From patchwork Thu May 31 14:45:52 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Johan Hovold X-Patchwork-Id: 10441265 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E9548602BC for ; Thu, 31 May 2018 14:46:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D75D72971C for ; Thu, 31 May 2018 14:46:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CC0F12973C; Thu, 31 May 2018 14:46:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7944129728 for ; Thu, 31 May 2018 14:46:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755505AbeEaOqO (ORCPT ); Thu, 31 May 2018 10:46:14 -0400 Received: from mail-lf0-f67.google.com ([209.85.215.67]:34487 "EHLO mail-lf0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755437AbeEaOqL (ORCPT ); Thu, 31 May 2018 10:46:11 -0400 Received: by mail-lf0-f67.google.com with SMTP id o9-v6so10145440lfk.1 for ; Thu, 31 May 2018 07:46:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=sender:from:to:cc:subject:date:message-id; bh=F0tWpYoAO2naCRrYWfxJxmJTu2/ZdE2Uw391zjuWggs=; b=DbCBJlKctnCJyDzgtcoO1AMCVpDGxISRBwYQtZRz2nUtpER0UCgH+hOa+Rj28Z8GMF 0z0bihNppct+T+3wJvL3Lh14ToUuvsJOHWbs8JL3gx8yvc5kRO4OG95l2wRh3oa7YKe0 oJSpkHRGvKtSmsJ0EoUB1tO5Ni2KMNdP4ZWIaB1Ui2ZTXhiHSa/OmfI0pN0R8TtrUDIB X1383JRWSBOOnG56yBEDBpzNiHOn3hv2sftGVm/KmeOMnRAVg4W82XaA8y19NreYJ3Lx trY4jeBmVgvFKB3LY57+WgDNEQpICf9rvTMKREFRJtU1zaLv3okkpGl/1B1kuvmhBWAo zw+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:from:to:cc:subject:date:message-id; bh=F0tWpYoAO2naCRrYWfxJxmJTu2/ZdE2Uw391zjuWggs=; b=Jd/mQtRWL8Vjp5jYC5gOycMD5HrDHycD0Wzw4w1Jx6sKdjgYRFSX8JTPlAOofc/lqe FqZudnP+5ve+vJUVdqCybMdgEnociXvROtLub+U61N+BRg7HGWMtCdbpe9M/4u7WorPM nqzogZRKuy5bVbkY2oBNSrZPMV4xPSzqfcvj69UQOqOyljJ/XDNvjlcu6OhKOIu+5ISh xEkLhqLpcs92Fe/P60skfZgid7f8ZJae5ohAco5QDd9AOS5vqfRIRyvnIPaKS2edae0n fsCsZpZh/htoV/rEaHL7F3YnnYNWcQG/EZeJGpYCOOBeY78kZG6fI/8LZ3Yd6e4A7tRs oRJw== X-Gm-Message-State: ALKqPwc9wykJXAhWAQ0jRF9gc+PrjbPZwDtEePqV/MU79Qk06emvuTF9 yDSZh317c1tMVMTFt69uWvVHK5XQ X-Google-Smtp-Source: ADUXVKIQFrkEpHqjmz/Ies9PXGvt8FyRlInGS+HQpXhidCsfa386w+ZzTX5aV8CSkQWi8YhcyNbASw== X-Received: by 2002:a19:1f51:: with SMTP id f78-v6mr4706922lff.42.1527777970052; Thu, 31 May 2018 07:46:10 -0700 (PDT) Received: from xi.terra (c-8bb2e655.07-184-6d6c6d4.bbcust.telenor.se. [85.230.178.139]) by smtp.gmail.com with ESMTPSA id d22-v6sm7613431ljg.44.2018.05.31.07.46.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 31 May 2018 07:46:09 -0700 (PDT) Received: from johan by xi.terra with local (Exim 4.90_1) (envelope-from ) id 1fOOq6-0007Ya-7K; Thu, 31 May 2018 16:46:06 +0200 From: Johan Hovold To: Felipe Balbi Cc: Greg Kroah-Hartman , Alan Stern , linux-usb@vger.kernel.org, Roger Quadros , Johan Hovold Subject: [PATCH] usb: dwc3: of-simple: fix use-after-free on remove Date: Thu, 31 May 2018 16:45:52 +0200 Message-Id: <20180531144552.29007-1-johan@kernel.org> X-Mailer: git-send-email 2.17.1 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The clocks have already been explicitly disabled and put as part of remove() so the runtime suspend callback must not be run when balancing the runtime PM usage count before returning. Fixes: 16adc674d0d6 ("usb: dwc3: add generic OF glue layer") Signed-off-by: Johan Hovold --- Changes in v2 - balance usage count only after disabling runtime PM to avoid racing with pm_runtime_suspend() as suggested by Alan drivers/usb/dwc3/dwc3-of-simple.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c index cb2ee96fd3e8..048922d549dd 100644 --- a/drivers/usb/dwc3/dwc3-of-simple.c +++ b/drivers/usb/dwc3/dwc3-of-simple.c @@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev) reset_control_put(simple->resets); - pm_runtime_put_sync(dev); pm_runtime_disable(dev); + pm_runtime_put_noidle(dev); + pm_runtime_set_suspended(dev); return 0; }