| Message ID | 20171010024525.21971-1-net147@gmail.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Tue, Oct 10, 2017 at 01:45:25PM +1100, Jonathan Liu wrote: > This fixes a kernel oops when unloading the driver due to usb_put_phy > being called after usb_phy_generic_unregister when the device is > detached. Calling usb_phy_generic_unregister causes x->dev->driver to > be NULL in usb_put_phy and results in a NULL pointer dereference. > > Cc: stable@vger.kernel.org # v4.3+ > Signed-off-by: Jonathan Liu <net147@gmail.com> > --- > Changes for v2: > - Use devm_usb_put_phy instead of usb_put_phy > > drivers/usb/musb/sunxi.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c > index c9a09b5bb6e5..dc353e24d53c 100644 > --- a/drivers/usb/musb/sunxi.c > +++ b/drivers/usb/musb/sunxi.c > @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb) > if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) > sunxi_sram_release(musb->controller->parent); > > + devm_usb_put_phy(glue->dev, glue->xceiv); > + > return 0; > } Applied. Thanks. -Bin.
On 10 October 2017 at 14:22, Bin Liu <b-liu@ti.com> wrote: > On Tue, Oct 10, 2017 at 01:45:25PM +1100, Jonathan Liu wrote: >> This fixes a kernel oops when unloading the driver due to usb_put_phy >> being called after usb_phy_generic_unregister when the device is >> detached. Calling usb_phy_generic_unregister causes x->dev->driver to >> be NULL in usb_put_phy and results in a NULL pointer dereference. >> >> Cc: stable@vger.kernel.org # v4.3+ >> Signed-off-by: Jonathan Liu <net147@gmail.com> >> --- >> Changes for v2: >> - Use devm_usb_put_phy instead of usb_put_phy >> >> drivers/usb/musb/sunxi.c | 2 ++ >> 1 file changed, 2 insertions(+) >> >> diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c >> index c9a09b5bb6e5..dc353e24d53c 100644 >> --- a/drivers/usb/musb/sunxi.c >> +++ b/drivers/usb/musb/sunxi.c >> @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb) >> if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) >> sunxi_sram_release(musb->controller->parent); >> >> + devm_usb_put_phy(glue->dev, glue->xceiv); >> + >> return 0; >> } > > > Applied. Thanks. > -Bin. Which repository was it applied to? Regards, Jonathan
On Mon, Oct 16, 2017 at 04:13:51PM +1100, Jonathan Liu wrote: > On 10 October 2017 at 14:22, Bin Liu <b-liu@ti.com> wrote: > > On Tue, Oct 10, 2017 at 01:45:25PM +1100, Jonathan Liu wrote: > >> This fixes a kernel oops when unloading the driver due to usb_put_phy > >> being called after usb_phy_generic_unregister when the device is > >> detached. Calling usb_phy_generic_unregister causes x->dev->driver to > >> be NULL in usb_put_phy and results in a NULL pointer dereference. > >> > >> Cc: stable@vger.kernel.org # v4.3+ > >> Signed-off-by: Jonathan Liu <net147@gmail.com> > >> --- > >> Changes for v2: > >> - Use devm_usb_put_phy instead of usb_put_phy > >> > >> drivers/usb/musb/sunxi.c | 2 ++ > >> 1 file changed, 2 insertions(+) > >> > >> diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c > >> index c9a09b5bb6e5..dc353e24d53c 100644 > >> --- a/drivers/usb/musb/sunxi.c > >> +++ b/drivers/usb/musb/sunxi.c > >> @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb) > >> if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) > >> sunxi_sram_release(musb->controller->parent); > >> > >> + devm_usb_put_phy(glue->dev, glue->xceiv); > >> + > >> return 0; > >> } > > > > > > > Applied. Thanks. > > -Bin. > > Which repository was it applied to? I don't have a public repo (yet), but the patch has been sent to Greg, so it should be merged into the next -rc. Regards, -Bin.
