[PATCH v2 1/2] platform/chrome: cros_ec_debugfs: clean up console log on probe failure

[PATCH v2 1/2] platform/chrome: cros_ec_debugfs: clean up console log on probe failure

[Hongyan Xu]

cros_ec_create_console_log() starts log_poll_work when console logging is
supported. If the following panic notifier registration fails, probe
removes the debugfs entries but leaves the delayed work scheduled. The
work can then access devm-managed data after the failed probe tears it
down.

Add a dedicated error label for failures after successful console log
setup. Earlier failures keep using the existing debugfs-only cleanup
path.

This issue was found by a static analysis tool.

Fixes: d90fa2c64d59 ("platform/chrome: cros_ec: Poll EC log on EC panic")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
Changes in v2:
- Split the console log probe cleanup into a separate patch.
- Add a dedicated cleanup_console_log error label.

Link to v1: https://lore.kernel.org/r/20260728123423.781-3-getshell@seu.edu.cn

 drivers/platform/chrome/cros_ec_debugfs.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c
index 92ac9a2..a781bb5 100644
--- a/drivers/platform/chrome/cros_ec_debugfs.c
+++ b/drivers/platform/chrome/cros_ec_debugfs.c
@@ -525,7 +525,7 @@ static int cros_ec_debugfs_probe(struct platform_device *pd)
 	ret = blocking_notifier_chain_register(&ec->ec_dev->panic_notifier,
 					       &debug_info->notifier_panic);
 	if (ret)
-		goto remove_debugfs;
+		goto cleanup_console_log;
 
 	ec->debug_info = debug_info;
 
@@ -533,6 +533,8 @@ static int cros_ec_debugfs_probe(struct platform_device *pd)
 
 	return 0;
 
+cleanup_console_log:
+	cros_ec_cleanup_console_log(debug_info);
 remove_debugfs:
 	debugfs_remove_recursive(debug_info->dir);
 	return ret;
-- 
2.50.1.windows.1

[PATCH v2 2/2] platform/chrome: cros_ec_debugfs: unregister panic notifier

[Hongyan Xu]

cros_ec_debugfs_probe() registers notifier_panic with the EC panic
notifier chain. The remove path tears down debugfs and the console log,
but leaves the notifier registered. A later panic notification can call
back into the removed instance and queue work that accesses released
data.

Unregister the panic notifier before tearing down the debugfs and
console log state.

This issue was found by a static analysis tool.

Fixes: d90fa2c64d59 ("platform/chrome: cros_ec: Poll EC log on EC panic")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
Changes in v2:
- Split the panic notifier unregister change into a separate patch.

Link to v1: https://lore.kernel.org/r/20260728123423.781-3-getshell@seu.edu.cn

 drivers/platform/chrome/cros_ec_debugfs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/platform/chrome/cros_ec_debugfs.c b/drivers/platform/chrome/cros_ec_debugfs.c
index a781bb5..7ca5114 100644
--- a/drivers/platform/chrome/cros_ec_debugfs.c
+++ b/drivers/platform/chrome/cros_ec_debugfs.c
@@ -544,6 +544,8 @@ static void cros_ec_debugfs_remove(struct platform_device *pd)
 {
 	struct cros_ec_dev *ec = dev_get_drvdata(pd->dev.parent);
 
+	blocking_notifier_chain_unregister(&ec->ec_dev->panic_notifier,
+					   &ec->debug_info->notifier_panic);
 	debugfs_remove_recursive(ec->debug_info->dir);
 	cros_ec_cleanup_console_log(ec->debug_info);
 }
-- 
2.50.1.windows.1

Re: [PATCH v2 1/2] platform/chrome: cros_ec_debugfs: clean up console log on probe failure

[Tzung-Bi Shih]

On Wed, Jul 29, 2026 at 06:32:16PM +0800, Hongyan Xu wrote:
> cros_ec_create_console_log() starts log_poll_work when console logging is
> supported. If the following panic notifier registration fails, probe
> removes the debugfs entries but leaves the delayed work scheduled. The
> work can then access devm-managed data after the failed probe tears it
> down.
> 
> Add a dedicated error label for failures after successful console log
> setup. Earlier failures keep using the existing debugfs-only cleanup
> path.
> 
> [...]

Applied to

    https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git for-next

[1/2] platform/chrome: cros_ec_debugfs: clean up console log on probe failure
      commit: 5d187600c4603b8f7812b12ce359a11ad7a7fd3a
[2/2] platform/chrome: cros_ec_debugfs: unregister panic notifier
      commit: e5954d3031fb55dd31aa59bae477d63c68e941c0

Thanks!