Re: [PATCH v2 03/22] usb: typec: tipd: Register a USB4 port mode for CD321x

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Probe error path fails to cancel the delayed work `update_work`, leading to a Use-After-Free.
--

commit 09cc2bd0cfd69f839367811f9385e5cf074438a8
Author: Sven Peter <sven@kernel.org>

usb: typec: tipd: Register a USB4 port mode for CD321x
    
Register a USB4 mode next to the DP and Thunderbolt alternate modes so
that negotiated USB4 partner modes can be linked to the port. Identify
it using TYPEC_MODE_KIND_USB4 without an SVID or mode index.

> diff --git a/drivers/usb/typec/tipd/core.c b/drivers/usb/typec/tipd/core.c
> index f76f563dc42b8..8c7f93d4270e2 100644
> --- a/drivers/usb/typec/tipd/core.c
> +++ b/drivers/usb/typec/tipd/core.c

[ ... ]

> @@ -1371,6 +1386,8 @@ cd321x_unregister_port(struct tps6598x *tps)
>  	cd321x->port_altmode_dp = NULL;
>  	typec_unregister_altmode(cd321x->port_altmode_tbt);
>  	cd321x->port_altmode_tbt = NULL;
> +	typec_unregister_altmode(cd321x->port_altmode_usb4);
> +	cd321x->port_altmode_usb4 = NULL;
>  	typec_unregister_port(tps->port);
>  }

[Severity: High]
This is a pre-existing issue, but does cd321x_unregister_port() need to
cancel the update_work delayed work?

When probe fails (for example, if devm_request_threaded_irq() fails after
connect queues the work), the error handling path in tps6598x_probe() drops
into this sequence:

drivers/usb/typec/tipd/core.c:tps6598x_probe() {
    ...
err_disconnect:
	tps6598x_disconnect(tps, 0);
err_unregister_port:
	tps->data->unregister_port(tps);
    ...
}

Since this doesn't call cancel_delayed_work_sync(&cd321x->update_work), 
could it leave the asynchronous work scheduled? As devres frees the tps
structure upon probe failure, will cd321x_update_work() dereference freed
memory when the timer expires?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906-b4-apple-soc-tbt-v2-0-1f80085f93fb@kernel.org?part=3