Skip to content

Commit 1ca52c0

Browse files
Loic Poulainvinodkoul
authored andcommitted
phy: qcom-qusb2: Fix NULL pointer dereference on early suspend
Enabling runtime PM before attaching the QPHY instance as driver data can lead to a NULL pointer dereference in runtime PM callbacks that expect valid driver data. There is a small window where the suspend callback may run after PM runtime enabling and before runtime forbid. This causes a sporadic crash during boot: ``` Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a1 [...] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.16.7+ #116 PREEMPT Workqueue: pm pm_runtime_work pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : qusb2_phy_runtime_suspend+0x14/0x1e0 [phy_qcom_qusb2] lr : pm_generic_runtime_suspend+0x2c/0x44 [...] ``` Attach the QPHY instance as driver data before enabling runtime PM to prevent NULL pointer dereference in runtime PM callbacks. Reorder pm_runtime_enable() and pm_runtime_forbid() to prevent a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup. Fixes: 891a96f ("phy: qcom-qusb2: Add support for runtime PM") Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://patch.msgid.link/20251219085640.114473-1-loic.poulain@oss.qualcomm.com Signed-off-by: Vinod Koul <vkoul@kernel.org>
1 parent 8becf91 commit 1ca52c0

1 file changed

Lines changed: 8 additions & 8 deletions

File tree

drivers/phy/qualcomm/phy-qcom-qusb2.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1093,29 +1093,29 @@ static int qusb2_phy_probe(struct platform_device *pdev)
10931093
or->hsdisc_trim.override = true;
10941094
}
10951095

1096-
pm_runtime_set_active(dev);
1097-
pm_runtime_enable(dev);
1096+
dev_set_drvdata(dev, qphy);
1097+
10981098
/*
1099-
* Prevent runtime pm from being ON by default. Users can enable
1100-
* it using power/control in sysfs.
1099+
* Enable runtime PM support, but forbid it by default.
1100+
* Users can allow it again via the power/control attribute in sysfs.
11011101
*/
1102+
pm_runtime_set_active(dev);
11021103
pm_runtime_forbid(dev);
1104+
ret = devm_pm_runtime_enable(dev);
1105+
if (ret)
1106+
return ret;
11031107

11041108
generic_phy = devm_phy_create(dev, NULL, &qusb2_phy_gen_ops);
11051109
if (IS_ERR(generic_phy)) {
11061110
ret = PTR_ERR(generic_phy);
11071111
dev_err(dev, "failed to create phy, %d\n", ret);
1108-
pm_runtime_disable(dev);
11091112
return ret;
11101113
}
11111114
qphy->phy = generic_phy;
11121115

1113-
dev_set_drvdata(dev, qphy);
11141116
phy_set_drvdata(generic_phy, qphy);
11151117

11161118
phy_provider = devm_of_phy_provider_register(dev, of_phy_simple_xlate);
1117-
if (IS_ERR(phy_provider))
1118-
pm_runtime_disable(dev);
11191119

11201120
return PTR_ERR_OR_ZERO(phy_provider);
11211121
}

0 commit comments

Comments
 (0)