[1/2] usb: typec: mux: Take care of driver module reference counting

[1/2] usb: typec: mux: Take care of driver module reference counting

[Greg Kroah-Hartman]

On Thu, Sep 20, 2018 at 02:26:28PM +0300, Heikki Krogerus wrote:
> On Thu, Sep 20, 2018 at 01:20:03PM +0200, Greg KH wrote:
> > On Wed, Sep 19, 2018 at 10:58:04AM +0300, Heikki Krogerus wrote:
> > > Functions typec_mux_get() and typec_switch_get() already
> > > make sure that the mux device reference count is
> > > incremented, but the same must be done to the driver module
> > > as well to prevent the drivers from being unloaded in the
> > > middle of operation.
> > > 
> > > This fixes a potential "BUG: unable to handle kernel paging
> > > request at ..." from happening.
> > > 
> > > Fixes: 93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
> > > Cc: <stable@vger.kernel.org>
> > 
> > Why is this flagged for stable? 93dd2112c7b2 went into 4.19-rc1 and has
> > not been backported anywhere else.
> > 
> > confused,
> 
> Sorry, it should not have the stable tag. Shall I resend these?

No need, I'll handle it, thanks.

greg k-h

[1/2] usb: typec: mux: Take care of driver module reference counting

[Heikki Krogerus]

On Thu, Sep 20, 2018 at 01:20:03PM +0200, Greg KH wrote:
> On Wed, Sep 19, 2018 at 10:58:04AM +0300, Heikki Krogerus wrote:
> > Functions typec_mux_get() and typec_switch_get() already
> > make sure that the mux device reference count is
> > incremented, but the same must be done to the driver module
> > as well to prevent the drivers from being unloaded in the
> > middle of operation.
> > 
> > This fixes a potential "BUG: unable to handle kernel paging
> > request at ..." from happening.
> > 
> > Fixes: 93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
> > Cc: <stable@vger.kernel.org>
> 
> Why is this flagged for stable? 93dd2112c7b2 went into 4.19-rc1 and has
> not been backported anywhere else.
> 
> confused,

Sorry, it should not have the stable tag. Shall I resend these?

Thanks,

[1/2] usb: typec: mux: Take care of driver module reference counting

[Greg Kroah-Hartman]

On Wed, Sep 19, 2018 at 10:58:04AM +0300, Heikki Krogerus wrote:
> Functions typec_mux_get() and typec_switch_get() already
> make sure that the mux device reference count is
> incremented, but the same must be done to the driver module
> as well to prevent the drivers from being unloaded in the
> middle of operation.
> 
> This fixes a potential "BUG: unable to handle kernel paging
> request at ..." from happening.
> 
> Fixes: 93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
> Cc: <stable@vger.kernel.org>

Why is this flagged for stable? 93dd2112c7b2 went into 4.19-rc1 and has
not been backported anywhere else.

confused,

greg k-h

[1/2] usb: typec: mux: Take care of driver module reference counting

[Sasha Levin]

Hi,

[This is an automated email]

This commit has been processed because it contains a -stable tag.
The stable tag indicates that it's relevant for the following trees: all

The bot has tested the following trees: v4.18.8, v4.14.70, v4.9.127, v4.4.156, v3.18.122, 

v4.18.8: Failed to apply! Possible dependencies:
    93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")

v4.14.70: Failed to apply! Possible dependencies:
    93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
    bdecb33af34f ("usb: typec: API for controlling USB Type-C Multiplexers")

v4.9.127: Failed to apply! Possible dependencies:
    93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
    bdecb33af34f ("usb: typec: API for controlling USB Type-C Multiplexers")

v4.4.156: Failed to apply! Possible dependencies:
    93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
    bdecb33af34f ("usb: typec: API for controlling USB Type-C Multiplexers")

v3.18.122: Failed to apply! Possible dependencies:
    93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
    bdecb33af34f ("usb: typec: API for controlling USB Type-C Multiplexers")


Please let us know if you'd like to have this patch included in a stable tree.
---
Thanks,
Sasha

[1/2] usb: typec: mux: Take care of driver module reference counting

[Heikki Krogerus]

Functions typec_mux_get() and typec_switch_get() already
make sure that the mux device reference count is
incremented, but the same must be done to the driver module
as well to prevent the drivers from being unloaded in the
middle of operation.

This fixes a potential "BUG: unable to handle kernel paging
request at ..." from happening.

Fixes: 93dd2112c7b2 ("usb: typec: mux: Get the mux identifier from function parameter")
Cc: <stable@vger.kernel.org>
Acked-by: Hans de Goede <hdegoede@redhat.com>
Tested-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
 drivers/usb/typec/mux.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c
index ddaac63ecf12..d990aa510fab 100644
--- a/drivers/usb/typec/mux.c
+++ b/drivers/usb/typec/mux.c
@@ -9,6 +9,7 @@
 
 #include <linux/device.h>
 #include <linux/list.h>
+#include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/usb/typec_mux.h>
 
@@ -49,8 +50,10 @@ struct typec_switch *typec_switch_get(struct device *dev)
 	mutex_lock(&switch_lock);
 	sw = device_connection_find_match(dev, "typec-switch", NULL,
 					  typec_switch_match);
-	if (!IS_ERR_OR_NULL(sw))
+	if (!IS_ERR_OR_NULL(sw)) {
+		WARN_ON(!try_module_get(sw->dev->driver->owner));
 		get_device(sw->dev);
+	}
 	mutex_unlock(&switch_lock);
 
 	return sw;
@@ -65,8 +68,10 @@ EXPORT_SYMBOL_GPL(typec_switch_get);
  */
 void typec_switch_put(struct typec_switch *sw)
 {
-	if (!IS_ERR_OR_NULL(sw))
+	if (!IS_ERR_OR_NULL(sw)) {
+		module_put(sw->dev->driver->owner);
 		put_device(sw->dev);
+	}
 }
 EXPORT_SYMBOL_GPL(typec_switch_put);
 
@@ -136,8 +141,10 @@ struct typec_mux *typec_mux_get(struct device *dev, const char *name)
 
 	mutex_lock(&mux_lock);
 	mux = device_connection_find_match(dev, name, NULL, typec_mux_match);
-	if (!IS_ERR_OR_NULL(mux))
+	if (!IS_ERR_OR_NULL(mux)) {
+		WARN_ON(!try_module_get(mux->dev->driver->owner));
 		get_device(mux->dev);
+	}
 	mutex_unlock(&mux_lock);
 
 	return mux;
@@ -152,8 +159,10 @@ EXPORT_SYMBOL_GPL(typec_mux_get);
  */
 void typec_mux_put(struct typec_mux *mux)
 {
-	if (!IS_ERR_OR_NULL(mux))
+	if (!IS_ERR_OR_NULL(mux)) {
+		module_put(mux->dev->driver->owner);
 		put_device(mux->dev);
+	}
 }
 EXPORT_SYMBOL_GPL(typec_mux_put);