From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E48832417D9 for ; Tue, 21 Jul 2026 13:05:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784639157; cv=none; b=dTjnRUB2xXtVdGiy8PHiZlqLIrzcvVJLPWeDqzb7MWOAyqIAIUAc8iN0yxVtomuyWVSGILwWc9nlPA4iP0wiRB8wXDbnDVnP0pdUQGTjQUhALzieNeaU3hjDDYZVUHcO29RluUXg/oBhFOM6oaeAHAh+HnVYOlCUbzVFAhIp0Xc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784639157; c=relaxed/simple; bh=1uCSE9pS0uK8c8rmwdqjcZn44CXrmRxmSQbFF1quomQ=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=rrVnxq9qKrnD6N2vFOOOi+yJLhki8f2cv+ihSAA4hLcnTX2Hy/dqIazqJ9UKR0EbkyvLfuYGIYn2MLa2/f3zxFKECK35OnqXW2ydhClXieOHWTC1Xdywa38accj18HlatV/VLKxW0w0DpTygc+z2V5OVrzcJwn4zDbKf7ytdeAA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=GyFacerb; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=H6n7Yvfk; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="GyFacerb"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="H6n7Yvfk" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LD2vmk1616638 for ; Tue, 21 Jul 2026 13:05:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= w1VnrF5mL82CPISYHMNOBYhwf3W9zInAag1/ZxJRFrs=; b=GyFacerbsu+7NaWF PA6zCWDW9/Z2oximPkP3NhvZeOLrSkdd5rwtoa+SmYmnzqSSIcprdvf61lpGvqUC s8J4xAjWdLXRtom04ClRv7zoN4OPMBYFBuZl8Rcq283F4XaLfzd45q7N/rJYxQrG SgeJnSkUt0R+US+ooe1GADTDM8ugUMcZzlEfGcSSZsPLaxinmzB7snBNF3rSjx71 F/wvZCbH7wESDGTyVqKmTgyT09/4xHY114+v7kpSI+l2qZ2EXciB0hrvQw7kS4et UmAgEK/Ia0uDG+rVgt84gP+g6yqUp1rzsTwvv1oSsnOCokrALq8ehWwAQbyCMAuf xqVdiA== Received: from mail-qt1-f199.google.com (mail-qt1-f199.google.com [209.85.160.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fj9ae80jf-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 21 Jul 2026 13:05:54 +0000 (GMT) Received: by mail-qt1-f199.google.com with SMTP id d75a77b69052e-52769fc3f2eso2905571cf.0 for ; Tue, 21 Jul 2026 06:05:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784639154; x=1785243954; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=w1VnrF5mL82CPISYHMNOBYhwf3W9zInAag1/ZxJRFrs=; b=H6n7YvfkNHsviUmL0Ww9uAUVeb3c+M0zPpDDzIfOZvV0R6WAL8sd8pGDBd/xjSxxUa aiOVFTnzVhpDocbASMRsBT8qjs8KRHiMhfm9UoKPp2bX8yoy+V2Vd0WrJoXAaYdecqYz BiOFSvs5oIH/fLYwrE0lIGfpnU6EBFgcOdXp1p5Xt6xnKDGQC29fNzk8MT3RB2A2NT1R 49vPRiV4Invsaso7Rtd5KFOeEW2s9ivZAjLIBxVqHdXKw7XVyFmYvWaPJnDSnQAlUxhy 16CFMsQ1baonA+9EiSgo+PuwX9O4sM9B8COw3y6hqNB4O+FAUm91Etmaj/BpxmwwEj5B vwVw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784639154; x=1785243954; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=w1VnrF5mL82CPISYHMNOBYhwf3W9zInAag1/ZxJRFrs=; b=YUDDmg0R83dRWuFKZB6F53kL9jwy/+SjWuqzMuH7MBEwAR8PG1sYlzNIbk4cLUhUj/ jbnrC0qgDWtc3G8qUpmzb38busMLtgXMrMd3pX3uBnlRTuNOaxsgNQ8k7YrhCRFDC8SG RK7bKZ3ot23SzJBJdLuM138FvNUK08kSfGXHWFav9TwTSKu8m5t1s1TyIFVWeDuMqpyw iXH3Cy//LO2UzbGjhpK4xBoJ0E+pd3cnH7z+lDsd/a4+8q5FLHmVVZOx23FmHmDL3AOz 