Re: [PATCH v5 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Unchecked regmap_read return value in ma35_role_sw_get leads to the use of uninitialized stack memory, potentially leaking 1 bit of kernel stack data to userspace.
--

commit 93b1ad8e66488910d7c296427cb3acbec813e0a2
Author: Joey Lu <a0987203069@gmail.com>

phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support

This patch extends the Nuvoton MA35D1 USB 2.0 PHY driver to manage both PHY0
and PHY1 ports using a unified init callback. It updates the reset and clock
polling sequences and adds a read-only USB role switch for PHY0 to expose
the active role to userspace.

> diff --git a/drivers/phy/nuvoton/phy-ma35d1-usb2.c b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> index 9a459b700ed48..2c60be0ee50f7 100644
> --- a/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> +++ b/drivers/phy/nuvoton/phy-ma35d1-usb2.c

[ ... ]

> +static enum usb_role ma35_role_sw_get(struct usb_role_switch *sw)
> +{
> +	struct ma35_usb_phy *p = usb_role_switch_get_drvdata(sw);
> +	u32 val;
> +
> +	regmap_read(p->sysreg, MA35_SYS_PWRONOTP, &val);
> +
> +	return (val & PWRONOTP_USBP0ID) ? USB_ROLE_HOST : USB_ROLE_DEVICE;
> +}

[Severity: Medium]
Could this lead to the use of uninitialized stack memory? If the call to
regmap_read() fails, the variable val will remain uninitialized. When
evaluated in the return statement, it would return a USB role based on stack
garbage.

Since this role is exposed to userspace via the sysfs role switch interface,
could this potentially leak one bit of kernel stack information to userspace
if the MMIO read happens to fail? Should the return value of regmap_read()
be checked before evaluating val?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914031859.385224-1-a0987203069@gmail.com?part=3