From: Benson Leung <bleung@google.com>
To: Andrei Kuchynski <akuchynski@chromium.org>
Cc: Heikki Krogerus <heikki.krogerus@linux.intel.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>,
Benson Leung <bleung@chromium.org>,
"Christian A. Ehrhardt" <lk@c--e.de>,
Jameson Thies <jthies@google.com>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
stable@vger.kernel.org
Subject: Re: [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access
Date: Thu, 6 Mar 2025 20:28:02 +0000 [thread overview]
Message-ID: <Z8oFUiazzBTKnGRB@google.com> (raw)
In-Reply-To: <20250305111739.1489003-2-akuchynski@chromium.org>
[-- Attachment #1: Type: text/plain, Size: 2408 bytes --]
Hi Andrei,
On Wed, Mar 05, 2025 at 11:17:39AM +0000, Andrei Kuchynski wrote:
> Resources should be released only after all threads that utilize them
> have been destroyed.
> This commit ensures that resources are not released prematurely by waiting
> for the associated workqueue to complete before deallocating them.
>
> Cc: stable@vger.kernel.org
> Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking")
> Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
> ---
> drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index fcf499cc9458..43b4f8207bb3 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -1825,11 +1825,11 @@ static int ucsi_init(struct ucsi *ucsi)
>
> err_unregister:
> for (con = connector; con->port; con++) {
> + if (con->wq)
> + destroy_workqueue(con->wq);
> ucsi_unregister_partner(con);
> ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
> ucsi_unregister_port_psy(con);
> - if (con->wq)
> - destroy_workqueue(con->wq);
>
> usb_power_delivery_unregister_capabilities(con->port_sink_caps);
> con->port_sink_caps = NULL;
> @@ -2013,10 +2013,6 @@ void ucsi_unregister(struct ucsi *ucsi)
>
> for (i = 0; i < ucsi->cap.num_connectors; i++) {
> cancel_work_sync(&ucsi->connector[i].work);
> - ucsi_unregister_partner(&ucsi->connector[i]);
> - ucsi_unregister_altmodes(&ucsi->connector[i],
> - UCSI_RECIPIENT_CON);
> - ucsi_unregister_port_psy(&ucsi->connector[i]);
>
> if (ucsi->connector[i].wq) {
> struct ucsi_work *uwork;
> @@ -2032,6 +2028,11 @@ void ucsi_unregister(struct ucsi *ucsi)
> destroy_workqueue(ucsi->connector[i].wq);
> }
>
> + ucsi_unregister_partner(&ucsi->connector[i]);
> + ucsi_unregister_altmodes(&ucsi->connector[i],
> + UCSI_RECIPIENT_CON);
> + ucsi_unregister_port_psy(&ucsi->connector[i]);
> +
> usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps);
> ucsi->connector[i].port_sink_caps = NULL;
> usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);
> --
> 2.49.0.rc0.332.g42c0ae87b1-goog
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
prev parent reply other threads:[~2025-03-06 20:28 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-05 11:17 [PATCH v2 0/1] Fix race condition causing NULL pointer dereference Andrei Kuchynski
2025-03-05 11:17 ` [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access Andrei Kuchynski
2025-03-05 13:59 ` Heikki Krogerus
2025-03-06 20:28 ` Benson Leung [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Z8oFUiazzBTKnGRB@google.com \
--to=bleung@google.com \
--cc=akuchynski@chromium.org \
--cc=bleung@chromium.org \
--cc=dmitry.baryshkov@linaro.org \
--cc=gregkh@linuxfoundation.org \
--cc=heikki.krogerus@linux.intel.com \
--cc=jthies@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=lk@c--e.de \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.