Re: [PATCH v5 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support
From: sashiko-bot@kernel.org
Date: 2026-09-14 03:27:14
Also in:
linux-phy
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Medium] Unchecked regmap_read return value in ma35_role_sw_get leads to the use of uninitialized stack memory, potentially leaking 1 bit of kernel stack data to userspace. -- commit 93b1ad8e66488910d7c296427cb3acbec813e0a2 Author: Joey Lu [off-list ref] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support This patch extends the Nuvoton MA35D1 USB 2.0 PHY driver to manage both PHY0 and PHY1 ports using a unified init callback. It updates the reset and clock polling sequences and adds a read-only USB role switch for PHY0 to expose the active role to userspace.
quoted hunk ↗ jump to hunk
diff --git a/drivers/phy/nuvoton/phy-ma35d1-usb2.c b/drivers/phy/nuvoton/phy-ma35d1-usb2.c index 9a459b700ed48..2c60be0ee50f7 100644 --- a/drivers/phy/nuvoton/phy-ma35d1-usb2.c +++ b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
[ ... ]
+static enum usb_role ma35_role_sw_get(struct usb_role_switch *sw)
+{
+ struct ma35_usb_phy *p = usb_role_switch_get_drvdata(sw);
+ u32 val;
+
+ regmap_read(p->sysreg, MA35_SYS_PWRONOTP, &val);
+
+ return (val & PWRONOTP_USBP0ID) ? USB_ROLE_HOST : USB_ROLE_DEVICE;
+}[Severity: Medium] Could this lead to the use of uninitialized stack memory? If the call to regmap_read() fails, the variable val will remain uninitialized. When evaluated in the return statement, it would return a USB role based on stack garbage. Since this role is exposed to userspace via the sysfs role switch interface, could this potentially leak one bit of kernel stack information to userspace if the MMIO read happens to fail? Should the return value of regmap_read() be checked before evaluating val? [ ... ] -- Sashiko AI review · https://sashiko.dev/#/patchset/20260914031859.385224-1-a0987203069@gmail.com?part=3