| Message ID | 20220502080456.21568-1-u.kleine-koenig@pengutronix.de (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | bbc126ae381cf0a27822c1f822d0aeed74cc40d9 |
| Headers | show |
| Series | usb: typec: tcpci: Don't skip cleanup in .remove() on error | expand |
On Mon, May 02, 2022 at 10:04:56AM +0200, Uwe Kleine-König wrote: > Returning an error value in an i2c remove callback results in an error > message being emitted by the i2c core, but otherwise it doesn't make a > difference. The device goes away anyhow and the devm cleanups are > called. > > In this case the remove callback even returns early without stopping the > tcpm worker thread and various timers. A work scheduled on the work > queue, or a firing timer after tcpci_remove() returned probably results > in a use-after-free situation because the regmap and driver data were > freed. So better make sure that tcpci_unregister_port() is called even > if disabling the irq failed. > > Also emit a more specific error message instead of the i2c core's > "remove failed (EIO), will be ignored" and return 0 to suppress the > core's warning. > > This patch is (also) a preparation for making i2c remove callbacks > return void. > > Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver") > Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com> > --- > drivers/usb/typec/tcpm/tcpci.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c > index e07d26a3cd8e..f33e08eb7670 100644 > --- a/drivers/usb/typec/tcpm/tcpci.c > +++ b/drivers/usb/typec/tcpm/tcpci.c > @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client) > /* Disable chip interrupts before unregistering port */ > err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); > if (err < 0) > - return err; > + dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); > > tcpci_unregister_port(chip->tcpci); > > > base-commit: 3123109284176b1532874591f7c81f3837bbdc17 > -- > 2.35.1 thanks,
On 5/2/22 01:04, Uwe Kleine-König wrote: > Returning an error value in an i2c remove callback results in an error > message being emitted by the i2c core, but otherwise it doesn't make a > difference. The device goes away anyhow and the devm cleanups are > called. > > In this case the remove callback even returns early without stopping the > tcpm worker thread and various timers. A work scheduled on the work > queue, or a firing timer after tcpci_remove() returned probably results > in a use-after-free situation because the regmap and driver data were > freed. So better make sure that tcpci_unregister_port() is called even > if disabling the irq failed. > > Also emit a more specific error message instead of the i2c core's > "remove failed (EIO), will be ignored" and return 0 to suppress the > core's warning. > > This patch is (also) a preparation for making i2c remove callbacks > return void. > > Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver") > Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Guenter Roeck <linux@roeck-us.net> > --- > drivers/usb/typec/tcpm/tcpci.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c > index e07d26a3cd8e..f33e08eb7670 100644 > --- a/drivers/usb/typec/tcpm/tcpci.c > +++ b/drivers/usb/typec/tcpm/tcpci.c > @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client) > /* Disable chip interrupts before unregistering port */ > err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); > if (err < 0) > - return err; > + dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); > > tcpci_unregister_port(chip->tcpci); > > > base-commit: 3123109284176b1532874591f7c81f3837bbdc17
On Mon, May 02, 2022 at 10:04:56AM +0200, Uwe Kleine-König wrote: > Returning an error value in an i2c remove callback results in an error > message being emitted by the i2c core, but otherwise it doesn't make a > difference. The device goes away anyhow and the devm cleanups are > called. > > In this case the remove callback even returns early without stopping the > tcpm worker thread and various timers. A work scheduled on the work > queue, or a firing timer after tcpci_remove() returned probably results > in a use-after-free situation because the regmap and driver data were > freed. So better make sure that tcpci_unregister_port() is called even > if disabling the irq failed. > > Also emit a more specific error message instead of the i2c core's > "remove failed (EIO), will be ignored" and return 0 to suppress the > core's warning. > > This patch is (also) a preparation for making i2c remove callbacks > return void. > > Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver") > Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Reviewed-by: Guenter Roeck <linux@roeck-us.net> > --- > drivers/usb/typec/tcpm/tcpci.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c > index e07d26a3cd8e..f33e08eb7670 100644 > --- a/drivers/usb/typec/tcpm/tcpci.c > +++ b/drivers/usb/typec/tcpm/tcpci.c > @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client) > /* Disable chip interrupts before unregistering port */ > err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); > if (err < 0) > - return err; > + dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); > > tcpci_unregister_port(chip->tcpci); > > > base-commit: 3123109284176b1532874591f7c81f3837bbdc17 > -- > 2.35.1 >
diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c index e07d26a3cd8e..f33e08eb7670 100644 --- a/drivers/usb/typec/tcpm/tcpci.c +++ b/drivers/usb/typec/tcpm/tcpci.c @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client) /* Disable chip interrupts before unregistering port */ err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0); if (err < 0) - return err; + dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err)); tcpci_unregister_port(chip->tcpci);
Returning an error value in an i2c remove callback results in an error message being emitted by the i2c core, but otherwise it doesn't make a difference. The device goes away anyhow and the devm cleanups are called. In this case the remove callback even returns early without stopping the tcpm worker thread and various timers. A work scheduled on the work queue, or a firing timer after tcpci_remove() returned probably results in a use-after-free situation because the regmap and driver data were freed. So better make sure that tcpci_unregister_port() is called even if disabling the irq failed. Also emit a more specific error message instead of the i2c core's "remove failed (EIO), will be ignored" and return 0 to suppress the core's warning. This patch is (also) a preparation for making i2c remove callbacks return void. Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver") Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> --- drivers/usb/typec/tcpm/tcpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) base-commit: 3123109284176b1532874591f7c81f3837bbdc17