linux-usb.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Johan Hovold <johan@kernel.org>
To: Felipe Balbi <balbi@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Alan Stern <stern@rowland.harvard.edu>,
	linux-usb@vger.kernel.org, Roger Quadros <rogerq@ti.com>,
	Johan Hovold <johan@kernel.org>
Subject: usb: dwc3: of-simple: fix use-after-free on remove
Date: Thu, 31 May 2018 16:45:52 +0200	[thread overview]
Message-ID: <20180531144552.29007-1-johan@kernel.org> (raw)

The clocks have already been explicitly disabled and put as part of
remove() so the runtime suspend callback must not be run when balancing
the runtime PM usage count before returning.

Fixes: 16adc674d0d6 ("usb: dwc3: add generic OF glue layer")
Signed-off-by: Johan Hovold <johan@kernel.org>
---

Changes in v2
 - balance usage count only after disabling runtime PM to avoid racing
   with pm_runtime_suspend() as suggested by Alan


 drivers/usb/dwc3/dwc3-of-simple.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
index cb2ee96fd3e8..048922d549dd 100644
--- a/drivers/usb/dwc3/dwc3-of-simple.c
+++ b/drivers/usb/dwc3/dwc3-of-simple.c
@@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
 
 	reset_control_put(simple->resets);
 
-	pm_runtime_put_sync(dev);
 	pm_runtime_disable(dev);
+	pm_runtime_put_noidle(dev);
+	pm_runtime_set_suspended(dev);
 
 	return 0;
 }

             reply	other threads:[~2018-05-31 14:45 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-31 14:45 Johan Hovold [this message]
  -- strict thread matches above, loose matches on Subject: below --
2018-05-31 14:58 usb: dwc3: of-simple: fix use-after-free on remove Johan Hovold
2018-06-13  7:49 Roger Quadros
2018-06-13  8:05 Felipe Balbi
2018-06-13  8:34 Roger Quadros
2018-06-13  9:39 Felipe Balbi
2018-06-13 10:59 Johan Hovold
2018-06-18  8:15 Felipe Balbi
2018-06-18  8:34 Johan Hovold
2018-06-18  9:33 Felipe Balbi
2018-06-18  9:47 Johan Hovold
2018-06-18  9:51 Felipe Balbi
2018-06-18 11:11 Roger Quadros
2018-06-18 12:21 Felipe Balbi
2018-06-18 14:32 Roger Quadros
2018-06-19  8:18 Felipe Balbi
2018-06-19 12:10 Tero Kristo
2018-06-20  4:34 Tony Lindgren
2018-06-20  9:16 Tony Lindgren
2018-06-20  9:27 Felipe Balbi
2018-06-20  9:54 Rafael J. Wysocki
2018-06-20 11:05 Felipe Balbi
2018-06-20 12:17 Rafael J. Wysocki
2018-06-20 12:23 Johan Hovold
2018-06-20 12:54 Rafael J. Wysocki
2018-06-20 15:46 Johan Hovold
2018-06-20 22:32 Rafael J. Wysocki
2018-06-20 22:55 Rafael J. Wysocki
2018-06-21  8:17 Roger Quadros
2018-06-21  8:27 Johan Hovold
2018-06-21  9:52 Johan Hovold
2018-06-21 10:11 Johan Hovold
2018-06-21 15:15 Alan Stern

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180531144552.29007-1-johan@kernel.org \
    --to=johan@kernel.org \
    --cc=balbi@kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=rogerq@ti.com \
    --cc=stern@rowland.harvard.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).