Re: [PATCH v6 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support - sashiko-bot

From: sashiko-bot@kernel.org
To: "Joey Lu" <a0987203069@gmail.com>
Cc: vkoul@kernel.org, robh@kernel.org, neil.armstrong@linaro.org,
	devicetree@vger.kernel.org, conor+dt@kernel.org,
	olteanv@gmail.com, linux-phy@lists.infradead.org
Subject: Re: [PATCH v6 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support
Date: Tue, 29 Sep 2026 02:16:12 +0000	[thread overview]
Message-ID: <20260929021612.7EB891F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260929020854.1282339-4-a0987203069@gmail.com>

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] phy: nuvoton: uninitialized stack variable usage in ma35_role_sw_get()
--

commit 801a123466a572aa070fd7a885bb27adf3f83110
Author: Joey Lu <a0987203069@gmail.com>

phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support

This commit extends the Nuvoton MA35D1 USB 2.0 PHY driver to manage both
PHY0 and PHY1, handling host and device modes. It introduces a single init
callback instead of separate power_on/power_off callbacks and adds a USB
role switch for PHY0. New device-tree properties for resistor calibration
and over-current polarity are also supported.

> diff --git a/drivers/phy/nuvoton/phy-ma35d1-usb2.c b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> index 9a459b700ed48..547c7d55d8ff4 100644
> --- a/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> +++ b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
[ ... ]
> +static enum usb_role ma35_role_sw_get(struct usb_role_switch *sw)
> +{
> +	struct ma35_usb_phy *p = usb_role_switch_get_drvdata(sw);
> +	u32 val;
> +
> +	regmap_read(p->sysreg, MA35_SYS_PWRONOTP, &val);
> +
> +	return (val & PWRONOTP_USBP0ID) ? USB_ROLE_HOST : USB_ROLE_DEVICE;
> +}

[Severity: Medium]
Does this code use an uninitialized stack variable if regmap_read() fails?

If regmap_read() returns a negative error code, the out-parameter val will
remain uninitialized. The subsequent check of val & PWRONOTP_USBP0ID would
then evaluate uninitialized kernel stack memory.

This could report an unreliable hardware state to the USB role framework and
leak a bit of kernel stack memory to userspace via the sysfs interface.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929020854.1282339-1-a0987203069@gmail.com?part=3

-- 
linux-phy mailing list
linux-phy@lists.infradead.org
https://lists.infradead.org/mailman/listinfo/linux-phy