Re: [PATCH v10 12/26] scsi: ufs: mediatek: Remove vendor kernel quirks cruft

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Dangling pointer to `phy_dev` in `ufs_mtk_probe()` due to premature `put_device()`.
--

--- Patch [12]: [PATCH v10 12/26] scsi: ufs: mediatek: Remove vendor kernel quirks cruft ---
commit 6a21968869510eaa0eea1b9f7b65e382357ae809
Author: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>

scsi: ufs: mediatek: Remove vendor kernel quirks cruft

Both ufs_mtk_vreg_fix_vcc and ufs_mtk_vreg_fix_vccqx look like they are
vendor kernel hacks to work around existing downstream device trees.
Mainline does not need or want them, so remove them.

> diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
> index a2749e79514c4..e5527969a5e67 100644
> --- a/drivers/ufs/host/ufs-mediatek.c
> +++ b/drivers/ufs/host/ufs-mediatek.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but does dropping the kobject
reference to phy_dev with put_device() leave host->phy_dev as a dangling
pointer?

drivers/ufs/host/ufs-mediatek.c:ufs_mtk_probe() {
	...
		pm_runtime_set_active(phy_dev);
		pm_runtime_enable(phy_dev);
		pm_runtime_get_sync(phy_dev);

		put_device(phy_dev);
		dev_info(dev, "phys node found\n");
	...
	if (phy_node && phy_dev) {
		host = ufshcd_get_variant(hba);
		host->phy_dev = phy_dev;
	}
	...
}

If the PHY platform device is unregistered (for example, via DT overlay removal
or manual sysfs unbind) between the UFS probe and runtime PM transitions,
would dereferencing this pointer later in ufs_mtk_runtime_suspend() or
ufs_mtk_runtime_resume() cause a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260730-mt8196-ufs-v10-0-bc5ecef202dc@collabora.com?part=12