From: sashiko-bot@kernel.org
To: hyunjungg <hj351016@gmail.com>
Cc: linux-phy@lists.infradead.org, vkoul@kernel.org,
neil.armstrong@linaro.org, olteanv@gmail.com,
wsa+renesas@sang-engineering.com
Subject: Re: [PATCH] phy: rcar-gen3-usb2: cancel OTG work on unbind to avoid use-after-free
Date: Mon, 09 Nov 2026 09:46:47 +0000 [thread overview]
Message-ID: <sashiko-outbox-204741@kernel.org> (raw)
In-Reply-To: <20261109091633.1430331-1-hj351016@gmail.com>
Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] phy: rcar-gen3-usb2: Fixes tag cites 2b38543c8db1 instead of
c14f8a4032ef
--
commit 897082e52850cdedb7797770d4fb9656cd7713ad
Author: Hyunjung Ko <hj351016@gmail.com>
> phy: rcar-gen3-usb2: cancel OTG work on unbind to avoid use-after-free
>
> The OTG role/VBUS interrupt (rcar_gen3_phy_usb2_irq) and the role sysfs
> attribute schedule channel->work (rcar_gen3_phy_usb2_work), whose handler
> dereferences the channel (ch->extcon). The channel is devm-allocated, so
> it is freed at unbind, but nothing cancels channel->work:
> rcar_gen3_phy_usb2_remove() only drops the role sysfs file. A work
> scheduled just before unbind can run after the channel has been freed, a
> use-after-free.
>
> Cancel the work via devm, registered before the interrupt is requested so
> that on unbind devm frees the interrupt first (no new work can be
> scheduled) and then runs the cancel action before the channel is freed.
>
> Fixes: 2b38543c8db1 ("phy: rcar-gen3-usb2: add extcon support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
[Severity: Low]
Should the Fixes tag reference c14f8a4032ef ("phy: rcar-gen3-usb2: fix
mutex_lock calling in interrupt") instead? Commit 2b38543c8db1 ("phy:
rcar-gen3-usb2: add extcon support") called extcon_set_cable_state_()
synchronously, whereas c14f8a4032ef ("phy: rcar-gen3-usb2: fix mutex_lock
calling in interrupt") introduced channel->work and
rcar_gen3_phy_usb2_work() without canceling the work on unbind.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261109091633.1430331-1-hj351016@gmail.com?part=1
--
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy
prev parent reply other threads:[~2026-11-09 9:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-09 9:16 [PATCH] phy: rcar-gen3-usb2: cancel OTG work on unbind to avoid use-after-free hyunjungg
2026-11-09 9:16 ` hyunjungg
2026-11-09 9:46 ` sashiko-bot [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-204741@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=hj351016@gmail.com \
--cc=linux-phy@lists.infradead.org \
--cc=neil.armstrong@linaro.org \
--cc=olteanv@gmail.com \
--cc=sashiko-reviews@lists.linux.dev \
--cc=vkoul@kernel.org \
--cc=wsa+renesas@sang-engineering.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.