Re: [PATCH v12 24/24] scsi: ufs: mediatek: Add MT8196 compatible, update copyright

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Kernel panic in ufs_mtk_09v_on() and ufs_mtk_09v_off() error paths due to missing NULL checks on host->reg_avdd09.
--

commit 3e1ab912b68bb7adad59190a0d213096bb41991c
Author: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>

scsi: ufs: mediatek: Add MT8196 compatible, update copyright

The MT8196's UFS controller has a new compatible. Add the necessary
struct definitions to support it.

> THe MT8196's UFS controller has a new compatible. Add the necessary
  ^^^
[Severity: Low]
This isn't a bug, but there's a typo (THe) in the commit message.

> diff --git a/drivers/ufs/host/ufs-mediatek.c b/drivers/ufs/host/ufs-mediatek.c
> index ef8924704c902..ceb52c40d266c 100644
> --- a/drivers/ufs/host/ufs-mediatek.c
> +++ b/drivers/ufs/host/ufs-mediatek.c

[ ... ]

> @@ -2264,10 +2270,18 @@ static const struct ufs_mtk_soc_data mt8192_8195_data = {
>  	.num_reg_names = ARRAY_SIZE(ufs_mtk_regs_avdd12_ckbuf_avdd18),
>  };
>  
> +static const struct ufs_mtk_soc_data mt8196_data = {
> +	.has_avdd09 = true,
> +	.has_avdd09_1 = true,

[Severity: High]
Does enabling has_avdd09_1 introduce a NULL pointer dereference in the error
handling paths for ufs_mtk_09v_on() and ufs_mtk_09v_off()?

If a device tree omits avdd09 but provides avdd09-1, host->reg_avdd09 will
be NULL. In ufs_mtk_09v_on(), the code properly checks if host->reg_avdd09
is valid before enabling it. However, if enabling host->reg_avdd09_1
subsequently fails, the error handler blindly executes:

    regulator_disable(host->reg_avdd09);

without checking if host->reg_avdd09 is NULL.

The core regulator subsystem unconditionally dereferences the struct regulator
pointer when CONFIG_REGULATOR is enabled, which would cause a panic.

The exact same issue appears to exist in ufs_mtk_09v_off(), where it calls:

    regulator_enable(host->reg_avdd09);

unconditionally if disabling avdd09-1 fails.

Since the MT8196 compatible is the first to set has_avdd09_1 = true, does
this make these error paths reachable?

> +	.reg_names = ufs_mtk_regs_avdd12_ckbuf,
> +	.num_reg_names = ARRAY_SIZE(ufs_mtk_regs_avdd12_ckbuf),
> +};
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260914-mt8196-ufs-v12-0-9279d7ef814d@collabora.com?part=24