Repository navigation
phy: qcom: Fix possible NULL dereferences and runtime PM races - #2012
Open
tapas-rana2811 wants to merge 7 commits into
Open
tapas-rana2811 wants to merge 7 commits into
tapas-rana2811 wants to merge 7 commits into
Conversation
added 7 commits
October 9, 2026 18:23
Runtime PM has to be enabled before creating the PHYs, since phy_create() only enables runtime PM on the PHY devices if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHYs are not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHYs have been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Runtime PM has to be enabled before creating the PHYs, since phy_create() only enables runtime PM on the PHY devices if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHYs are not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHYs have been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
…uspend
There is a small window where the runtime suspend callback may run
after pm_runtime_enable() and before pm_runtime_forbid(). In this
case, a crash occurs because runtime suspend/resume dereferences
qmp->phy pointer, which is not yet initialized:
`if (!qmp->phy->init_count) {`
This can also happen if user re-enables runtime-pm via the sysfs
attribute before qmp phy is initialized.
Similarly to other qcom phy drivers, introduce a qmp->phy_initialized
variable that can be used to avoid relying on the possibly uninitialized
phy pointer.
Fixes: e464a31 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support")
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
…boot Runtime PM has to be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHY is not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
…spend Runtime PM must be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. However, the runtime PM callbacks dereference the hsphy instance, which is not yet ready, leaving a window where a suspend callback may trigger a NULL pointer dereference. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created, so that no runtime suspend can run before the PHY is ready. This also prevents a short window where an unnecessary runtime suspend can occur. Use the devres-managed version to ensure PM runtime is symmetrically disabled during driver removal for proper cleanup. Fixes: 0d75f50 ("phy: qcom-snps: Add runtime suspend and resume handlers") Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
There is a small window where the runtime suspend callback may run
after pm_runtime_enable() and before pm_runtime_forbid(). In this
case, a crash occurs because runtime suspend/resume dereferences
qmp->phy pointer, which is not yet initialized:
`if (!qmp->phy->init_count) {`
This can also happen if user re-enables runtime-pm via the sysfs
attribute before qmp phy is initialized.
Similarly to other qcom phy drivers, introduce a qmp->phy_initialized
variable that can be used to avoid relying on the possibly uninitialized
phy pointer.
Fixes: e464a31 ("phy: qcom-qmp-usb: split off the legacy USB+dp_com support")
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Runtime PM has to be enabled before creating the PHY, since phy_create() only enables runtime PM on the PHY device if it is already enabled on this parent device. This opens a small window where the device can be runtime suspended after pm_runtime_enable() and before the later pm_runtime_forbid(), causing an unnecessary suspend/resume cycle while the PHY is not yet registered. Take a runtime PM usage reference with pm_runtime_get_noresume() before enabling runtime PM and release it once the PHY has been created to prevent the device from being runtime suspended during that window. This also makes the probe path safe independently of pm_runtime_forbid(), which is a good preparation for potentially dropping the forbid() call in the future and letting runtime PM be enabled by default. Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
qcomlnxci
requested review from
a team,
Pratham Pratap (ppratap-liveroot) and
wcheng-eng
and removed request for
a team
October 9, 2026 13:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Propagate the complete 7-patch v6 series to the Qualcomm USB PHY topic
branch.
The series fixes possible NULL dereferences and runtime PM race conditions
in Qualcomm USB PHY drivers and prevents unnecessary runtime PM suspend
during boot.
All 7 patches from the original series are included in order.
Original series:
https://lore.kernel.org/all/20260722-qcom-usb-phy-fix-null-v6-0-534f7e61b9a6@oss.qualcomm.com/
Target topic branch:
tech/bus/usb/phy