From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 36B69CCF2C3 for ; Fri, 16 Oct 2026 18:56:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Reply-To:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Date:References: In-Reply-To:Cc:To:Subject:From:Message-ID:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=TQKEOGu8qgwfKzjmPy0j1BjOQPj8sAR2EOo0aL+yig4=; b=ZjVsllrzOpv25b doev2835D/1fOTT2agNpDY4LbLAKZ6bhNunnwGB/jbmBDH4nhLdp5IZ9XjPVczyXrTC011B/uVEaC M+gxM4WPNYXviHj//qQya4zgA4GXQd0EZbpBUevoK/67/QblGDYZ3lXLNSnYnl47OgYCZvSGK+f2u 0r7VJfAno0AeJ+KStOPsnxE9qwUfuZWUrnGBv5UiUDakZWfICh3bEkgVJS/e58Mfp5dTmvXKB8auw tWeEbomm8znml6EkPN3nZUtDJc7MN6BZ73DarNNMNawbABeX88moqVToQ6JZcrb7dq673sv4HkCGZ J3ghfYWaqIFWcGDqzNWg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1xHn67-00000003jnk-3kj9; Fri, 16 Oct 2026 18:56:07 +0000 Received: from sea.source.kernel.org ([172.234.252.31]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1xHn67-00000003jna-0r6H for linux-phy@lists.infradead.org; Fri, 16 Oct 2026 18:56:07 +0000 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by sea.source.kernel.org (Postfix) with ESMTP id BBED340B05; Fri, 16 Oct 2026 18:56:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21D0A1F000C4; Fri, 16 Oct 2026 18:56:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792176966; bh=/kVyelCjWMtE8WreHFwMKW5pUBsXLrz4jQpxpGQX+Mg=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=g8XBZvJQ4LyfXHhoysMSWtWmoqRCs7ms5FOZMv2TR/ZN/Qyen4xqsqDcMGbQEvFKP jvLniECB6d9/xSQSBYrmBaCvd6lkNbxQDMzIaPMwH/mNPDsNEZSRaBhOof28YQ+ty/ 88lOE0kpaWTeM5btmrEnJicH7JXWlByA8JcCdSwHLh5sECK6j7q5MtMYDmKECcJCqp 6ivvNAt7x/WbiP/VjKXvpkZ+JMCbiFDTNhuOBd1CSlCuLrFNO945rY9lTa85taaav9 g1SYNHx6fqiG5HLYW9gfkiBhaWMN+8v3LqT8q1nETZBkwizdfeFpYl5HBbp8oUGuZn J5KAibDYWiv0Q== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v17 7/7] usb: dwc3: rockchip: fix USB-C reconnect in gadget mode To: "Sebastian Reichel" Cc: linux-usb@vger.kernel.org, linux-phy@lists.infradead.org, vkoul@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20261016-b4-rockchip-dwc3-rockchip-glue-v17-7-876f96893e2f@collabora.com> References: <20261016-b4-rockchip-dwc3-rockchip-glue-v17-0-876f96893e2f@collabora.com> <20261016-b4-rockchip-dwc3-rockchip-glue-v17-7-876f96893e2f@collabora.com> Date: Fri, 16 Oct 2026 18:56:05 +0000 X-BeenThere: linux-phy@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Linux Phy Mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: