[PATCH] usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure

[PATCH] usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure

[Pengpeng Hou]

gaokun_ucsi_register_worker() registers the EC notifier before
registering the UCSI device.

If ucsi_register() fails, the worker only reports the error and leaves
the notifier registered.  Later EC events can then call back into an
unregistered UCSI instance.  The remove path also unconditionally
unregisters both the notifier and UCSI device even when the delayed
worker failed part way through registration.

Track which publication steps succeeded, unregister the EC notifier when
UCSI registration fails, and make remove only undo the steps that were
actually published.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
index ca749fde49bd..29d2e76b2fe9 100644
--- a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
+++ b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
@@ -98,6 +98,8 @@ struct gaokun_ucsi {
 	struct device *dev;
 	struct delayed_work work;
 	struct notifier_block nb;
+	bool notifier_registered;
+	bool ucsi_registered;
 	u16 version;
 	u8 num_ports;
 };
@@ -457,10 +459,16 @@ static void gaokun_ucsi_register_worker(struct work_struct *work)
 		dev_err_probe(ucsi->dev, ret, "notifier register failed\n");
 		return;
 	}
+	uec->notifier_registered = true;
 
 	ret = ucsi_register(ucsi);
-	if (ret)
+	if (ret) {
 		dev_err_probe(ucsi->dev, ret, "ucsi register failed\n");
+		gaokun_ec_unregister_notify(uec->ec, &uec->nb);
+		uec->notifier_registered = false;
+		return;
+	}
+	uec->ucsi_registered = true;
 }
 
 static int gaokun_ucsi_probe(struct auxiliary_device *adev,
@@ -504,8 +512,10 @@ static void gaokun_ucsi_remove(struct auxiliary_device *adev)
 	struct gaokun_ucsi *uec = auxiliary_get_drvdata(adev);
 
 	disable_delayed_work_sync(&uec->work);
-	gaokun_ec_unregister_notify(uec->ec, &uec->nb);
-	ucsi_unregister(uec->ucsi);
+	if (uec->notifier_registered)
+		gaokun_ec_unregister_notify(uec->ec, &uec->nb);
+	if (uec->ucsi_registered)
+		ucsi_unregister(uec->ucsi);
 	ucsi_destroy(uec->ucsi);
 }
 
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] usb: typec: ucsi: gaokun: unwind notifier on UCSI register failure

[Greg Kroah-Hartman]

On Mon, Jun 15, 2026 at 02:53:57PM +0800, Pengpeng Hou wrote:
> gaokun_ucsi_register_worker() registers the EC notifier before
> registering the UCSI device.
> 
> If ucsi_register() fails, the worker only reports the error and leaves
> the notifier registered.  Later EC events can then call back into an
> unregistered UCSI instance.  The remove path also unconditionally
> unregisters both the notifier and UCSI device even when the delayed
> worker failed part way through registration.
> 
> Track which publication steps succeeded, unregister the EC notifier when
> UCSI registration fails, and make remove only undo the steps that were
> actually published.
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
>  drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c | 16 +++++++++++++---
>  1 file changed, 13 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
> index ca749fde49bd..29d2e76b2fe9 100644
> --- a/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
> +++ b/drivers/usb/typec/ucsi/ucsi_huawei_gaokun.c
> @@ -98,6 +98,8 @@ struct gaokun_ucsi {
>  	struct device *dev;
>  	struct delayed_work work;
>  	struct notifier_block nb;
> +	bool notifier_registered;
> +	bool ucsi_registered;
>  	u16 version;
>  	u8 num_ports;
>  };
> @@ -457,10 +459,16 @@ static void gaokun_ucsi_register_worker(struct work_struct *work)
>  		dev_err_probe(ucsi->dev, ret, "notifier register failed\n");
>  		return;
>  	}
> +	uec->notifier_registered = true;
>  
>  	ret = ucsi_register(ucsi);
> -	if (ret)
> +	if (ret) {
>  		dev_err_probe(ucsi->dev, ret, "ucsi register failed\n");
> +		gaokun_ec_unregister_notify(uec->ec, &uec->nb);
> +		uec->notifier_registered = false;

Why this convulted logic of setting to true and then false?  Did you
have an AI write this?

And why are 2 flags needed?  Are you sure that's necessary?

How was this tested?

thanks,

greg k-h