From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 80757346777 for ; Tue, 21 Jul 2026 13:06:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784639163; cv=none; b=RaYPJ0mz2dEVU6g5iOkW8pMqvNIiYo5xU1we3cddAy0frT6XE2Iih737AP8pLJ1j0bNBdFPBHyA7+cL4RkLRUzkBxBreal6f/4GJV3BRw2cwFqlyOjQWgO3iwzKp+uKF0ItTyCoCvuok9ydGMp0dX2Yq8aOymSP7LZtOyF8LhOQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784639163; c=relaxed/simple; bh=hB43yDM5wPsZ0p8kCzuf9vWRzlFYjXS4Z9sUYHruMMM=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=T0n23PZN1DCOdPeyl3QIJhXsgZJnYa6zPJgXivxQhnWO0r/6x6IdA7/VGGLfJNdlcXqndwts4sgbTV8DuMHFiIJiBUZlLB0IIFeDwEmhpci6djAq3TAZ3ooAxKA3djzcjEwuKpLKTCMTBOpduB6YMhgVsKT0CGfsze0L1ViZPIY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=jszkDaJf; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=gJWB2nwc; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="jszkDaJf"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="gJWB2nwc" Received: from pps.filterd (m0279871.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66LARNWe1499957 for ; Tue, 21 Jul 2026 13:06:00 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= GXJHlTlWI9rdZAlQlDTbUDpfcsl4EJSlpJT6KPqMdqk=; b=jszkDaJfDaNZQX+G vLXRqKgoclNXEm8JrFbRzkROKZXEQidCi9/1RwolO0KKUQkBaGclbwDlblIWNqak MaM1ZGHU0VwexiDod8Afoiej3LvJF05gVb1eFryupAGqiX8eTA5VVjuJid/Rcohq gKWQ9WVzanQwbgCBBdsRs0Wuy9W91PwB7C0VRcqRztDPOaGp+WE8J2U+AzB7q0Yg f/4L81f9i14u5/ZCm3qfEJxGKzALx2TXm1RyZwa+gNidzGbLwqnAQGDiakfA09QN yEpljJyTLfxCmadIYz++1Goex0vwPimuhxUq3v+VI2IlqLX0YTdtkzkkNw/10LvX dfiF8Q== Received: from mail-qt1-f197.google.com (mail-qt1-f197.google.com [209.85.160.197]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fj1bvtfk7-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Tue, 21 Jul 2026 13:06:00 +0000 (GMT) Received: by mail-qt1-f197.google.com with SMTP id d75a77b69052e-5174a23afcbso98748021cf.3 for ; Tue, 21 Jul 2026 06:06:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784639160; x=1785243960; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=GXJHlTlWI9rdZAlQlDTbUDpfcsl4EJSlpJT6KPqMdqk=; b=gJWB2nwcRkm4jCoKabS0dtSS+l8iKmZoQaqwS91/pXsyQZBgRdZiVxhc6iQdbw4Q3w liG21BTzvnXKEfDqrKo8wY8Tw351HQMa8GocEr5oy9pUOGlQrcBGXSxZUuBgPO9gt+Y8 h0yrIZ3eIp5g/RA2MiZODaXUnRkj2XQDdu0c0Xpfn0Oi4XyjmKW3Q12nGXf+OULYqmZt uebKRBBLQIFi/LTBN+unmQCdTB5dGqmokBqiEASoWbXpTp7w6B2H0E+7kwDSqQWxl4U2 BtsFXLp7VUFIINnbGsiEG/fS8wwikHHJ8twvE+iu0usZxV+uKQ8/qVZ2QqJRY7ITzR9B EPsA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784639160; x=1785243960; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=GXJHlTlWI9rdZAlQlDTbUDpfcsl4EJSlpJT6KPqMdqk=; b=QEzBWt7+llwlQxSZ/OftXYoTTa/HpDmXbC2dI0XZvFf+KV6mcOqP1qbLc+sv+X88Xf cqO9SmBmwAx8qWq2hqUzxKtVnEqdewDAUiZFwjdS9of41/AUH2mVMnQoZGUeUov1pYw7 xjaP8Pf5rSoAC5cQFHjhnTE+f0NYXMgomvgLbElujJm9q4mEcf/f12WwTlGdAjrMHFoE ny8ZIvyKYtZHMbnp4isC7/6te2/WPhqSDCyzd2IjogmTdevFUdXPR87R2dsy7gL4HW4v