Re: [PATCH 1/3] ata: sata_dwc_460ex: fix PHY lifecycle ordering on device removal

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Inverted teardown sequence destroys the legacy DMA controller before its channels are released, causing a use-after-free and crash during device removal and probe error handling.
--

--- Patch [1]: [PATCH 1/3] ata: sata_dwc_460ex: fix PHY lifecycle ordering on device removal ---
commit dd1760ffad9026f965244b679ddbacf4ae16f4e6
Author: Rosen Penev <rosenp@gmail.com>

ata: sata_dwc_460ex: fix PHY lifecycle ordering on device removal

This commit fixes PHY teardown ordering by calling phy_exit() after
phy_power_off() instead of before, ensuring the PHY is properly powered
down prior to destruction. It also adjusts the error handling in
sata_dwc_probe() to clean up legacy DMA resources if activation fails.

> diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
> index 8e3fc713891af..8a1d80ac906a7 100644
> --- a/drivers/ata/sata_dwc_460ex.c
> +++ b/drivers/ata/sata_dwc_460ex.c

[ ... ]

> @@ -1171,29 +1182,26 @@ static int sata_dwc_probe(struct platform_device *ofdev)

[ ... ]

>  error_out:
> -	phy_exit(hsdev->phy);
> +#ifdef CONFIG_SATA_DWC_OLD_DMA
> +	if (!device_property_present(dev, "dmas"))
> +		sata_dwc_dma_exit_old(hsdev);

[Severity: High]
This is a pre-existing issue, but does this manual teardown sequence create a
use-after-free for the legacy DMA controller?

By calling sata_dwc_dma_exit_old() here in the probe error path (and
similarly in sata_dwc_remove()), the legacy DMA controller is explicitly
destroyed before the devres unwind actions run.

However, when devres later triggers the ata_host_stop action, it calls
sata_dwc_port_stop(), which does this:

    dmaengine_terminate_sync(hsdevp->chan);
    dma_release_channel(hsdevp->chan);

Since the legacy DMA controller has already been deactivated and removed by
sata_dwc_dma_exit_old(), won't these channel operations in
sata_dwc_port_stop() access the destroyed controller and cause a crash?

> +#endif
>  	return err;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723001208.1469323-1-rosenp@gmail.com?part=1