[PATCH v6 3/3] phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support

[sashiko-bot at kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] phy: nuvoton: uninitialized stack variable usage in ma35_role_sw_get()
--

commit 801a123466a572aa070fd7a885bb27adf3f83110
Author: Joey Lu <a0987203069 at gmail.com>

phy: nuvoton: phy-ma35d1-usb2: extend to dual-port with OTG support

This commit extends the Nuvoton MA35D1 USB 2.0 PHY driver to manage both
PHY0 and PHY1, handling host and device modes. It introduces a single init
callback instead of separate power_on/power_off callbacks and adds a USB
role switch for PHY0. New device-tree properties for resistor calibration
and over-current polarity are also supported.

> diff --git a/drivers/phy/nuvoton/phy-ma35d1-usb2.c b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> index 9a459b700ed48..547c7d55d8ff4 100644
> --- a/drivers/phy/nuvoton/phy-ma35d1-usb2.c
> +++ b/drivers/phy/nuvoton/phy-ma35d1-usb2.c
[ ... ]
> +static enum usb_role ma35_role_sw_get(struct usb_role_switch *sw)
> +{
> +	struct ma35_usb_phy *p = usb_role_switch_get_drvdata(sw);
> +	u32 val;
> +
> +	regmap_read(p->sysreg, MA35_SYS_PWRONOTP, &val);
> +
> +	return (val & PWRONOTP_USBP0ID) ? USB_ROLE_HOST : USB_ROLE_DEVICE;
> +}

[Severity: Medium]
Does this code use an uninitialized stack variable if regmap_read() fails?

If regmap_read() returns a negative error code, the out-parameter val will
remain uninitialized. The subsequent check of val & PWRONOTP_USBP0ID would
then evaluate uninitialized kernel stack memory.

This could report an unreliable hardware state to the USB role framework and
leak a bit of kernel stack memory to userspace via the sysfs interface.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929020854.1282339-1-a0987203069@gmail.com?part=3