pointer by dereferencing
vstatus via the read function. Does this need an error check during the
initial mapping or before this dereference?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016180314.31760-1-adilov@disroot.org?part=5

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy