From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0a-0031df01.pphosted.com (mx0a-0031df01.pphosted.com [205.220.168.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 460F93B6344 for ; Mon, 20 Jul 2026 14:53:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.168.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784559233; cv=none; b=hoEq2hOFVpnJVog2p7EBhFIBWKy+OoEyPG9weIMlLGp3DMKEhNsp+6XfiZiwxVe7F28aW6zteqgipZISphJiTctFtxxSHWW2oDCDq1ZddRTC59MCcL2yLFevPRBmkw17MJQTdSuWqPQjtoyXdj6/4WkbqqbMZ/LtyvDoG/9M4do= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784559233; c=relaxed/simple; bh=hB43yDM5wPsZ0p8kCzuf9vWRzlFYjXS4Z9sUYHruMMM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=Vj0HbZZ+MwslpYDiKtUuZj6kdKw/nUr84cOx7QUcvRJbB8XnWYb7DSSzV5iDWdFvMxl/SWy9bMl3/M/NaYRm4l/axFoP8tN6kFTNtPPsS4/F5WjRIHw7khfhpiNBD3B64N9l3yM3CRfDMLJZQM1NgZdmFHX9wzDQNOE6tBA67Ps= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=jDkujJ+q; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=G8xBFsCF; arc=none smtp.client-ip=205.220.168.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="jDkujJ+q"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="G8xBFsCF" Received: from pps.filterd (m0279865.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66KDqbSo2962875 for ; Mon, 20 Jul 2026 14:53:51 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= GXJHlTlWI9rdZAlQlDTbUDpfcsl4EJSlpJT6KPqMdqk=; b=jDkujJ+qSnwsUxBm 1EcSaMqdPQnJdXRSjJ71Vk3+7L4RhU343dllQrDcrJLOLenLM9zvKKfJUwSw6RD+ /jqQo7fJBzIOa/doGt7vuNlKeu6Q/H/LY0VisR0vHWQdpzcowTAPpolv9zjLUZs2 PfJycizd0PLli6LiQjrtsEFGe2LrA+x3qo+QBFTf4bv4R09WmFfvTeEJf3xLZdti dLWtCVWDE3bDG2hmdCckaEeih8xRpLocG1XoCX6FcxvkF+kc/lwQ5h666UeCrvhi bHgAHauRpOe5gxHfJNzn0u7dn+qLMHj+AaiJj9WPiMuPIkhtEUrxOjily4VOihdQ 5dYpOg== Received: from mail-qt1-f200.google.com (mail-qt1-f200.google.com [209.85.160.200]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fhfdchwdc-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 20 Jul 2026 14:53:51 +0000 (GMT) Received: by mail-qt1-f200.google.com with SMTP id d75a77b69052e-51a8db414c7so170368471cf.0 for ; Mon, 20 Jul 2026 07:53:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784559230; x=1785164030; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GXJHlTlWI9rdZAlQlDTbUDpfcsl4EJSlpJT6KPqMdqk=; b=G8xBFsCF1foGrYyfqu0mGx3mnvg5QEHcCnFAupDYED4PqOZuybIF/ouVIx1xUVcrK6 Wg5b1CKjUqSYwrUrySvozPgdly5Rq2sPwVbLS0QFqAmBw07BnH5UY8UgM4fxdhkqYJ54 SIBOYt7/6TBdu45IuYUARxUgIb6M7rvNke7/slkFaJ6lXmMdC8fi8yNYUGGpHT1sMClf +7dEzYb+3yzypGi3J+UIYyIYBlzXK6SGKiiYtdGmIouSSwyWgr+1XD4BeEJh4fg9+/FX 6fAs/KvtayOAmR2F88cHo+ah06cPIdjxnuv5C6yEgTnNvXqrsVO8G39bjNj8h+DuqHaG VyBg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784559230; x=1785164030; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=GXJHlTlWI9rdZAlQlDTbUDpfcsl4EJSlpJT6KPqMdqk=; b=H76hLQOZzqGEnvJTqMg7tT0b6IEinLQ5OUkq52qikN8JtlLr3ORo5wvK3waDTpgfnX 