sashiko-reviews@lists.linux.dev MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-phy" Errors-To: linux-phy-bounces+linux-phy=archiver.kernel.org@lists.infradead.org VGhhbmsgeW91IGZvciB5b3VyIGNvbnRyaWJ1dGlvbiEgU2FzaGlrbyBBSSByZXZpZXcgZm91bmQg MyBwb3RlbnRpYWwgaXNzdWUocykgdG8gY29uc2lkZXI6Ci0gW0hpZ2hdIHVzYjogZHdjMzogcm9j a2NoaXA6IFVBRiBpbiB2YnVzIGhhbmRsZXIgZHVyaW5nIGdhZGdldCB0ZWFyZG93bgotIFtIaWdo XSB1c2I6IGR3YzM6IHJvY2tjaGlwOiB1bmJhbGFuY2VkIHBtX3J1bnRpbWVfcHV0IHdoZW4gUE0g ZGlzYWJsZWQKLSBbSGlnaF0gdXNiOiBkd2MzOiBoYXJkd2FyZSBhYm9ydCBkdWUgdG8gbGF0ZSBQ SFkgY2FsbGJhY2sgdW5yZWdpc3RyYXRpb24KLS0KCmNvbW1pdCBkNDRlNTY0NWY5MjUyMDk0NjJm MWJmNjY2Zjk1ZWI3OWFkMWQ1MGYxCkF1dGhvcjogU2ViYXN0aWFuIFJlaWNoZWwgPHNlYmFzdGlh bi5yZWljaGVsQGNvbGxhYm9yYS5jb20+Cgp1c2I6IGR3YzM6IHJvY2tjaGlwOiBmaXggVVNCLUMg cmVjb25uZWN0IGluIGdhZGdldCBtb2RlCgpXaGVuIFVTQi1DIGlzIGNvbmZpZ3VyZWQgaW4gZ2Fk Z2V0IG1vZGUgYW5kIHRoZSBjYWJsZSBpcyB1bnBsdWdnZWQKdGhlIFVTQiBjb250cm9sbGVyIGlz IHN1c3BlbmRlZC4gQWZ0ZXIgcGx1Z2dpbmcgaW4gdGhlIGNhYmxlIGFnYWluLAp0aGUgVVNCIGNv bnRyb2xsZXIgc3RheXMgc3VzcGVuZGVkIGFuZCB0aHVzIHRoZSBwb3J0IHN0YXR1cyByZW1haW5z Cm5vdC1hdHRhY2hlZC4KClRoaXMgY29tbWl0IGZpeGVzIHRoaXMgYnkgaW5mb3JtaW5nIHRoZSBV U0IgY29yZSBhYm91dCBWQlVTIHVwZGF0ZXMgd2hlbgp0aGUgUEhZIG1vZGUgY2hhbmdlcy4KCj4g ZGlmZiAtLWdpdCBhL2RyaXZlcnMvdXNiL2R3YzMvZHdjMy1yb2NrY2hpcC5jIGIvZHJpdmVycy91 c2IvZHdjMy9kd2MzLXJvY2tjaGlwLmMKPiBpbmRleCAxZjMyMTUwY2FhMDkwLi41Y2I1ZmVlYzhi ZDRiIDEwMDY0NAo+IC0tLSBhL2RyaXZlcnMvdXNiL2R3YzMvZHdjMy1yb2NrY2hpcC5jCj4gKysr IGIvZHJpdmVycy91c2IvZHdjMy9kd2MzLXJvY2tjaGlwLmMKWyAuLi4gXQo+IEBAIC0yNSw4ICsy NSwxNyBAQCBzdHJ1Y3QgZHdjM19ya19waHlfbmIgewo+ICBzdHJ1Y3QgZHdjM19yb2NrY2hpcCB7 Cj4gIAlzdHJ1Y3QgZHdjMwkJZHdjOwo+ICAJdTgJCQlwaHlfcmVzZXRfYWN0aXZlOwo+ICsJZW51 bSB1c2Jfcm9sZQkJcm9sZTsKPiAgfTsKPiAgCj4gK3N0YXRpYyB2b2lkIGR3YzNfcm9ja2NoaXBf dmJ1c19oYW5kbGVyKHN0cnVjdCBkd2MzICpkd2MsIGJvb2wgcHJlc2VudCkKPiArewo+ICsJaWYg KCFkd2MtPmdhZGdldCB8fCAhZHdjLT5nYWRnZXRfZHJpdmVyKQo+ICsJCXJldHVybjsKPiArCj4g Kwl1c2JfdWRjX3ZidXNfaGFuZGxlcihkd2MtPmdhZGdldCwgcHJlc2VudCk7Cj4gK30KCltTZXZl cml0eTogSGlnaF0KRG9lcyB0aGlzIGxvY2tsZXNzIGNoZWNrIG9mIGR3Yy0+Z2FkZ2V0IGFsbG93 IGEgVE9DVE9VIHJhY2U/CgpUaGUgaGFuZGxlciBpcyBpbnZva2VkIGJ5IGR3YzNfcm9ja2NoaXBf cGh5X3ByZV9yZXNldCgpLCB3aGljaCBpcyBhIFBIWQpyZXNldCBjYWxsYmFjayB0aGF0IGNhbiBy dW4gY29uY3VycmVudGx5IChmb3IgaW5zdGFuY2UsIGZyb20gRFAgaG90cGx1ZwpldmVudHMgaW4g dGhlIHJvY2tjaGlwLXVzYmRwIGRyaXZlciB2aWEgcmtfdWRwaHlfZHBfcGh5X3Bvd2VyX29uKS4K