6FbyTaQeSh2syIE5Y1yPQgAQnqiLB1IKZhwYfukdX3Mqv7xt3AC014wdkRQQE0INH0IZ ioyQ== X-Forwarded-Encrypted: i=1; AHgh+Rp+/EjXNUUTxVilatfKkQ9NHRhFbqsgrEalRZlKZ/ugLdUvqS0ZtlPpW6Gg6MD8uk9aGpFk3h6KkHMkt+Y=@vger.kernel.org X-Gm-Message-State: AOJu0Yz4GH6kUOOYs6ldJgy8JOSe34jdpuZ3p9EWw3yZL9zAYz91jJ5m jcjpg6LLfrKBHMTDgzyGxZJpns7oYWFoocvOJs8PgAbg+/v82j2Bm+s6DmahwpKsYrCmTDhh5YT HFClvcB6eexm68Gb1b0f5CFrBIGlGUggVvho5+cBmK5swgaISPrU2asRlFdONsZQcicI= X-Gm-Gg: AfdE7cmdwYp3yGwhR0i/D9OL6cSJKWkbbsTGWLDSEHHjuCsrGf+3x8iW4PzQHfyN0b5 zaKlgDNu16avx/JqtBUDHFFXCzK3V+5igCrxJi7fnKD1VZ1NEKDu3GimnggMXJKnssTbTP9x3TG OTQx3zB8T1ES7mD5DMAsCQ9DPLclhN00VnrD+0yfmSnyE3Maog8ndXTEtuh/p2WPvDgys0eaT3S ftsKY6UCADhBpm88llFVoLACziKs6v+WzmXKAn/YcoDITf17eKy/eKgQlbYeM+zPcZfdVbdYqtl mbRxO3BEzHL/2D7bOtGKPJ83K3LhnXc5Dm0Ha89BHQ87KA1qemel4mEPGLwscQ8oskt0yzyYsdW PTJrFM87NBgf2ITGxcphnrxB6/qtpGpgbbDJgqkOJHt8ANnLwHr805exejHrjLyCFJhAxuP+V3F 2fk17sCjvQoOFDQJViBzv46D+Hx+lcaDaQwUlln9qcH5LU1MWlCgo= X-Received: by 2002:a05:622a:110c:b0:51c:167d:b346 with SMTP id d75a77b69052e-5213c5f3a9emr164338281cf.23.1784639154098; Tue, 21 Jul 2026 06:05:54 -0700 (PDT) X-Received: by 2002:a05:622a:110c:b0:51c:167d:b346 with SMTP id d75a77b69052e-5213c5f3a9emr164337661cf.23.1784639153460; Tue, 21 Jul 2026 06:05:53 -0700 (PDT) Received: from QCOM-eG0v1AUPpu.na.qualcomm.com ([2a01:e0a:830:450:751c:d61c:c91:60dd]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c17009ae04bsm591898066b.8.2026.07.21.06.05.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Jul 2026 06:05:52 -0700 (PDT) From: Loic Poulain Date: Tue, 21 Jul 2026 15:05:47 +0200 Subject: [PATCH v5 3/5] phy: qcom: qmp-usb-legacy: Fix possible NULL-deref on early runtime suspend Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260721-qcom-usb-phy-fix-null-v5-3-a181e2adbd2d@oss.qualcomm.com> References: <20260721-qcom-usb-phy-fix-null-v5-0-a181e2adbd2d@oss.qualcomm.com> In-Reply-To: <20260721-qcom-usb-phy-fix-null-v5-0-a181e2adbd2d@oss.qualcomm.com> To: Vinod Koul , Neil Armstrong , Dmitry Baryshkov , Wesley Cheng Cc: linux-arm-msm@vger.kernel.org, linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org, Abel Vesa , Dmitry Baryshkov , Loic Poulain X-Mailer: b4 0.14.2 X-Proofpoint-ORIG-GUID: kGMMfp3xUUnMiAQuKjL5UMJ-RIxyzOWf X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzOCBTYWx0ZWRfX2K3FmEgHxTTt F26GiabnSBQYKaqsuFHrhCxZjtcg+22zZ7Xd8KdgUQHY94pqVjk7GvinMHgHh2ZwfxjJaMZShVT b5w/N1Bvx1b3zWzZzgXccmMSjV3u7n4= X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzOCBTYWx0ZWRfX/ByaxcOHZm69 MIiHpqi3m7wd5vTdF4NPfBzwON/4boz+9jqprnjWAqeFxwJJZ9TrSQrai6A2gIbV75ZASADwixL o9Xm9gOV05tqFgV+66Myac4U3l7ci9Kn+fbJP2LdF2+SdGRe80m6jl6qzlx97i0nGNmMJa9I32d z3f+/+j/xfPSG77mQTh51eLgVhWaZYPHoliTPoXvvFt7IMey+i/b3diX5tfbSqSMbV7SzE5RqAl tqyhUqxFvwgUghZBvb5BhnaNztzu2RmtHLnmF+BgsIHCheQbd3dgVZhPefTn9nF1qyjjqf5ehe/ ZPmgcTW+gufMm+/5y7kSfxM5fhOyu8WTEY94GUy2gN958bGBKJ9EVnFFed7lN5Ygv3G8J6Yna8a