From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 600DA431E69 for ; Mon, 20 Jul 2026 14:53:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784559223; cv=none; b=nAmF/I4m0hX8lXiKkhIpldWUgNLY1Kq9GOr7h+s24IKQIV/gJxAkEohev+guCPiPl/q7LfrYDVkg5+qgOLSebQudmKEJB8wjwmVE2VbcJoFdUAg6w6pD9f+acWBE5F+yN7zbiI/GRGSBJ8aOo9BMNJv5r/rDxuDsXI6G+zTR+fU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784559223; c=relaxed/simple; bh=kEFKGUoElhkuV1SIhUE3nbBGRr9taBnPmKBOso2I/E8=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=TUQcLvZV5G/1QP+XZV877lCjMUfBomsc8onp0s4F99w33AnXuLvuUhXKUXtfr+MvObn+/w8GaaGBAxkBs1hWwsWWT8SriyuBIsu0FdbtRlvTMVXqtCzVMOi+0WHte2wm5vJah35eGzt8JwUapJ78vuJdiH83raHF8hjd9wMCQ5g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=hkqBA2iw; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=A4CAMsz0; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="hkqBA2iw"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="A4CAMsz0" Received: from pps.filterd (m0279863.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDqanA2837031 for ; Mon, 20 Jul 2026 14:53:41 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= L0DjVqpTkuQJo94lpey+cOup2FTxJcwHBbDODt+Htk0=; b=hkqBA2iwVJV91ZFM ht0X7DIXqERCapwkg40bDZ+vs0XyK7uXEWnCfvImyCehkDi/m9fyAIJXTvEqav07 dcOLD9vvVL7VqcqNpwrlKY1ifyynSvWyh1D5ofYrdhKvY2wp/fz7x4rfpFpluDPJ E5hZ8Dku2bhA2PtkqdyDBuSiT2zBjDbPS7B4AFp2YOzI+9FMbRzDQ18GPlQvZf/m kh+NjjBRtL6wNJarWhDo4mDuVJNhlnQzqJfn/BAHLSWgtTtEvtUqF1ALccxiDD0A 81UevLP1r2mAeIBMmpzjTk7M0j5eF8Rv0G2KeNDa+pn6n3kITbKAn5w8na9kokpO mY2x2g== Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fhfvxhsn3-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 20 Jul 2026 14:53:41 +0000 (GMT) Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-51c12e43b98so200597761cf.1 for ; Mon, 20 Jul 2026 07:53:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784559221; x=1785164021; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=L0DjVqpTkuQJo94lpey+cOup2FTxJcwHBbDODt+Htk0=; b=A4CAMsz0SQ77t6JDTJhIg5u96rh9KaAz4Aw9W+UCxTZSeFNDbcSwLx9S7/nDTeo0X0 1YbLnvI2mbj9pqd3NJjm0BBVAK3idfkaTxbZepeaApDhiZzFlXNDaF3S8iH9ch6d2Ls6 ppon5ODvPt7np8+8NfWqfZzGfPpyq0BWbyDutkrdrezMViVJHGFvgtp9fDu9YBbqKkEq BScql5U2NJfDCu+KxSICoR/MLsSg/G/aXbwHjrr0bTdumX5jAqJ8bQCf9qSSRoYLFGo5 v7lVDMEh+3lfZTyzU77/3WSBTeBK/sHADCGgS2opFjDacbVrL7WE+pTO30+Z/+AIgqOp BH5w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784559221; x=1785164021; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=L0DjVqpTkuQJo94lpey+cOup2FTxJcwHBbDODt+Htk0=; b=sgDiuHkJYuFsPt54coVpE6a1PUg4UaMWRtfE+zF7MmlhE3RTZkMqart4yABCRYBPDJ Rb+gx+1hhagA9iJowVJCM4WrMh+LOJ2l8JmPoK76wX4msuKW9ZmMV/UIDKdgMfIwgccR Cda2cJgwPNdnsmuwNG24LNNMVZkVauybunhysr/lwUNVxdumf5Pk+5H79Vv7FMEl7tRz f4Z0gksXsqxxkDlD1lfjJCxcRwi3IJbgyDS8NeEROf0QMmxfMGHpe5eG+KEd5JWjQE/X K+bjSYM592kHxEK2d+iM7anu7YhiWefo/XhHGfEhVZb4+mc+205HeIJWuIfGE8qbw50L 6wSg== X-Forwarded-Encrypted: i=1; AHgh+RrX6U3qNBoIcLQVMSaly7XYv6CFZoDPcvNnFMwTCNn+7TO4oNPjQAeVk6bTttVcYSneCM6cbzr2OvJ0mjU=@vger.kernel.org X-Gm-Message-State: AOJu0YwX+dDAeH9H5U+C8VjYroZHzjCu9JB6hGW/aHhenq4V66EyKqt+ IVvAW/MbnMyBM8iCrnqvmKuIhESn+rDftYSBuou+FcseMIc1PslDI04YvI+oXIDiGBOpS/hkC3+ fPKQq/zE0BU8db131XXgsHJMhe6zSsuW2cV8FtQxA85JNqxO1JsK/GL3zPqdUvOVsaUI= X-Gm-Gg: AfdE7clKVXtNQI6tSmOtbco8yHOmFnelEsJ8o+MEl8tJnECkEiQ2eFaVYJqvtEyxfk/ 5J2LEs82Nf9PlaiE/Kwf3dSXccM7ajGmyNWgbktI8CZSuIxaew1DtDQGMfLSLPBZMygKSFaLb7h 279K0MkymYf7U6BIMZomOjSu22IkyeVwIs0q8vEStfq07r7fUh1lKMfEjPsJ6zxzgg5MxGNAKET LpGvWP0FCw5bljsF+3n22o0rVcLGWwtXkjc28UEyVMCcc041JAYqgItZWVFzjJx8RufBHaVWQdZ h+AK3h0PsQqZmv4Jc2UwETY+yauN0OU8wdzUNfHx+oWoLeDS6eRwmrwX/B+qUG6YaNU4imOA+Px tOcHM1apo9Z1aqNFB629JxJImKSUtDRpVrd9KVZV8kZwwoHjjBNorQVbuRvPJ9Y5mFcoMsHDhbF vJBxuhHNjuGeSIbx899rJmCE5OPUw7qfI/rSS7sJpOEcwlTt4+X08= X-Received: by 2002:a05:622a:1f91:b0:516:e152:7a59 with SMTP id d75a77b69052e-5213e08256bmr137157431cf.42.1784559220328; Mon, 20 Jul 2026 07:53:40 -0700 (PDT) X-Received: by 2002:a05:622a:1f91:b0:516:e152:7a59 with SMTP id d75a77b69052e-5213e08256bmr137156911cf.42.1784559219566; Mon, 20 Jul 2026 07:53:39 -0700 (PDT) Received: from QCOM-eG0v1AUPpu.na.qualcomm.com ([2a01:e0a:830:450:751c:d61c:c91:60dd]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-69e7000c3e2sm4800215a12.30.2026.07.20.07.53.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 07:53:37 -0700 (PDT) From: Loic Poulain Date: Mon, 20 Jul 2026 16:53:32 +0200 Subject: [PATCH v4 3/4] phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260720-qcom-usb-phy-fix-null-v4-3-4d2a0f06d53a@oss.qualcomm.com> References: <20260720-qcom-usb-phy-fix-null-v4-0-4d2a0f06d53a@oss.qualcomm.com> In-Reply-To: <20260720-qcom-usb-phy-fix-null-v4-0-4d2a0f06d53a@oss.qualcomm.com> To: Vinod Koul , Neil Armstrong , Dmitry Baryshkov , Wesley Cheng Cc: linux-arm-msm@vger.kernel.org, linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org, Abel Vesa , Loic Poulain X-Mailer: b4 0.14.2 X-Authority-Analysis: v=2.4 cv=HKLz0Itv c=1 sm=1 tr=0 ts=6a5e3675 cx=c_pps a=WeENfcodrlLV9YRTxbY/uA==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yOCtJkima9RkubShWh1s:22 a=EUspDBNiAAAA:8 a=PcYcMbZi39MCwOMHHM8A:9 a=QEXdDO2ut3YA:10 a=kacYvNCVWA4VmyqE58fU:22 X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE2NSBTYWx0ZWRfX6HhykxU6n3qQ 4uVA8PDahcbPhUkfpeLEhG7Me2c9GQvA5btqIvAo6X4XQE1XV26mkqusC27ETMAflliCubGXRNq Wssd6B/RNddVCoYXqeE28YCUZ6O87oI= X-Proofpoint-GUID: N_InJHfThYahAQMVzJzKAWlIaUHH_ZtS X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE2NSBTYWx0ZWRfX+dGZHTms/e86 OZrZGuIr5L0cHiPHB53PLknYTT5mHAZo9SBtQquVEYmUsVB5HgC9C3R38+pbliRRzLFnKC4MKp2 RrQmi5VXPXmvuswQ8a9IMKdZ5eP6TpUaOcg7pGEAXJOxtf2eriyoaOXjGvsnqOL2vLZXxaoGw/E HIAA0EFV7Hy4XoAxxLXnhQcqqtdtbaJA1hXDbRf+Nf3QRzlE51ZphUR7Hgp8JjfjLL6ykQL5H8S vVBWslM1Uow07DlxVfNk+OXnRlwr0+jIVx+oqHPxN9MMDGc7oRiqPNmxo+0iTS8+bo3Hp406W53 nrO1RzriI8fh1g+lUVlHPoJ/R/fp26SQbpskul7IBOQfOYOexvo3nBhVMCAku398VvX3SBxD+AI zpNhkJV3lntqvvwos/7hKNU0Y1UV7WHgrjmpa8oaBB9+flXC9F7NumbR3/xeGIPwV6hCbJkfqB6 uiztQ/fqn/27E361E3A== X-Proofpoint-ORIG-GUID: N_InJHfThYahAQMVzJzKAWlIaUHH_ZtS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 impostorscore=0 clxscore=1015 malwarescore=0 bulkscore=0 spamscore=0 lowpriorityscore=0 suspectscore=0 priorityscore=1501 phishscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200165 Runtime PM has to be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. However, the runtime suspend/resume callbacks dereference the qmp->phy pointer, which is only assigned by devm_phy_create(), later in probe: `if (!qmp->phy->init_count) {` There is thus a small window where the callback may run after pm_runtime_enable() but before qmp->phy is set, dereferencing a NULL pointer. This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once qmp->phy has been created, so that no runtime suspend can run while the phy pointer is still uninitialized. Fixes: e464a3180a43 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support") Reviewed-by: Abel Vesa Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c index 8bf951b0490cfd811635df8940de1b789e21b46c..8b91eec0b5eee0c76b64e2c2b7a15f0169ce4b09 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c @@ -1277,10 +1277,16 @@ static int qmp_usb_legacy_probe(struct platform_device *pdev) if (ret) goto err_node_put; + /* + * Enable runtime PM before creating the PHY, phy_create() only enables + * it on the PHY device if already enabled on the parent. Hold a usage + * reference so callbacks cannot run before qmp->phy is assigned. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); ret = devm_pm_runtime_enable(dev); if (ret) - goto err_node_put; + goto err_pm_put; /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -1289,23 +1295,27 @@ static int qmp_usb_legacy_probe(struct platform_device *pdev) ret = phy_pipe_clk_register(qmp, np); if (ret) - goto err_node_put; + goto err_pm_put; qmp->phy = devm_phy_create(dev, np, &qmp_usb_legacy_phy_ops); if (IS_ERR(qmp->phy)) { ret = PTR_ERR(qmp->phy); dev_err(dev, "failed to create PHY: %d\n", ret); - goto err_node_put; + goto err_pm_put; } phy_set_drvdata(qmp->phy, qmp); + pm_runtime_put(dev); + of_node_put(np); phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); return PTR_ERR_OR_ZERO(phy_provider); +err_pm_put: + pm_runtime_put_noidle(dev); err_node_put: of_node_put(np); return ret; -- 2.34.1