CklmIHRoZSBQSFkgcmVzZXQgcnVucyBjb25jdXJyZW50bHkgd2l0aCBkd2MzX2NvcmVfZXhpdF9t b2RlKCksIGNvdWxkIHRoZQpsb2NrbGVzcyBjaGVjayBzdWNjZWVkIGp1c3QgYmVmb3JlIGR3YzNf Z2FkZ2V0X3N0b3AoKSBjbGVhcnMKZHdjLT5nYWRnZXRfZHJpdmVyIGFuZCBkd2MzX2dhZGdldF9l eGl0KCkgZnJlZXMgZHdjLT5nYWRnZXQ/CgpXb3VsZCB0aGlzIGNhdXNlIHRoZSByZXNldCBoYW5k bGVyIHRvIHBhc3MgYSBmcmVlZCBkd2MtPmdhZGdldCB0bwp1c2JfdWRjX3ZidXNfaGFuZGxlcigp LCByZXN1bHRpbmcgaW4gYSB1c2UtYWZ0ZXItZnJlZT8KCldvdWxkIHNlcmlhbGl6aW5nIHRoZSBj aGVjayBhbmQgY2FsbCB3aXRoaW4gc3Bpbl9sb2NrX2lycXNhdmUoJmR3Yy0+bG9jaywKZmxhZ3Mp IHByZXZlbnQgdGhpcyByYWNlIHNhZmVseT8KCj4gKwo+ICBzdGF0aWMgaW50IGR3YzNfcm9ja2No aXBfcGh5X3ByZV9yZXNldChzdHJ1Y3QgZHdjM19yb2NrY2hpcCAqZHdjX3JrLCBpbnQgcG9ydCkK PiAgewo+ICAJc3RydWN0IGR3YzMgKmR3YyA9ICZkd2NfcmstPmR3YzsKWyAuLi4gXQo+IEBAIC01 MSw2ICs2MCw4IEBAIHN0YXRpYyBpbnQgZHdjM19yb2NrY2hpcF9waHlfcHJlX3Jlc2V0KHN0cnVj dCBkd2MzX3JvY2tjaGlwICpkd2NfcmssIGludCBwb3J0KQo+ICAJaWYgKCFyZXQpCj4gIAkJcmV0 dXJuIHJldDsKCltTZXZlcml0eTogSGlnaF0KV2hlbiBydW50aW1lIFBNIGlzIGRpc2FibGVkLCBw bV9ydW50aW1lX2dldF9pZl9hY3RpdmUoZHdjLT5kZXYpIHJldHVybnMKLUVJTlZBTCBhbmQgZG9l cyBub3QgaW5jcmVtZW50IHVzYWdlX2NvdW50LiBTaW5jZSB0aGUgYGlmICghcmV0KWAgY2hlY2sK ZXZhbHVhdGVzIHRvIGZhbHNlIGZvciAtRUlOVkFMLCB3aWxsIGV4ZWN1dGlvbiBjb250aW51ZSBh bmQgbGVhZCB0byBhbgp1bmJhbGFuY2VkIHBtX3J1bnRpbWVfcHV0X2F1dG9zdXNwZW5kKCkgbGF0 ZXI/CgpBZGRpdGlvbmFsbHksIGRvZXMgdGhpcyBQTSBjaGVjayBleHBvc2UgdGhlIGRyaXZlciB0 byBhbiBhc3luY2hyb25vdXMKZXh0ZXJuYWwgYWJvcnQgKGtlcm5lbCBwYW5pYykgZHVlIHRvIGxh dGUgUEhZIGNhbGxiYWNrIHVucmVnaXN0cmF0aW9uPwoKRHVyaW5nIGR3YzNfY29yZV9yZW1vdmUo KSwgY2xvY2tzIGFyZSBkaXNhYmxlZCB2aWEgZHdjM19jb3JlX2V4aXQoKSB3aGlsZQp0aGUgUE0g c3RhdGUgcmVtYWlucyBSUE1fQUNUSVZFIHVudGlsIHBtX3J1bnRpbWVfZGlzYWJsZSgpIGlzIGNh bGxlZC4KQmVjYXVzZSB0aGUgUEhZIGNhbGxiYWNrIGlzIHVucmVnaXN0ZXJlZCB2aWEgZGV2cmVz ICh3aGljaCBydW5zIGFmdGVyCnJlbW92ZSBjb21wbGV0ZXMpLCBjb3VsZCBhIGNvbmN1cnJlbnQg RFAgUEhZIHBvd2VyLW9uIGV4ZWN1dGUgdGhpcwpwcmUtcmVzZXQgZnVuY3Rpb24gYW5kIGFjY2Vz cyB1bmNsb2NrZWQgaGFyZHdhcmUgcmVnaXN0ZXJzPwoKPiAgCj4gKwlkd2MzX3JvY2tjaGlwX3Zi dXNfaGFuZGxlcihkd2MsIGZhbHNlKTsKPiArCj4gIAkvKgo+ICAJICogQXNzZXJ0IFVTQjMgUEhZ IHNvZnQgcmVzZXQgd2l0aGluIERXQzMgYmVmb3JlIHRoZSBleHRlcm5hbAo+ICAJICogUEhZIHJl c2V0cy4gVGhpcyBkaXNjb25uZWN0cyB0aGUgUElQRSBpbnRlcmZhY2UsIHByZXZlbnRpbmcKWyAu Li4gXQo+IEBAIC04Nyw2ICsxMDAsOCBAQCBzdGF0aWMgaW50IGR3YzNfcm9ja2NoaXBfcGh5X3Bv c3RfcmVzZXQoc3RydWN0IGR3YzNfcm9ja2NoaXAgKmR3Y19yaywgaW50IHBvcnQpCj4gIAlkd2Mz X3dyaXRlbChkd2MsIERXQzNfR1VTQjNQSVBFQ1RMKHBvcnQpLCByZWcpOwo+ICAJc3Bpbl91bmxv