bTrLit+Tm1V9dj2q684ccDIDiWVypDQMfY15BMofQMyBX4jBDBdN61n4OcHqYt/EAPVh 2Uhg== X-Forwarded-Encrypted: i=1; AHgh+RqlF3rP5sZhwFGUjYbNgMygmHHzUDnVOk8cbMuqj4yCiK5UgpvdOVdQXs8ILKmajnbR43uhEDGPne1Z+xA=@vger.kernel.org X-Gm-Message-State: AOJu0Yz2iEVlXr7o6rMGkKRZazuvzuUAdOP+JVJ6RCYlLQrSvdCQjnQr SWoeDcMRrqPSJ13sxG7tdZ3GTFbx40DZ8BrBQ4kbV3B5SkkLb3UAKjYnAw8Y5TsMWwzrSU1cM6I TFwTW2rImrzBoQ4ZLXyzvvQQfgHF8LrylfRmbGewzCX0ptLMPR2xE9mPKNPXPwb9s0S8= X-Gm-Gg: AfdE7cmobFFbgYQCmfzFgQibBfJBfeMK9ByzjBwBbawMEdHHqcWh+tnrLBZeGUQnwpj IYRqVaW+h/rndFS361efQ9/mQaBbsC8sUlm3egqUlEg+AEEdELtPsuDbf995Jfc7AY2saPLchBd nHnArEjNW2bAUxjZp8W5qO81zYyc5qbB8HVyP/QvwROnGENf6Ll0anL87mrd54y2Fr0pmZanzJ5 8nH3Re/qa6oocLz8meReAfUkWr1aZv6UITQ4Coog+WK04juNgLX1fNNvaCTMrp7pV6DSVqShCw+ U7Pdl7uJ8u4usS+5GB3VJ6T4/OZSika3J2o+zNgHd26rzTCy8pqZ3gWdDSgDXjrHzZzbb5X4RkO 8hDgSuLAyxSNb4bsm11Gme804A1VqRPuDkI/uqli8FeouPP76Kvl9kZOhau1JdlCK26JQgS8rWk JgIIHpEh/mXPb2/fvnSdVb/LEBXuzodAGb5WZM7qQqarrhenHQk40= X-Received: by 2002:a05:622a:228a:b0:517:5e32:af1e with SMTP id d75a77b69052e-5213c10a757mr161124541cf.8.1784639159684; Tue, 21 Jul 2026 06:05:59 -0700 (PDT) X-Received: by 2002:a05:622a:228a:b0:517:5e32:af1e with SMTP id d75a77b69052e-5213c10a757mr161123831cf.8.1784639159021; Tue, 21 Jul 2026 06:05:59 -0700 (PDT) Received: from QCOM-eG0v1AUPpu.na.qualcomm.com ([2a01:e0a:830:450:751c:d61c:c91:60dd]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c17009ae04bsm591898066b.8.2026.07.21.06.05.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Jul 2026 06:05:58 -0700 (PDT) From: Loic Poulain Date: Tue, 21 Jul 2026 15:05:49 +0200 Subject: [PATCH v5 5/5] phy: qcom: snps-femto-v2: Fix possible NULL-deref on early runtime suspend Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260721-qcom-usb-phy-fix-null-v5-5-a181e2adbd2d@oss.qualcomm.com> References: <20260721-qcom-usb-phy-fix-null-v5-0-a181e2adbd2d@oss.qualcomm.com> In-Reply-To: <20260721-qcom-usb-phy-fix-null-v5-0-a181e2adbd2d@oss.qualcomm.com> To: Vinod Koul , Neil Armstrong , Dmitry Baryshkov , Wesley Cheng Cc: linux-arm-msm@vger.kernel.org, linux-phy@lists.infradead.org, linux-kernel@vger.kernel.org, Dmitry Baryshkov , Konrad Dybcio , Abel Vesa , Loic Poulain X-Mailer: b4 0.14.2 X-Proofpoint-ORIG-GUID: e0ROcgFaHiBwoebTfv-b3p3oDoDc7gXX X-Proofpoint-Spam-Info: AW1haW4tMjYwNzIxMDEzOCBTYWx0ZWRfXxjlSQeXwSZG+ 39cJMssV/ijtqq/WfAqM7IsHGQ4mZb8QF81OiHgoBFH/xVNxSBNxmn86uz26PcMKAX2JJfiy0Wy jqkQTpuaeT9KOSSuLkNaPaHEBKG2++U= X-Proofpoint-GUID: e0ROcgFaHiBwoebTfv-b3p3oDoDc7gXX X-Authority-Analysis: v=2.4 cv=Sb7HsPRu c=1 sm=1 tr=0 ts=6a5f6eb8 cx=c_pps a=EVbN6Ke/fEF3bsl7X48z0g==:117 a=xqWC_Br6kY4A:10 a=IkcTkHD0fZMA:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=3WHJM1ZQz_JShphwDgj5:22 a=EUspDBNiAAAA:8 a=PcYcMbZi39MCwOMHHM8A:9 a=QEXdDO2ut3YA:10 a=a_PwQJl-kcHnX1M80qC6:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzIxMDEzOCBTYWx0ZWRfX81XAk+kitYGj 