[PATCH v7 phy-next 14/27] usb: gadget: tegra-xudc: avoid direct dereference of phy->dev.of_node
Vladimir Oltean
vladimir.oltean at nxp.com
Tue May 5 02:34:51 PDT 2026
Sashiko says:
> commit 1ca88ec2e954b3a331eb5afb8081406d9200c8f6
> Author: Vladimir Oltean <vladimir.oltean at nxp.com>
> usb: gadget: tegra-xudc: avoid direct dereference of phy->dev.of_node
>
> This commit replaces direct dereferences of the device tree node with a
> parallel lookup using the phys phandle and the padctl provider. It also
> introduces a local usbphy variable to hold the output and simplify error
> checks.
>
> > diff --git a/drivers/usb/gadget/udc/tegra-xudc.c b/drivers/usb/gadget/udc/tegra-xudc.c
> > index e9d33be028664..cf4e6c87e44da 100644
> > --- a/drivers/usb/gadget/udc/tegra-xudc.c
> > +++ b/drivers/usb/gadget/udc/tegra-xudc.c
> [ ... ]
> > @@ -3515,7 +3516,10 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc)
> > xudc->vbus_nb.notifier_call = tegra_xudc_vbus_notify;
> >
> > for (i = 0; i < xudc->soc->num_phys; i++) {
> > + struct of_phandle_args args;
> > char phy_name[] = "usb.-.";
> > + struct usb_phy *usbphy;
> > + int index, err;
>
> This declares a local err variable inside the loop, shadowing the outer
> err variable from the function scope.
> Later in this loop, if devm_phy_optional_get() or devm_usb_get_phy_by_node()
> fails, the code assigns the error code to this inner err and uses goto
> clean_up.
> Since the inner err is destroyed when leaving the loop block, will the
> function incorrectly return the outer err which is still 0?
This is correct, I've removed the duplicated "err" variable declaration
for v8.
> >
> > /* Get USB2 phy */
> > snprintf(phy_name, sizeof(phy_name), "usb2-%d", i);
> [ ... ]
> > @@ -3525,22 +3529,31 @@ static int tegra_xudc_phy_get(struct tegra_xudc *xudc)
> > dev_err_probe(xudc->dev, err,
> > "failed to get PHY for phy-name usb2-%d\n", i);
> > goto clean_up;
> > - } else if (xudc->utmi_phy[i]) {
> [ ... ]
> > } else if (!xudc->utmi_phy[i]) {
> > /* if utmi phy is not available, ignore USB3 phy get */
> > continue;
> > }
> >
> > + index = of_property_match_string(np, "phy-names", phy_name);
> > + if (index < 0)
> > + continue;
> > +
> > + err = of_parse_phandle_with_args(np, "phys", "#phy-cells",
> > + index, &args);
> > + if (err)
> > + continue;
>
> If either of these device tree parsing steps fail, the code uses continue
> to skip to the next iteration.
> Does this unintentionally skip the entire USB3 PHY initialization block
> that follows later in this loop for the current port?
This is correct, although theoretically of_property_match_string() and
of_parse_phandle_with_args() should not fail as long as devm_phy_optional_get()
succeeded for that very same phy_name starting from the very same OF node.
But nonetheless, if this happens due to bugs, I've instead treated the
condition as fatal and printed error messages for v8.
> > +
> > + /* Get usb-phy, if utmi phy is available */
> > + usbphy = devm_usb_get_phy_by_node(xudc->dev, args.np, NULL);
> > + of_node_put(args.np);
> [ ... ]
More information about the linux-arm-kernel
mailing list