Y2tfaXJxcmVzdG9yZSgmZHdjLT5sb2NrLCBmbGFncyk7Cj4gIAo+ICsJZHdjM19yb2NrY2hpcF92 YnVzX2hhbmRsZXIoZHdjLCBnYWRnZXRfbW9kZSk7Cj4gKwo+ICAJcG1fcnVudGltZV9wdXRfYXV0 b3N1c3BlbmQoZHdjLT5kZXYpOwoKW1NldmVyaXR5OiBIaWdoXQpTaW5jZSB0aGlzIHBtX3J1bnRp bWVfcHV0X2F1dG9zdXNwZW5kKCkgaXMgZXhlY3V0ZWQgdW5jb25kaXRpb25hbGx5LCB3aWxsCml0 IGRlY3JlbWVudCB0aGUgdXNhZ2VfY291bnQgZXZlbiB3aGVuIHBtX3J1bnRpbWVfZ2V0X2lmX2Fj dGl2ZSgpCnByZXZpb3VzbHkgcmV0dXJuZWQgLUVJTlZBTD8KCkNvdWxkIHRoaXMgZmFsc2VseSBk cm9wIHRoZSB1c2FnZSBjb3VudCBmcm9tID4gMCB0byAwIChzdGVhbGluZyBhIHJlZmVyZW5jZQpm cm9tIGFub3RoZXIgc3Vic3lzdGVtIGNvbXBvbmVudCkgYW5kIGxlYWQgdG8gdGhlIGRldmljZSBi ZWluZyBydW50aW1lCnN1c3BlbmRlZCB3aGlsZSBhY3RpdmVseSBpbiB1c2U/Cgo+ICAKPiAgCXJl dHVybiAwOwoKLS0gClNhc2hpa28gQUkgcmV2aWV3IMK3IGh0dHBzOi8vc2FzaGlrby5kZXYvIy9w YXRjaHNldC8yMDI2MTAxNi1iNC1yb2NrY2hpcC1kd2MzLXJvY2tjaGlwLWdsdWUtdjE3LTAtODc2 Zjk2ODkzZTJmQGNvbGxhYm9yYS5jb20/cGFydD03CgotLSAKbGludXgtcGh5IG1haWxpbmcgbGlz dApsaW51eC1waHlAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwczovL2xpc3RzLmluZnJhZGVhZC5v cmcvbWFpbG1hbi9saXN0aW5mby9saW51eC1waHkK From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AEF94D9552 for ; Fri, 16 Oct 2026 18:56:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792176968; cv=none; b=kUib31c9olor+D0CDwTzSYufaXyM1BktaD14lhA8rSc0Lo4Z8B92Ezo6WXFE4hqZU9QRrrFqGUhQKT5itpdrwT3ZxvwMntn7D4eXcWNnxf2IxQeFzai4J0Shq6H60UoDtAvpAZ4DOgEl31uuRzslhVxDsIHmunoQHoYu5VA+5JU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792176968; c=relaxed/simple; bh=4cQnFyct2L/Uhi/WeenSDxO/LFkGkQigfyvoi1J7zG0=; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type: Date; b=B2XrgpZ57op/sojpAkZznd9xJ8JF7f4PQKxrXLwSVmY1CeGrlU8SoLiFkYTaVfDE1wcHr2PTWMAMHW3L6QsqMdljofCHAfUDKKOzwwNd6rcMbreOpb8DtrLeKNjRhVLn3z4HAb2yfKTKs0vgn05x/8wLp3yV4N8YwRKz5RlJ66Q= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=g8XBZvJQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="g8XBZvJQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21D0A1F000C4; Fri, 16 Oct 2026 18:56:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1792176966; bh=/kVyelCjWMtE8WreHFwMKW5pUBsXLrz4jQpxpGQX+Mg=; h=From:Subject:Reply-To:To:Cc:In-Reply-To:References:Date; b=g8XBZvJQ4LyfXHhoysMSWtWmoqRCs7ms5FOZMv2TR/ZN/Qyen4xqsqDcMGbQEvFKP jvLniECB6d9/xSQSBYrmBaCvd6lkNbxQDMzIaPMwH/mNPDsNEZSRaBhOof28YQ+ty/ 88lOE0kpaWTeM5btmrEnJicH7JXWlByA8JcCdSwHLh5sECK6j7q5MtMYDmKECcJCqp 6ivvNAt7x/WbiP/VjKXvpkZ+JMCbiFDTNhuOBd1CSlCuLrFNO945rY9lTa85taaav9 