1bBdkh0yps9iJJPxxRqYrus10gdi+R2xefbYAihB5zJKrrBwlsR8jfag9mtV6d7onbVX SSFPPFzU7mdDTXJn8tda1wCL0XGRu6nTOo3GR+TGg+h2jqKkygQAb5c2V5vevhs4aAAh Y4w6xKKa55uSYtIpcOMLfGqVe3XPsxUslFC0eeGeFU3awbSijweT/JKV4FvWokR8y107 SNyTLuiQtip94JZb+N8MuzwjU6Z6IJdoftu+l/cev0H0n7/3Jvx4XwxHllBZj35SHXxw R+Cw== X-Forwarded-Encrypted: i=1; AHgh+Rr9g9vPPqLQchw3gX7QGMNZjXogwW70n/b8nfD06TssHtgJT+N9MLYh3aH0wb3UjGQRXLeT/Yu3L7HrU+o=@vger.kernel.org X-Gm-Message-State: AOJu0YyNY5I9FunXdpzOUieN4n2g8dMkngOhtES0PBNu9PGLISGAdsQ8 fMTl6Pkxsbhvq3dh/htKWSNNBwAQKPVyNq2GU9dH9ViKynBEEBqdpSClxzfAspvVzttGhPcYz+G vK/pnXZHx5+ea0wj87sYP8c0nNoSuEDyciApFYp+G9P9EjKD0CgNOPDkZQtjfN9aseSY= X-Gm-Gg: AfdE7ckq5ESx/sH6b5LsUSfG1DCQxMpIS1t5W12Gb3z+azByAG+v9MRhML7yMBHI/RP RsM3pQig624FOPs6+7sDsTsMHlfg1tlaL+nvtgI2wYppf4KqE30a6I3j3hLOgDBHHu8iSoxhUqX ncCDolfV7EHAglENmZDi/LVtI+zVDZqdjuR2rBChIPTGUjccecKNHJOvZANEOZE9x+9gWKhPbt9 ngUaphEtb7SQt1gyayOowCUNm9TsJ0TzIEQx4o8dDcsocQb0gKOPEEOV9ON7wW1kImnKX36hTmm 63Pu0ae+LvUe8/H8M4h8zIHFV17K2ZNn5j9ULoT32dJNUmT92v/YrZezIeOZkXwLqhUNUPdtgNu EDmQfJiRc8Z4QvXssUF9PNkJfTkQgktBeum1d/rZTEiFEu+yK5yzlekZVj0psEBNJpHi1EjB95W P34NRj9dt9s2HtjMlgCZRr2bewcVIY2WkEXjjoSJ6sGEkqkzToU8g= X-Received: by 2002:ac8:5e49:0:b0:51c:7b11:419c with SMTP id d75a77b69052e-5213f36e3bemr143373021cf.73.1784559230487; Mon, 20 Jul 2026 07:53:50 -0700 (PDT) X-Received: by 2002:ac8:5e49:0:b0:51c:7b11:419c with SMTP id d75a77b69052e-5213f36e3bemr143366741cf.73.1784559221716; Mon, 20 Jul 2026 07:53:41 -0700 (PDT) Received: from QCOM-eG0v1AUPpu.na.qualcomm.com ([2a01:e0a:830:450:751c:d61c:c91:60dd]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-69e7000c3e2sm4800215a12.30.2026.07.20.07.53.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 07:53:40 -0700 (PDT) From: Loic Poulain Date: Mon, 20 Jul 2026 16:53:33 +0200 Subject: [PATCH v4 4/4] phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260720-qcom-usb-phy-fix-null-v4-4-4d2a0f06d53a@oss.qualcomm.com> References: <20260720-qcom-usb-phy-fix-null-v4-0-4d2a0f06d53a@oss.qualcomm.com> In-Reply-To: <20260720-qcom-usb-phy-fix-null-v4-0-4d2a0f06d53a@oss.qualcomm.com> To: Vinod Koul , Neil Armstrong , Dmitry Baryshkov , Wesley Cheng Cc: linux-arm-msm@vger.kernel.org, linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org, Dmitry Baryshkov , Konrad Dybcio , Abel Vesa , Loic Poulain X-Mailer: b4 0.14.2 X-Proofpoint-ORIG-GUID: Z-FV2B13qQIhKPew0LWtJOWbrFeI__3f X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIwMDE2NSBTYWx0ZWRfX7sv5+a+w221p KltP8JxoJKuxzBmQIPcNq0c7iI7XS8lpHdfrmrtoDY+D2cZ91ivlvN0f66fAHKGv7sgoZbjCwYE 0S8QjGElzYb9H/kutWlRsPavVl7DEGvRo9cKfOM7Za1fz9UgUh/t88arbXpmvyv4ZGol7fm24f0 yLnpD7TDQQUXkeFsEyjgrxWro/Gc7f9aQ3GUVMrc1ktOYJdtX8MDSxi/j/jEOZi8iSrzNut9dM0 OqJN1yh94gFwfoYHtbwrzjnSQ42K0c9j1Nfi7wt4YyCmenSwYmkyVvpiH57Q9XK/uaJFnd2kuuX