Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2024-12-29 09:12:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

extcon: extcon-max14577: Fix potential work-queue cancellation race

Browse Source 
The extcon IRQ schedules a work item. IRQ is requested using devm while
WQ is cancelld at remove(). This mixing of devm and manual unwinding has
potential case where the WQ has been emptied (.remove() was ran) but
devm unwinding of IRQ was not yet done. It is possible the IRQ is triggered
at this point scheduling new work item to the already flushed queue.

Use new devm_work_autocancel() to remove the remove() and to kill the bug.

Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Chanwoo Choi <cw00.choi@samsung.com>
Link: https://lore.kernel.org/r/ee8545f59ae3a93f0a70f640ecbd7e31cfadbcb9.1623146580.git.matti.vaittinen@fi.rohmeurope.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
This commit is contained in:
Matti Vaittinen 2021-06-08 13:09:55 +03:00 committed by Hans de Goede
parent 7a2c4cc537
commit 14ad76825f
1 changed files with 5 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/extcon/extcon-max14577.c
View File

@ -6,6 +6,7 @@
// Chanwoo Choi <cw00.choi@samsung.com> // Chanwoo Choi <cw00.choi@samsung.com>
// Krzysztof Kozlowski <krzk@kernel.org> // Krzysztof Kozlowski <krzk@kernel.org>
#include <linux/devm-helpers.h>
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/i2c.h> #include <linux/i2c.h>
@ -673,7 +674,10 @@ static int max14577_muic_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, info); platform_set_drvdata(pdev, info);
mutex_init(&info->mutex); mutex_init(&info->mutex);
INIT_WORK(&info->irq_work, max14577_muic_irq_work); ret = devm_work_autocancel(&pdev->dev, &info->irq_work,
max14577_muic_irq_work);
if (ret)
return ret;
switch (max14577->dev_type) { switch (max14577->dev_type) {
case MAXIM_DEVICE_TYPE_MAX77836: case MAXIM_DEVICE_TYPE_MAX77836:
@ -766,15 +770,6 @@ static int max14577_muic_probe(struct platform_device *pdev)
return ret; return ret;
} }
static int max14577_muic_remove(struct platform_device *pdev)
{
struct max14577_muic_info *info = platform_get_drvdata(pdev);
cancel_work_sync(&info->irq_work);
return 0;
}
static const struct platform_device_id max14577_muic_id[] = { static const struct platform_device_id max14577_muic_id[] = {
{ "max14577-muic", MAXIM_DEVICE_TYPE_MAX14577, }, { "max14577-muic", MAXIM_DEVICE_TYPE_MAX14577, },
{ "max77836-muic", MAXIM_DEVICE_TYPE_MAX77836, }, { "max77836-muic", MAXIM_DEVICE_TYPE_MAX77836, },
@ -797,7 +792,6 @@ static struct platform_driver max14577_muic_driver = {
.of_match_table = of_max14577_muic_dt_match, .of_match_table = of_max14577_muic_dt_match,
}, },
.probe = max14577_muic_probe, .probe = max14577_muic_probe,
.remove = max14577_muic_remove,
.id_table = max14577_muic_id, .id_table = max14577_muic_id,
}; };