Re: [PATCH 3/3] usb: ucsi: ccg: Add support for CYPD6129 (CCG6)

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Incorrect teardown order in ucsi_ccg_remove allows the IRQ handler to execute after ucsi_unregister and ucsi_destroy have freed the ucsi instance and its connectors, leading to a use-after-free vulnerability.
--

commit d51e27a1b01686843b28a09a37b6e7b3a61e453b
Author: Akash Kumar <akash.kumar@oss.qualcomm.com>

usb: ucsi: ccg: Add support for CYPD6129 (CCG6)

This commit adds "cypress,cypd6129" to the UCSI CCG driver match table.
This allows the driver to bind to CCG6-based platforms using this
controller.

> diff --git a/drivers/usb/typec/ucsi/ucsi_ccg.c b/drivers/usb/typec/ucsi/ucsi_ccg.c
> index 199799b319c2a..0695ce348135c 100644
> --- a/drivers/usb/typec/ucsi/ucsi_ccg.c
> +++ b/drivers/usb/typec/ucsi/ucsi_ccg.c
> @@ -1520,6 +1520,7 @@ static void ucsi_ccg_remove(struct i2c_client *client)

[Severity: High]
This is a pre-existing issue, but does the teardown order in ucsi_ccg_remove()
cause a use-after-free of the ucsi instance and its connectors?

Looking at ucsi_ccg_remove():

	ucsi_unregister(uc->ucsi);
	ucsi_destroy(uc->ucsi);
	free_irq(uc->irq, uc);

Because free_irq() is called after ucsi_unregister() and ucsi_destroy(), an
interrupt could fire during the teardown process.

If this happens, the IRQ handler would execute and call ucsi_notify_common(),
which dereferences the already-freed uc->ucsi pointer and accesses the freed
ucsi->connector array.

Should free_irq() be moved before ucsi_unregister() so that any pending IRQ
handlers complete and no new ones are scheduled?

>  
>  static const struct of_device_id ucsi_ccg_of_match_table[] = {
>  		{ .compatible = "cypress,cypd4226", },
> +		{ .compatible = "cypress,cypd6129", },
>  		{ /* sentinel */ }
>  };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260520093902.2064730-1-akash.kumar@oss.qualcomm.com?part=3