All of lore.kernel.org
 help / color / mirror / Atom feed
From: b-liu@ti.com (Bin Liu)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH] usb: musb: sunxi: Explicitly release USB PHY on exit
Date: Mon, 9 Oct 2017 21:14:39 -0500	[thread overview]
Message-ID: <20171010021439.GH12182@LTA0271908.dhcp.ti.com> (raw)
In-Reply-To: <CANwerB2kbxnhrgWAnmWB9Uzp+M1MjC7MwWuwLXw==dpdCRLCAA@mail.gmail.com>

On Tue, Oct 10, 2017 at 08:17:34AM +1100, Jonathan Liu wrote:
> Hi,
> 
> On 10 October 2017 at 01:23, Bin Liu <b-liu@ti.com> wrote:
> > Hi,
> >
> > On Tue, Sep 26, 2017 at 09:39:23PM +1000, Jonathan Liu wrote:
> >> This fixes a kernel oops when unloading the driver due to usb_put_phy
> >> being called after usb_phy_generic_unregister when the device is
> >> detached. Calling usb_phy_generic_unregister causes x->dev->driver to
> >> be NULL in usb_put_phy and results in a NULL pointer dereference.
> >>
> >> As we are now explicitly managing the lifetime of usb_phy,
> >> devm_usb_get_phy is changed to usb_get_phy and we call usb_put_phy in
> >> the probe error path.
> >>
> >> Cc: stable at vger.kernel.org # v4.3+
> >> Signed-off-by: Jonathan Liu <net147@gmail.com>
> >> ---
> >>  drivers/usb/musb/sunxi.c | 8 ++++++--
> >>  1 file changed, 6 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c
> >> index c9a09b5bb6e5..8eed61042103 100644
> >> --- a/drivers/usb/musb/sunxi.c
> >> +++ b/drivers/usb/musb/sunxi.c
> >> @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb)
> >>       if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags))
> >>               sunxi_sram_release(musb->controller->parent);
> >>
> >> +     usb_put_phy(glue->xceiv);
> >
> > Will devm_usb_put_phy() solve the issue too? Then you don't need the
> > changes in sunxi_musb_probe() below.
> >
> 
> devm_usb_put_phy does solve the issue without changes in
> sunxi_musb_probe but I think it is clearer that the lifetime is
> explicitly managed if we don't mix implicit and explicit freeing of
> resources.

Then what is the purpose of the devm_* API?

The original bug was that devm_usb_get_phy() is called in _probe, but
devm_usb_put_phy() was never called, which caused the device ref count
unbalanced. It is not related to implicit/explicit resource management.

devm_* is recommended whenever applicable.

Regards,
-Bin.

WARNING: multiple messages have this Message-ID (diff)
From: Bin Liu <b-liu@ti.com>
To: Jonathan Liu <net147@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Maxime Ripard <maxime.ripard@free-electrons.com>,
	Chen-Yu Tsai <wens@csie.org>, <linux-usb@vger.kernel.org>,
	linux-arm-kernel <linux-arm-kernel@lists.infradead.org>,
	linux-kernel <linux-kernel@vger.kernel.org>,
	linux-sunxi <linux-sunxi@googlegroups.com>
Subject: Re: [PATCH] usb: musb: sunxi: Explicitly release USB PHY on exit
Date: Mon, 9 Oct 2017 21:14:39 -0500	[thread overview]
Message-ID: <20171010021439.GH12182@LTA0271908.dhcp.ti.com> (raw)
In-Reply-To: <CANwerB2kbxnhrgWAnmWB9Uzp+M1MjC7MwWuwLXw==dpdCRLCAA@mail.gmail.com>

On Tue, Oct 10, 2017 at 08:17:34AM +1100, Jonathan Liu wrote:
> Hi,
> 
> On 10 October 2017 at 01:23, Bin Liu <b-liu@ti.com> wrote:
> > Hi,
> >
> > On Tue, Sep 26, 2017 at 09:39:23PM +1000, Jonathan Liu wrote:
> >> This fixes a kernel oops when unloading the driver due to usb_put_phy
> >> being called after usb_phy_generic_unregister when the device is
> >> detached. Calling usb_phy_generic_unregister causes x->dev->driver to
> >> be NULL in usb_put_phy and results in a NULL pointer dereference.
> >>
> >> As we are now explicitly managing the lifetime of usb_phy,
> >> devm_usb_get_phy is changed to usb_get_phy and we call usb_put_phy in
> >> the probe error path.
> >>
> >> Cc: stable@vger.kernel.org # v4.3+
> >> Signed-off-by: Jonathan Liu <net147@gmail.com>
> >> ---
> >>  drivers/usb/musb/sunxi.c | 8 ++++++--
> >>  1 file changed, 6 insertions(+), 2 deletions(-)
> >>
> >> diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c
> >> index c9a09b5bb6e5..8eed61042103 100644
> >> --- a/drivers/usb/musb/sunxi.c
> >> +++ b/drivers/usb/musb/sunxi.c
> >> @@ -297,6 +297,8 @@ static int sunxi_musb_exit(struct musb *musb)
> >>       if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags))
> >>               sunxi_sram_release(musb->controller->parent);
> >>
> >> +     usb_put_phy(glue->xceiv);
> >
> > Will devm_usb_put_phy() solve the issue too? Then you don't need the
> > changes in sunxi_musb_probe() below.
> >
> 
> devm_usb_put_phy does solve the issue without changes in
> sunxi_musb_probe but I think it is clearer that the lifetime is
> explicitly managed if we don't mix implicit and explicit freeing of
> resources.

Then what is the purpose of the devm_* API?

The original bug was that devm_usb_get_phy() is called in _probe, but
devm_usb_put_phy() was never called, which caused the device ref count
unbalanced. It is not related to implicit/explicit resource management.

devm_* is recommended whenever applicable.

Regards,
-Bin.

  reply	other threads:[~2017-10-10  2:14 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-09-26 11:39 [PATCH] usb: musb: sunxi: Explicitly release USB PHY on exit Jonathan Liu
2017-09-26 11:39 ` Jonathan Liu
2017-09-26 11:42 ` Jonathan Liu
2017-09-26 11:42   ` Jonathan Liu
2017-10-09 14:23 ` Bin Liu
2017-10-09 14:23   ` Bin Liu
2017-10-09 21:17   ` Jonathan Liu
2017-10-09 21:17     ` Jonathan Liu
2017-10-10  2:14     ` Bin Liu [this message]
2017-10-10  2:14       ` Bin Liu
2017-10-10  2:43       ` Jonathan Liu
2017-10-10  2:43         ` Jonathan Liu

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20171010021439.GH12182@LTA0271908.dhcp.ti.com \
    --to=b-liu@ti.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.