On 16 October 2017 at 23:49, Bin Liu <b-liu@ti.com> wrote: > On Mon, Oct 16, 2017 at 04:13:51PM +1100, Jonathan Liu wrote: >> On 10 October 2017 at 14:22, Bin Liu <b-liu@ti.com> wrote: >> > On Tue, Oct 10, 2017 at 01:45:25PM +1100, Jonathan Liu wrote: >> >> This fixes a kernel oops when unloading the driver due to usb_put_phy >> >> being called after usb_phy_generic_unregister when the device is >> >> detached. Calling usb_phy_generic_unregister causes x->dev->driver to >> >> be NULL in usb_put_phy and results in a NULL pointer dereference. >> >> >> >> Cc: stable@vger.kernel.org # v4.3+ >> >> Signed-off-by: Jonathan Liu <net147@gmail.com> >> >> --- >> >> Changes for v2: >> >> - Use devm_usb_put_phy instead of usb_put_phy >> >> >> >> drivers/usb/musb/sunxi.c | 2 ++ >> >> 1 file changed, 2 insertions(+) >> >> >> >> diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c >> >> index c9a09b5bb6e5..dc353e24d53c 100644 >> >> --- a/drivers/usb/musb/sunxi.c >> >> +++ b/drivers/usb/musb/sunxi.c >> >> @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb) >> >> if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) >> >> sunxi_sram_release(musb->controller->parent); >> >> >> >> + devm_usb_put_phy(glue->dev, glue->xceiv); >> >> + >> >> return 0; >> >> } >> > >> > >> >> > Applied. Thanks. >> > -Bin. >> >> Which repository was it applied to? > > I don't have a public repo (yet), but the patch has been sent to Greg, > so it should be merged into the next -rc. > > Regards, > -Bin. The MAINTAINERS file has git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb.git listed as the tree for drivers/usb/musb/. I guess that should be updated. Regards, Jonathan
On Mon, Oct 16, 2017 at 11:54:27PM +1100, Jonathan Liu wrote: > On 16 October 2017 at 23:49, Bin Liu <b-liu@ti.com> wrote: > > On Mon, Oct 16, 2017 at 04:13:51PM +1100, Jonathan Liu wrote: > >> On 10 October 2017 at 14:22, Bin Liu <b-liu@ti.com> wrote: > >> > On Tue, Oct 10, 2017 at 01:45:25PM +1100, Jonathan Liu wrote: > >> >> This fixes a kernel oops when unloading the driver due to usb_put_phy > >> >> being called after usb_phy_generic_unregister when the device is > >> >> detached. Calling usb_phy_generic_unregister causes x->dev->driver to > >> >> be NULL in usb_put_phy and results in a NULL pointer dereference. > >> >> > >> >> Cc: stable@vger.kernel.org # v4.3+ > >> >> Signed-off-by: Jonathan Liu <net147@gmail.com> > >> >> --- > >> >> Changes for v2: > >> >> - Use devm_usb_put_phy instead of usb_put_phy > >> >> > >> >> drivers/usb/musb/sunxi.c | 2 ++ > >> >> 1 file changed, 2 insertions(+) > >> >> > >> >> diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c > >> >> index c9a09b5bb6e5..dc353e24d53c 100644 > >> >> --- a/drivers/usb/musb/sunxi.c > >> >> +++ b/drivers/usb/musb/sunxi.c > >> >> @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb) > >> >> if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) > >> >> sunxi_sram_release(musb->controller->parent); > >> >> > >> >> + devm_usb_put_phy(glue->dev, glue->xceiv); > >> >> + > >> >> return 0; > >> >> } > >> > > >> > > >> > >> > Applied. Thanks. > >> > -Bin. > >> > >> Which repository was it applied to? > > > > I don't have a public repo (yet), but the patch has been sent to Greg, > > so it should be merged into the next -rc. > > > > Regards, > > -Bin. > > The MAINTAINERS file has > git://git.kernel.org/pub/scm/linux/kernel/git/balbi/usb.git listed as > the tree for drivers/usb/musb/. I guess that should be updated. I will create a patch for it. Thanks for reporting this. Regards, -Bin.
diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c index c9a09b5bb6e5..dc353e24d53c 100644 --- a/drivers/usb/musb/sunxi.c +++ b/drivers/usb/musb/sunxi.c @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb) if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) sunxi_sram_release(musb->controller->parent); + devm_usb_put_phy(glue->dev, glue->xceiv); + return 0; }
This fixes a kernel oops when unloading the driver due to usb_put_phy being called after usb_phy_generic_unregister when the device is detached. Calling usb_phy_generic_unregister causes x->dev->driver to be NULL in usb_put_phy and results in a NULL pointer dereference. Cc: stable@vger.kernel.org # v4.3+ Signed-off-by: Jonathan Liu <net147@gmail.com> --- Changes for v2: - Use devm_usb_put_phy instead of usb_put_phy drivers/usb/musb/sunxi.c | 2 ++ 1 file changed, 2 insertions(+)