Re: [PATCH v2 03/14] arm64: dts: qcom: ipq5018: Add USB Super-Speed PHY node

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing `platform_set_drvdata()` in the PHY driver probe function leads to a NULL pointer dereference on driver removal.
--

--- Patch [3]: [PATCH v2 03/14] arm64: dts: qcom: ipq5018: Add USB Super-Speed PHY node ---
commit 97eadd80983348dbdd8dbea710c772858c61ccf6
Author: George Moussalem <[email protected]>

arm64: dts: qcom: ipq5018: Add USB Super-Speed PHY node

Add USB Super-Speed UNIPHY node and populate the USB DT clock on the GCC
node for the GCC to gate the PIPE clock supplied by the USB3 PHY.

> diff --git a/arch/arm64/boot/dts/qcom/ipq5018.dtsi b/arch/arm64/boot/dts/qcom/ipq5018.dtsi
> --- a/arch/arm64/boot/dts/qcom/ipq5018.dtsi
> +++ b/arch/arm64/boot/dts/qcom/ipq5018.dtsi
> @@ -179,6 +179,23 @@ usbphy0: phy@5b000 {
>  			status = "disabled";
>  		};
>  
> +		usbphy1: phy@5d000 {
> +			compatible = "qcom,ipq5018-uniphy-usb-ss-phy";

[Severity: High]
Does enabling this PHY expose a NULL pointer dereference in the driver upon
removal?

Looking at the driver for this PHY in
drivers/phy/qualcomm/phy-qcom-uniphy-usb-ss-22ull.c, the
qcom_uniphy_usb_probe() function allocates the uniphy state but fails to save
it to the platform device:

drivers/phy/qualcomm/phy-qcom-uniphy-usb-ss-22ull.c:qcom_uniphy_usb_probe() {
    ...
	phy_set_drvdata(uniphy->phy, uniphy);

	phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
    ...
}

When the driver is unbound, qcom_uniphy_usb_remove() retrieves a NULL pointer:

drivers/phy/qualcomm/phy-qcom-uniphy-usb-ss-22ull.c:qcom_uniphy_usb_remove() {
	struct uniphy_usb *uniphy = platform_get_drvdata(pdev);

	qcom_uniphy_usb_mux_select(uniphy, false);
}

This NULL pointer is then passed to qcom_uniphy_usb_mux_select(), causing a
crash.

Should a fix adding platform_set_drvdata(pdev, uniphy) be included to prevent
unbinding this device from causing a kernel oops?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=3

-- 
linux-phy mailing list
[email protected]
https://lists.infradead.org/mailman/listinfo/linux-phy