Re: [PATCH] phy: apple: atc: remove stale kernel-doc for removed struct members

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] The patch removes kernel-doc descriptions for `@sw` and `@mux`, falsely claiming the struct members were removed, which introduces new kernel-doc warnings.

Pre-existing issues:
- [High] Type-C switch and mux objects are leaked and cause Use-After-Free on driver unbind or probe error.
--

commit 2c0f305efb460c36ad63bcaef90a04f555e5a65b
Author: Rosen Penev <rosenp@gmail.com>

phy: apple: atc: remove stale kernel-doc for removed struct members
    
The @sw and @mux members were removed from struct apple_atcphy but their
kernel-doc entries remained, causing kernel-doc warnings.

> The @sw and @mux members were removed from struct apple_atcphy but their
> kernel-doc entries remained, causing kernel-doc warnings.

[Severity: Low]
Are these members actually removed? The struct definition still contains
both sw and mux. Removing their kernel-doc comments while the members remain
will introduce new warnings about missing descriptions rather than fixing them.

> diff --git a/drivers/phy/apple/atc.c b/drivers/phy/apple/atc.c
> index e9d106f135c51..37be29d855cd9 100644
> --- a/drivers/phy/apple/atc.c
> +++ b/drivers/phy/apple/atc.c
> @@ -585,8 +585,6 @@ struct atcphy_mode_configuration {
>   * @phys.dp: DisplayPort PHY instance
>   * @phy_provider: PHY provider instance
>   * @rcdev: Reset controller device
> - * @sw: Type-C switch instance
> - * @mux: Type-C mux instance
>   * @lock: Mutex for synchronizing register access across PHY, Type-C switch/mux and reset controller
>   */
>  struct apple_atcphy {

[Severity: High]
This is a pre-existing issue, but do we leak the Type-C switch and mux objects
on probe error or driver unbind?

Looking at atcphy_probe_switch() and atcphy_probe_mux(), they register the
devices but discard the pointers:

	return PTR_ERR_OR_ZERO(typec_switch_register(atcphy->dev, &sw_desc));

Since these aren't devres-managed, the pointers must be saved to properly call
typec_switch_unregister() and typec_mux_unregister() on teardown.

If the driver is unbound or probe fails later, the devres-managed atcphy context
is freed. The registered switch and mux still retain a pointer to this freed
memory in their drvdata. Later calls like atcphy_mux_set() will dereference it:

	struct apple_atcphy *atcphy = typec_mux_get_drvdata(mux);

	guard(mutex)(&atcphy->lock);

Could this result in a use-after-free?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608053525.12354-1-rosenp@gmail.com?part=1

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy