From 7a2c4cc537fa9f05fe90812e7d789b9faf7eb869 Mon Sep 17 00:00:00 2001 From: Matti Vaittinen Date: Tue, 8 Jun 2021 13:09:34 +0300 Subject: [PATCH 1/5] devm-helpers: Add resource managed version of work init A few drivers which need a work-queue must cancel work at driver detach. Some of those implement remove() solely for this purpose. Help drivers to avoid unnecessary remove and error-branch implementation by adding managed verision of work initialization. This will also help drivers to avoid mixing manual and devm based unwinding when other resources are handled by devm. Signed-off-by: Matti Vaittinen Reviewed-by: Krzysztof Kozlowski Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/94ff4175e7f2ff134ed2fa7d6e7641005cc9784b.1623146580.git.matti.vaittinen@fi.rohmeurope.com Signed-off-by: Hans de Goede --- include/linux/devm-helpers.h | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/include/linux/devm-helpers.h b/include/linux/devm-helpers.h index f40f77717a24..74891802200d 100644 --- a/include/linux/devm-helpers.h +++ b/include/linux/devm-helpers.h @@ -51,4 +51,29 @@ static inline int devm_delayed_work_autocancel(struct device *dev, return devm_add_action(dev, devm_delayed_work_drop, w); } +static inline void devm_work_drop(void *res) +{ + cancel_work_sync(res); +} + +/** + * devm_work_autocancel - Resource-managed work allocation + * @dev: Device which lifetime work is bound to + * @w: Work to be added (and automatically cancelled) + * @worker: Worker function + * + * Initialize work which is automatically cancelled when driver is detached. + * A few drivers need to queue work which must be cancelled before driver + * is detached to avoid accessing removed resources. + * devm_work_autocancel() can be used to omit the explicit + * cancelleation when driver is detached. + */ +static inline int devm_work_autocancel(struct device *dev, + struct work_struct *w, + work_func_t worker) +{ + INIT_WORK(w, worker); + return devm_add_action(dev, devm_work_drop, w); +} + #endif From 14ad76825f00b1471a7ec2eff30528d21ee2772b Mon Sep 17 00:00:00 2001 From: Matti Vaittinen Date: Tue, 8 Jun 2021 13:09:55 +0300 Subject: [PATCH 2/5] extcon: extcon-max14577: Fix potential work-queue cancellation race The extcon IRQ schedules a work item. IRQ is requested using devm while WQ is cancelld at remove(). This mixing of devm and manual unwinding has potential case where the WQ has been emptied (.remove() was ran) but devm unwinding of IRQ was not yet done. It is possible the IRQ is triggered at this point scheduling new work item to the already flushed queue. Use new devm_work_autocancel() to remove the remove() and to kill the bug. Signed-off-by: Matti Vaittinen Reviewed-by: Krzysztof Kozlowski Reviewed-by: Hans de Goede Acked-by: Chanwoo Choi Link: https://lore.kernel.org/r/ee8545f59ae3a93f0a70f640ecbd7e31cfadbcb9.1623146580.git.matti.vaittinen@fi.rohmeurope.com Signed-off-by: Hans de Goede --- drivers/extcon/extcon-max14577.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/extcon/extcon-max14577.c b/drivers/extcon/extcon-max14577.c index ace523924e58..5476f48ed74b 100644 --- a/drivers/extcon/extcon-max14577.c +++ b/drivers/extcon/extcon-max14577.c @@ -6,6 +6,7 @@ // Chanwoo Choi // Krzysztof Kozlowski +#include #include #include #include @@ -673,7 +674,10 @@ static int max14577_muic_probe(struct platform_device *pdev) platform_set_drvdata(pdev, info); mutex_init(&info->mutex); - INIT_WORK(&info->irq_work, max14577_muic_irq_work); + ret = devm_work_autocancel(&pdev->dev, &info->irq_work, + max14577_muic_irq_work); + if (ret) + return ret; switch (max14577->dev_type) { case MAXIM_DEVICE_TYPE_MAX77836: @@ -766,15 +770,6 @@ static int max14577_muic_probe(struct platform_device *pdev) return ret; } -static