g1SYNHx6fqiG5HLYW9gfkiBhaWMN+8v3LqT8q1nETZBkwizdfeFpYl5HBbp8oUGuZn J5KAibDYWiv0Q== Message-ID: From: sashiko-bot@kernel.org Subject: Re: [PATCH v17 7/7] usb: dwc3: rockchip: fix USB-C reconnect in gadget mode Reply-To: sashiko-reviews@lists.linux.dev To: "Sebastian Reichel" Cc: linux-usb@vger.kernel.org, linux-phy@lists.infradead.org, vkoul@kernel.org, neil.armstrong@linaro.org, olteanv@gmail.com In-Reply-To: <20261016-b4-rockchip-dwc3-rockchip-glue-v17-7-876f96893e2f@collabora.com> References: <20261016-b4-rockchip-dwc3-rockchip-glue-v17-0-876f96893e2f@collabora.com> <20261016-b4-rockchip-dwc3-rockchip-glue-v17-7-876f96893e2f@collabora.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Fri, 16 Oct 2026 18:56:05 +0000 Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Thank you for your contribution! Sashiko AI review found 3 potential issue(= s) to consider: - [High] usb: dwc3: rockchip: UAF in vbus handler during gadget teardown - [High] usb: dwc3: rockchip: unbalanced pm_runtime_put when PM disabled - [High] usb: dwc3: hardware abort due to late PHY callback unregistration -- commit d44e5645f925209462f1bf666f95eb79ad1d50f1 Author: Sebastian Reichel usb: dwc3: rockchip: fix USB-C reconnect in gadget mode When USB-C is configured in gadget mode and the cable is unplugged the USB controller is suspended. After plugging in the cable again, the USB controller stays suspended and thus the port status remains not-attached. This commit fixes this by informing the USB core about VBUS updates when the PHY mode changes. > diff --git a/drivers/usb/dwc3/dwc3-rockchip.c b/drivers/usb/dwc3/dwc3-roc= kchip.c > index 1f32150caa090..5cb5feec8bd4b 100644 > --- a/drivers/usb/dwc3/dwc3-rockchip.c > +++ b/drivers/usb/dwc3/dwc3-rockchip.c [ ... ] > @@ -25,8 +25,17 @@ struct dwc3_rk_phy_nb { > struct dwc3_rockchip { > struct dwc3 dwc; > u8 phy_reset_active; > + enum usb_role role; > }; > =20 > +static void dwc3_rockchip_vbus_handler(struct dwc3 *dwc, bool present) > +{ > + if (!dwc->gadget || !dwc->gadget_driver) > + return; > + > + usb_udc_vbus_handler(dwc->gadget, present); > +} [Severity: High] Does this lockless check of dwc->gadget allow a TOCTOU race? The handler is invoked by dwc3_rockchip_phy_pre_reset(), which is a PHY reset callback that can run concurrently (for instance, from DP hotplug events in the rockchip-usbdp driver via rk_udphy_dp_phy_power_on). If the PHY reset runs