1lf4igg2bGzAbMCFmRKFqqIlHLvLjMnErt3aKQnrms7XCMpkZe7a/bUiTkWfWE/nKuN46UxHhFJ uWrNbqGc4e1baC4IIl+fzNHXnxtxz/6OKhw1w1PHWUHLVM+FJKZb1IQPUIuvJA+5e9Xez7e9rXS quM6icGDhNn07i6vo1eFnbqMLaKVNw+QG9umO3/6VVxCDQ39bnHXYTHbs0Mcu1j2Abo+34dKhCe LFIyGqCTwCNAAcf5/9WACP8+EtMBdV5gu5t6PUJnWgwujjAyeYE53175/nBfmb/sWwFoi2CXgrX 72EAxfEh2xI05vrfx5fSL0C/1QzxH/RX5xDZTJhd84Sqb6sMUNMSm29YA2ndQA8Y86RUL8g3Ecc B7jMGsSnmirLtfIf/39ehG5tBKlAjFxjdwHwKReAGK/wqrj5pMKpCGKhtp8+DQfhsTdrCeUPAtJ w9tgjx4fAlxx3cxUQ5Q== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-21_01,2026-07-20_03,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 malwarescore=0 spamscore=0 suspectscore=0 clxscore=1015 lowpriorityscore=0 impostorscore=0 adultscore=0 phishscore=0 priorityscore=1501 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607210138 Runtime PM must be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. However, the runtime PM callbacks dereference the hsphy instance, which is not yet ready, leaving a window where a suspend callback may trigger a NULL pointer dereference. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created, so that no runtime suspend can run before the PHY is ready. This also prevents a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup. Fixes: 0d75f508a9d5 ("phy: qcom-snps: Add runtime suspend and resume handlers") Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Reviewed-by: Abel Vesa Signed-off-by: Loic Poulain --- drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c index eb0b0f61d98e03963bf92e5c822334f52636abe7..b1a85518fed0a7a35516d16da3ebf69afe760e40 100644 --- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c @@ -599,8 +599,18 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) return dev_err_probe(dev, ret, "failed to get regulator supplies\n"); + /* + * Enable runtime PM before creating the PHY, phy_create() only enables + * it on the PHY device if already enabled on the parent. Hold a usage + * reference so callbacks cannot run before the PHY is ready. + */ + pm_runtime_get_noresume(dev); pm_runtime_set_active(dev); - pm_runtime_enable(dev); + ret = devm_pm_runtime_enable(dev); + if (ret) { + pm_runtime_put_noidle(dev); + return ret; + } /* * Prevent runtime pm from being ON by default. Users can enable * it using power/control in sysfs. @@ -611,6 +621,7 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) if (IS_ERR(generic_phy)) { ret = PTR_ERR(generic_phy); dev_err(dev, "failed to create phy, %d\n", ret); + pm_runtime_put_noidle(dev); return ret; } hsphy->phy = generic_phy; @@ -622,8 +633,8 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate); if (!IS_ERR(phy_provider)) dev_dbg(dev, "Registered Qcom-SNPS HS phy\n"); - else - pm_runtime_disable(dev); + + pm_runtime_put(dev); return PTR_ERR_OR_ZERO(phy_provider); } -- 2.34.1