Re: [PATCH 1/3] ata: sata_dwc_460ex: fix PHY lifecycle ordering on device removal

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:

Pre-existing issues:
- [High] Inverted teardown sequence destroys the legacy DMA controller befo=
re its channels are released, causing a use-after-free and crash during dev=
ice removal and probe error handling.
--

--- Patch [1]: [PATCH 1/3] ata: sata_dwc_460ex: fix PHY lifecycle ordering =
on device removal ---
commit dd1760ffad9026f965244b679ddbacf4ae16f4e6
Author: Rosen Penev <[email protected]>

ata: sata_dwc_460ex: fix PHY lifecycle ordering on device removal

This commit fixes PHY teardown ordering by calling phy_exit() after
phy_power_off() instead of before, ensuring the PHY is properly powered
down prior to destruction. It also adjusts the error handling in
sata_dwc_probe() to clean up legacy DMA resources if activation fails.

> diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
> index 8e3fc713891af..8a1d80ac906a7 100644
> --- a/drivers/ata/sata_dwc_460ex.c
> +++ b/drivers/ata/sata_dwc_460ex.c

[ ... ]

> @@ -1171,29 +1182,26 @@ static int sata_dwc_probe(struct platform_device =
*ofdev)

[ ... ]

>  error_out:
> -	phy_exit(hsdev->phy);
> +#ifdef CONFIG_SATA_DWC_OLD_DMA
> +	if (!device_property_present(dev, "dmas"))
> +		sata_dwc_dma_exit_old(hsdev);

[Severity: High]
This is a pre-existing issue, but does this manual teardown sequence create=
 a
use-after-free for the legacy DMA controller?

By calling sata_dwc_dma_exit_old() here in the probe error path (and
similarly in sata_dwc_remove()), the legacy DMA controller is explicitly
destroyed before the devres unwind actions run.

However, when devres later triggers the ata_host_stop action, it calls
sata_dwc_port_stop(), which does this:

    dmaengine_terminate_sync(hsdevp->chan);
    dma_release_channel(hsdevp->chan);

Since the legacy DMA controller has already been deactivated and removed by
sata_dwc_dma_exit_old(), won't these channel operations in
sata_dwc_port_stop() access the destroyed controller and cause a crash?

> +#endif
>  	return err;
>  }

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260723001208.1469=
[email protected]?part=3D1