[PATCH 0/2] two fixes for phy usb

[PATCH 0/2] two fixes for phy usb

[Sun Ke]

two fixes for phy usb 

Sun Ke (2):
  phy: usb: Fix potential NULL dereference in sp_usb_phy_probe()
  phy: usb: Fix return value check in sp_usb_phy_probe()

 drivers/phy/sunplus/phy-sunplus-usb2.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

-- 
2.31.1

[PATCH 1/2] phy: usb: Fix potential NULL dereference in sp_usb_phy_probe()

[Sun Ke]

platform_get_resource_byname() may fail and return NULL, so we should
better check it s return value to avoid a NULL pointer dereference
a bit later in the code.

Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021")
Signed-off-by: Sun Ke <sunke32@huawei.com>
---
 drivers/phy/sunplus/phy-sunplus-usb2.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/phy/sunplus/phy-sunplus-usb2.c b/drivers/phy/sunplus/phy-sunplus-usb2.c
index 5269968b3060..d73a8a421d9c 100644
--- a/drivers/phy/sunplus/phy-sunplus-usb2.c
+++ b/drivers/phy/sunplus/phy-sunplus-usb2.c
@@ -249,11 +249,15 @@ static int sp_usb_phy_probe(struct platform_device *pdev)
 	usbphy->dev = &pdev->dev;
 
 	usbphy->phy_res_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "phy");
+	if (!usbphy->phy_res_mem)
+		return -EINVAL;
 	usbphy->phy_regs = devm_ioremap_resource(&pdev->dev, usbphy->phy_res_mem);
 	if (IS_ERR(usbphy->phy_regs))
 		return PTR_ERR(usbphy->phy_regs);
 
 	usbphy->moon4_res_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "moon4");
+	if (!usbphy->moon4_res_mem)
+		return -EINVAL;
 	usbphy->moon4_regs = devm_ioremap(&pdev->dev, usbphy->moon4_res_mem->start,
 					  resource_size(usbphy->moon4_res_mem));
 	if (IS_ERR(usbphy->moon4_regs))
-- 
2.31.1

[PATCH 2/2] phy: usb: Fix return value check in sp_usb_phy_probe()

[Sun Ke]

In case of error, the function devm_ioremap() returns NULL pointer
not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.

Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021")
Signed-off-by: Sun Ke <sunke32@huawei.com>
---
 drivers/phy/sunplus/phy-sunplus-usb2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/phy/sunplus/phy-sunplus-usb2.c b/drivers/phy/sunplus/phy-sunplus-usb2.c
index d73a8a421d9c..50ad428cc55d 100644
--- a/drivers/phy/sunplus/phy-sunplus-usb2.c
+++ b/drivers/phy/sunplus/phy-sunplus-usb2.c
@@ -260,8 +260,8 @@ static int sp_usb_phy_probe(struct platform_device *pdev)
 		return -EINVAL;
 	usbphy->moon4_regs = devm_ioremap(&pdev->dev, usbphy->moon4_res_mem->start,
 					  resource_size(usbphy->moon4_res_mem));
-	if (IS_ERR(usbphy->moon4_regs))
-		return PTR_ERR(usbphy->moon4_regs);
+	if (!usbphy->moon4_regs)
+		return -EINVAL;
 
 	usbphy->phy_clk = devm_clk_get(&pdev->dev, NULL);
 	if (IS_ERR(usbphy->phy_clk))
-- 
2.31.1

Re: [PATCH 1/2] phy: usb: Fix potential NULL dereference in sp_usb_phy_probe()

[Greg KH]

On Fri, Sep 09, 2022 at 09:35:45AM +0800, Sun Ke wrote:
> platform_get_resource_byname() may fail and return NULL, so we should
> better check it s return value to avoid a NULL pointer dereference
> a bit later in the code.
> 
> Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021")
> Signed-off-by: Sun Ke <sunke32@huawei.com>
> ---
>  drivers/phy/sunplus/phy-sunplus-usb2.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/phy/sunplus/phy-sunplus-usb2.c b/drivers/phy/sunplus/phy-sunplus-usb2.c
> index 5269968b3060..d73a8a421d9c 100644
> --- a/drivers/phy/sunplus/phy-sunplus-usb2.c
> +++ b/drivers/phy/sunplus/phy-sunplus-usb2.c
> @@ -249,11 +249,15 @@ static int sp_usb_phy_probe(struct platform_device *pdev)
>  	usbphy->dev = &pdev->dev;
>  
>  	usbphy->phy_res_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "phy");

How can this fail on this system?

> +	if (!usbphy->phy_res_mem)
> +		return -EINVAL;
>  	usbphy->phy_regs = devm_ioremap_resource(&pdev->dev, usbphy->phy_res_mem);
>  	if (IS_ERR(usbphy->phy_regs))
>  		return PTR_ERR(usbphy->phy_regs);
>  
>  	usbphy->moon4_res_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "moon4");

Same here, how can this fail?
Have you seen these failures happen in real systems?

thanks,

greg k-h

Re: [PATCH 1/2] phy: usb: Fix potential NULL dereference in sp_usb_phy_probe()

[Sun Ke]

在 2022/9/9 13:39, Greg KH 写道:
> On Fri, Sep 09, 2022 at 09:35:45AM +0800, Sun Ke wrote:
>> platform_get_resource_byname() may fail and return NULL, so we should
>> better check it s return value to avoid a NULL pointer dereference
>> a bit later in the code.
>>
>> Fixes: 99d9ccd97385 ("phy: usb: Add USB2.0 phy driver for Sunplus SP7021")
>> Signed-off-by: Sun Ke <sunke32@huawei.com>
>> ---
>>   drivers/phy/sunplus/phy-sunplus-usb2.c | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/phy/sunplus/phy-sunplus-usb2.c b/drivers/phy/sunplus/phy-sunplus-usb2.c
>> index 5269968b3060..d73a8a421d9c 100644
>> --- a/drivers/phy/sunplus/phy-sunplus-usb2.c
>> +++ b/drivers/phy/sunplus/phy-sunplus-usb2.c
>> @@ -249,11 +249,15 @@ static int sp_usb_phy_probe(struct platform_device *pdev)
>>   	usbphy->dev = &pdev->dev;
>>   
>>   	usbphy->phy_res_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "phy");
> 
> How can this fail on this system?
> 
>> +	if (!usbphy->phy_res_mem)
>> +		return -EINVAL;
>>   	usbphy->phy_regs = devm_ioremap_resource(&pdev->dev, usbphy->phy_res_mem);
>>   	if (IS_ERR(usbphy->phy_regs))
>>   		return PTR_ERR(usbphy->phy_regs);
>>   
>>   	usbphy->moon4_res_mem = platform_get_resource_byname(pdev, IORESOURCE_MEM, "moon4");
> 
> Same here, how can this fail?
> Have you seen these failures happen in real systems?

No, just code review.

Thanks,
Sun Ke
> 
> thanks,
> 
> greg k-h
> .
>