If9UCZPuDvHrRXzY5cY3BN3xRkPGOozEDdmekZNKR5RBRAWEIOKfM165Y8I/bz7tZBDYECWc4x4 Zlt1MLe4qkvNZ6Uz+PxCdZevWdivHD3OY8qei/aL6xI431qSi4Epp+UpYVmuJP1MJ1pU6ciz5mk 98ge2JHbeEdm9p7q9mQ== X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIwMDE2NSBTYWx0ZWRfXwccJXMdIegQ0 WyqSnrw+VElu+FPqhalUl4Ea4TTUulUJ7gvmf1QQhIUf+wn8YUq7T7xcSWr5PF1zpNUpCxTB+gd YToK4wWEeUcq7liifh/s5W2aatd3VPk= X-Proofpoint-GUID: Z-FV2B13qQIhKPew0LWtJOWbrFeI__3f X-Authority-Analysis: v=2.4 cv=bv58wkai c=1 sm=1 tr=0 ts=6a5e367f cx=c_pps a=JbAStetqSzwMeJznSMzCyw==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=Um2Pa8k9VHT-vaBCBUpS:22 a=EUspDBNiAAAA:8 a=PcYcMbZi39MCwOMHHM8A:9 a=QEXdDO2ut3YA:10 a=uxP6HrT_eTzRwkO_Te1X:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-20_03,2026-07-20_02,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 bulkscore=0 priorityscore=1501 spamscore=0 malwarescore=0 phishscore=0 lowpriorityscore=0 clxscore=1015 suspectscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607200165 Runtime PM must be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. However, the runtime PM callbacks dereference the hsphy instance, which is not yet ready, leaving a window where a suspend callback may trigger a NULL pointer dereference. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created, so that no runtime suspend can run before the PHY is ready. This also prevents a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup. Fixes: 0d75f508a9d5 ("phy: qcom-snps: Add runtime suspend and resume handlers") Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c index eb0b0f61d98e03963bf92e5c822334f52636abe7..b1a85518fed0a7a35516d16da3ebf69afe760e40 100644 --- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c @@ -599,8 +599,18 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) return dev_err_probe(dev, ret, "failed to get regulator supplies\n"); + /* + * Enable runtime PM before creating the PHY, phy_create() only enables + * it on the PHY device if already enabled on the parent. Hold a usage + * reference so callbacks cannot run before the PHY is ready. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); - pm_runtime_enable(dev); + ret = devm_pm_runtime_enable(dev); + if (ret) { + pm_runtime_put_noidle(dev); + return ret; + } /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -611,6 +621,7 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) if (IS_ERR(generic_phy)) { ret = PTR_ERR(generic_phy); dev_err(dev, "failed to create phy, %d\n", ret); + pm_runtime_put_noidle(dev); return ret; } hsphy->phy = generic_phy; @@ -622,8 +633,8 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); if (!IS_ERR(phy_provider)) dev_dbg(dev, "Registered Qcom-SNPS HS phy\n"); - else - pm_runtime_disable(dev); + + pm_runtime_put(dev); return PTR_ERR_OR_ZERO(phy_provider); } -- 2.34.1