concurrently with dwc3_core_exit_mode(), could the lockless check succeed just before dwc3_gadget_stop() clears dwc->gadget_driver and dwc3_gadget_exit() frees dwc->gadget? Would this cause the reset handler to pass a freed dwc->gadget to usb_udc_vbus_handler(), resulting in a use-after-free? Would serializing the check and call within spin_lock_irqsave(&dwc->lock, flags) prevent this race safely? > + > static int dwc3_rockchip_phy_pre_reset(struct dwc3_rockchip *dwc_rk, int= port) > { > struct dwc3 *dwc =3D &dwc_rk->dwc; [ ... ] > @@ -51,6 +60,8 @@ static int dwc3_rockchip_phy_pre_reset(struct dwc3_rock= chip *dwc_rk, int port) > if (!ret) > return ret; [Severity: High] When runtime PM is disabled, pm_runtime_get_if_active(dwc->dev) returns -EINVAL and does not increment usage_count. Since the `if (!ret)` check evaluates to false for -EINVAL, will execution continue and lead to an unbalanced pm_runtime_put_autosuspend() later? Additionally, does this PM check expose the driver to an asynchronous external abort (kernel panic) due to late PHY callback unregistration? During dwc3_core_remove(), clocks are disabled via dwc3_core_exit() while the PM state remains RPM_ACTIVE until pm_runtime_disable() is called. Because the PHY callback is unregistered via devres (which runs after remove completes), could a concurrent DP PHY power-on execute this pre-reset function and access unclocked hardware registers? > =20 > + dwc3_rockchip_vbus_handler(dwc, false); > + > /* > * Assert USB3 PHY soft reset within DWC3 before the external > * PHY resets. This disconnects the PIPE interface, preventing [ ... ] > @@ -87,6 +100,8 @@ static int dwc3_rockchip_phy_post_reset(struct dwc3_ro= ckchip *dwc_rk, int port) > dwc3_writel(dwc, DWC3_GUSB3PIPECTL(port), reg); > spin_unlock_irqrestore(&dwc->lock, flags); > =20 > + dwc3_rockchip_vbus_handler(dwc, gadget_mode); > + > pm_runtime_put_autosuspend(dwc->dev); [Severity: High] Since this pm_runtime_put_autosuspend() is executed unconditionally, will it decrement the usage_count even when pm_runtime_get_if_active() previously returned -EINVAL? Could this falsely drop the usage count from > 0 to 0 (stealing a reference from another subsystem component) and lead to the device being runtime suspended while actively in use? > =20 > return 0; --=20 Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261016-b4-rockchi= p-dwc3-rockchip-glue-v17-0-876f96893e2f@collabora.com?part=3D7