Bs0ieyjEXCvZA5ZxX3wb4klurXhO4AwMzkqX67tYA0vFNCeLoFhDg6F+2RhLbCGoR+jxVmwvB+B xue0PNSbIpmoJqgN3Rg== X-Proofpoint-GUID: kGMMfp3xUUnMiAQuKjL5UMJ-RIxyzOWf X-Authority-Analysis: v=2.4 cv=Cr6PtH4D c=1 sm=1 tr=0 ts=6a5f6eb2 cx=c_pps a=WeENfcodrlLV9YRTxbY/uA==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=EUspDBNiAAAA:8 a=QCvEx_dtP_Vb2dzgXhUA:9 a=QEXdDO2ut3YA:10 a=kacYvNCVWA4VmyqE58fU:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 adultscore=0 impostorscore=0 lowpriorityscore=0 spamscore=0 phishscore=0 clxscore=1015 suspectscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607210138 There is a small window where the runtime suspend callback may run after pm_runtime_enable() and before pm_runtime_forbid(). In this case, a crash occurs because runtime suspend/resume dereferences qmp->phy pointer, which is not yet initialized: `if (!qmp->phy->init_count) {` This can also happen if user re-enables runtime-pm via the sysfs attribute before qmp phy is initialized. Similarly to other qcom phy drivers, introduce a qmp->phy_initialized variable that can be used to avoid relying on the possibly uninitialized phy pointer. Fixes: e464a3180a43 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support") Reviewed-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c index 8bf951b0490cfd811635df8940de1b789e21b46c..fc490589c8e4888770807a60170905a1c7610421 100644 --- a/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c +++ b/drivers/phy/qualcomm/phy-qcom-qmp-usb-legacy.c @@ -542,6 +542,8 @@ struct qmp_usb { enum phy_mode mode; + bool phy_initialized; + struct phy *phy; struct clk_fixed_rate pipe_clk_fixed; @@ -895,6 +897,7 @@ static int qmp_usb_legacy_power_off(struct phy *phy) static int qmp_usb_legacy_enable(struct phy *phy) { + struct qmp_usb *qmp = phy_get_drvdata(phy); int ret; ret = qmp_usb_legacy_init(phy); @@ -904,14 +907,19 @@ static int qmp_usb_legacy_enable(struct phy *phy) ret = qmp_usb_legacy_power_on(phy); if (ret) qmp_usb_legacy_exit(phy); + else + qmp->phy_initialized = true; return ret; } static int qmp_usb_legacy_disable(struct phy *phy) { + struct qmp_usb *qmp = phy_get_drvdata(phy); int ret; + qmp->phy_initialized = false; + ret = qmp_usb_legacy_power_off(phy); if (ret) return ret; @@ -988,7 +996,7 @@ static int __maybe_unused qmp_usb_legacy_runtime_suspend(struct device *dev) dev_vdbg(dev, "Suspending QMP phy, mode:%d\n", qmp->mode); - if (!qmp->phy->init_count) { + if (!qmp->phy_initialized) { dev_vdbg(dev, "PHY not initialized, bailing out\n"); return 0; } @@ -1009,7 +1017,7 @@ static int __maybe_unused qmp_usb_legacy_runtime_resume(struct device *dev) dev_vdbg(dev, "Resuming QMP phy, mode:%d\n", qmp->mode); - if (!qmp->phy->init_count) { + if (!qmp->phy_initialized) { dev_vdbg(dev, "PHY not initialized, bailing out\n"); return 0; } -- 2.34.1