Re: [PATCH 2/3] usb: musb: remove redundant pm_runtime_dont_use_autosuspend() calls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Critical] usb: musb: use-after-free in musb_remove() [1]
--

commit 288b4875a2dac2d67d03e8708cdad214c6870682
Author: Joshua Crofts <crofts@kernel.org>

usb: musb: remove redundant pm_runtime_dont_use_autosuspend() calls

This commit removes redundant pm_runtime_dont_use_autosuspend() calls in
musb_init_controller() and musb_remove() since the driver core now handles
this on driver exit.

> diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
> index 73ac25f53698f..28e59b53fd02f 100644
> --- a/drivers/usb/musb/musb_core.c
> +++ b/drivers/usb/musb/musb_core.c

[ ... ]

> @@ -2644,7 +2643,6 @@ static void musb_remove(struct platform_device *pdev)
>  	spin_unlock_irqrestore(&musb->lock, flags);
>  	musb_platform_exit(musb);
>  
> -	pm_runtime_dont_use_autosuspend(musb->controller);
>  	pm_runtime_put_sync(musb->controller);
>  	pm_runtime_disable(musb->controller);
>  	musb_phy_callback = NULL;

[Severity: Critical]
This problem wasn't introduced by this patch, but can calling
musb_platform_exit(musb) before usb_phy_shutdown(musb->xceiv) a few lines
below cause a use-after-free on musb->xceiv [1]?

Platform exit callbacks such as da8xx_musb_exit() call
usb_put_phy(musb->xceiv), which drops the final reference and frees the PHY
before musb_remove() passes musb->xceiv to usb_phy_shutdown():

drivers/usb/musb/musb_core.c:musb_remove() {
	...
	musb_platform_exit(musb);

	pm_runtime_put_sync(musb->controller);
	pm_runtime_disable(musb->controller);
	musb_phy_callback = NULL;
	if (musb->dma_controller)
		musb_dma_controller_destroy(musb->dma_controller);
	usb_phy_shutdown(musb->xceiv);
	...
}

[1] https://sashiko.dev/#/bug/linux-d180c2b9-0006-4638-a22b-13df8c201235

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106133933.1577-1-crofts@kernel.org?part=2