int max14577_muic_remove(struct platform_device *pdev) -{ - struct max14577_muic_info *info = platform_get_drvdata(pdev); - - cancel_work_sync(&info->irq_work); - - return 0; -} - static const struct platform_device_id max14577_muic_id[] = { { "max14577-muic", MAXIM_DEVICE_TYPE_MAX14577, }, { "max77836-muic", MAXIM_DEVICE_TYPE_MAX77836, }, @@ -797,7 +792,6 @@ static struct platform_driver max14577_muic_driver = { .of_match_table = of_max14577_muic_dt_match, }, .probe = max14577_muic_probe, - .remove = max14577_muic_remove, .id_table = max14577_muic_id, }; From 74047eaa2281982853afa144463ebe18d49022f2 Mon Sep 17 00:00:00 2001 From: Matti Vaittinen Date: Tue, 8 Jun 2021 13:10:11 +0300 Subject: [PATCH 3/5] extcon: extcon-max77693.c: Fix potential work-queue cancellation race The extcon IRQ schedules a work item. IRQ is requested using devm while WQ is cancelld at remove(). This mixing of devm and manual unwinding has potential case where the WQ has been emptied (.remove() was ran) but devm unwinding of IRQ was not yet done. It may be possible the IRQ is triggered at this point scheduling new work item to the already flushed queue. According to the input documentation the input device allocated by devm_input_allocate_device() does not need to be explicitly unregistered. Use the new devm_work_autocancel() and remove the remove() to simplify the code. Signed-off-by: Matti Vaittinen Reviewed-by: Krzysztof Kozlowski Reviewed-by: Hans de Goede Acked-by: Chanwoo Choi Link: https://lore.kernel.org/r/cbe8205eed8276f6e6db5003cfe51b8b0d4ac966.1623146580.git.matti.vaittinen@fi.rohmeurope.com Signed-off-by: Hans de Goede --- drivers/extcon/extcon-max77693.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c index 92af97e00828..1f1d9ab0c5c7 100644 --- a/drivers/extcon/extcon-max77693.c +++ b/drivers/extcon/extcon-max77693.c @@ -5,6 +5,7 @@ // Copyright (C) 2012 Samsung Electrnoics // Chanwoo Choi +#include #include #include #include @@ -1127,7 +1128,10 @@ static int max77693_muic_probe(struct platform_device *pdev) platform_set_drvdata(pdev, info); mutex_init(&info->mutex); - INIT_WORK(&info->irq_work, max77693_muic_irq_work); + ret = devm_work_autocancel(&pdev->dev, &info->irq_work, + max77693_muic_irq_work); + if (ret) + return ret; /* Support irq domain for MAX77693 MUIC device */ for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) { @@ -1254,22 +1258,11 @@ static int max77693_muic_probe(struct platform_device *pdev) return ret; } -static int max77693_muic_remove(struct platform_device *pdev) -{ - struct max77693_muic_info *info = platform_get_drvdata(pdev); - - cancel_work_sync(&info->irq_work); - input_unregister_device(info->dock); - - return 0; -} - static struct platform_driver max77693_muic_driver = { .driver = { .name = DEV_NAME, }, .probe = max77693_muic_probe, - .remove = max77693_muic_remove, }; module_platform_driver(max77693_muic_driver); From 610bdc04830a864115e6928fc944f1171dfff6f3 Mon Sep 17 00:00:00 2001 From: Matti Vaittinen Date: Tue, 8 Jun 2021 13:10:31 +0300 Subject: [PATCH 4/5] extcon: extcon-max8997: Fix IRQ freeing at error path If reading MAX8997_MUIC_REG_STATUS1 fails at probe the driver exits without freeing the requested IRQs. Free the IRQs prior returning if reading the status fails. Fixes: 3e34c8198960 ("extcon: max8997: Avoid forcing UART path on drive probe") Signed-off-by: Matti Vaittinen Reviewed-by: Hans de Goede Acked-by: Chanwoo Choi Link: https://lore.kernel.org/r/27ee4a48ee775c3f8c9d90459c18b6f2b15edc76.1623146580.git.matti.vaittinen@fi.rohmeurope.com Signed-off-by: Hans de Goede --- drivers/extcon/extcon-max8997.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c index e1408075ef7d..c15a612067af 100644 --- a/drivers/extcon/extcon-max8997.c +++ b/drivers/extcon/extcon-max8997.c @@ -733,7 +733,7 @@ static int max8997_muic_probe(struct platform_device *pdev) 2, info->status); if (ret) { dev_err(info->dev, "failed to read MUIC register\n"); - return ret; + goto err_irq; } cable_type = max8997_muic_get_cable_type(info, MAX8997_CABLE_GROUP_ADC, &attached); From 87ee8de23c9df3a368504f34cf3d7f9be9207717 Mon Sep 17 00:00:00 2001 From: Matti Vaittinen Date: Tue, 8 Jun 2021 13:10:53 +0300 Subject: [PATCH 5/5] extcon: extcon-max8997: Simplify driver using devm Simplify driver by switching to use the resource managed IRQ requesting and resource managed work-queue initialization. Signed-off-by: Matti Vaittinen Reviewed-by: Hans de Goede Acked-by: Chanwoo Choi Link: https://lore.kernel.org/r/61190cc280a63baeb05ec570282bb3677bee8e7b.1623146580.git.matti.vaittinen@fi.rohmeurope.com Signed-off-by: Hans de Goede --- drivers/extcon/extcon-max8997.c | 47 +++++++++++---------------------- 1 file changed, 16 insertions(+), 31 deletions(-) diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c index c15a612067af..bbc592823570 100644 --- a/drivers/extcon/extcon-max8997.c +++ b/drivers/extcon/extcon-max8997.c @@ -5,6 +5,7 @@ // Copyright (C) 2012 Samsung Electronics // Donggeun Kim +#include #include #include #include @@ -650,27 +651,30 @@ static int max8997_muic_probe(struct platform_device *pdev) mutex_init(&info->mutex); INIT_WORK(&info->irq_work, max8997_muic_irq_work); + ret = devm_work_autocancel(&pdev->dev, &info->irq_work, + max8997_muic_irq_work); + if (ret) + return ret; for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) { struct max8997_muic_irq *muic_irq = &muic_irqs[i]; unsigned int virq = 0; virq = irq_create_mapping(max8997->irq_domain, muic_irq->irq); - if (!virq) { - ret = -EINVAL; - goto err_irq; - } + if (!virq) + return -EINVAL; + muic_irq->virq = virq; - ret = request_threaded_irq(virq, NULL, - max8997_muic_irq_handler, - IRQF_NO_SUSPEND, - muic_irq->name, info); + ret = devm_request_threaded_irq(&pdev->dev, virq, NULL, + max8997_muic_irq_handler, + IRQF_NO_SUSPEND, + muic_irq->name, info); if (ret) { dev_err(&pdev->dev, "failed: irq request (IRQ: %d, error :%d)\n", muic_irq->irq, ret); - goto err_irq; + return ret; } } @@ -678,14 +682,13 @@ static int max8997_muic_probe(struct platform_device *pdev) info->edev = devm_extcon_dev_allocate(&pdev->dev, max8997_extcon_cable); if (IS_ERR(info->edev)) { dev_err(&pdev->dev, "failed to allocate memory for extcon\n"); - ret = PTR_ERR(info->edev); - goto err_irq; + return PTR_ERR(info->edev); } ret = devm_extcon_dev_register(&pdev->dev, info->edev); if (ret) { dev_err(&pdev->dev, "failed to register extcon device\n"); - goto err_irq; + return ret; } if (pdata && pdata->muic_pdata) { @@ -733,7 +736,7 @@ static int max8997_muic_probe(struct platform_device *pdev) 2, info->status); if (ret) { dev_err(info->dev, "failed to read MUIC register\n"); - goto err_irq; + return ret; } cable_type = max8997_muic_get_cable_type(info, MAX8997_CABLE_GROUP_ADC, &attached); @@ -756,23 +759,6 @@ static int max8997_muic_probe(struct platform_device *pdev) delay_jiffies); return 0; - -err_irq: - while (--i >= 0) - free_irq(muic_irqs[i].virq, info); - return ret; -} - -static int max8997_muic_remove(struct platform_device *pdev) -{ - struct max8997_muic_info *info = platform_get_drvdata(pdev); - int i; - - for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) - free_irq(muic_irqs[i].virq, info); - cancel_work_sync(&info->irq_work); - - return 0; } static struct platform_driver max8997_muic_driver = { @@ -780,7 +766,6 @@ static struct platform_driver max8997_muic_driver = { .name = DEV_NAME, }, .probe = max8997_muic_probe, - .remove = max8997_muic_remove, }; module_platform_driver(max8997_muic_driver);