From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Biju Das <biju.das.jz@bp.renesas.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Biju Das <biju.das@bp.renesas.com>,
"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
Geert Uytterhoeven <geert+renesas@glider.be>,
Fabrizio Castro <fabrizio.castro.jz@renesas.com>,
"linux-renesas-soc@vger.kernel.org"
<linux-renesas-soc@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH v2] usb: typec: hd3ss3220: Fix NULL pointer crash
Date: Tue, 13 Dec 2022 10:36:32 +0200 [thread overview]
Message-ID: <Y5g5kPYu9+tGfriE@kuha.fi.intel.com> (raw)
In-Reply-To: <OS0PR01MB5922FC3A7C5F0507292F99AF86E29@OS0PR01MB5922.jpnprd01.prod.outlook.com>
Hi,
On Mon, Dec 12, 2022 at 10:54:25AM +0000, Biju Das wrote:
> > Looks It is a bug in renesas_usb3.c rather than this driver.
> >
> > But how we will prevent hd3ss3220_set_role being called after
> > usb_role_switch_unregister(usb3->role_sw) from renesas_usb3.c driver??
Normally that should not be a problem. When you get a reference to the
role switch, also the reference count of the switch driver module (on
top of the device) is incremented.
From where is usb_role_switch_unregister() being called in this case -
is it renesas_usb3_probe()?
If it is, would something like this help:
diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 615ba0a6fbee1..d2e01f7cfef11 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -2907,18 +2907,13 @@ static int renesas_usb3_probe(struct platform_device *pdev)
renesas_usb3_role_switch_desc.driver_data = usb3;
INIT_WORK(&usb3->role_work, renesas_usb3_role_work);
- usb3->role_sw = usb_role_switch_register(&pdev->dev,
- &renesas_usb3_role_switch_desc);
- if (!IS_ERR(usb3->role_sw)) {
- usb3->host_dev = usb_of_get_companion_dev(&pdev->dev);
- if (!usb3->host_dev) {
- /* If not found, this driver will not use a role sw */
- usb_role_switch_unregister(usb3->role_sw);
- usb3->role_sw = NULL;
- }
- } else {
+
+ usb3->host_dev = usb_of_get_companion_dev(&pdev->dev);
+ if (usb3->host_dev)
+ usb3->role_sw = usb_role_switch_register(&pdev->dev,
+ &renesas_usb3_role_switch_desc);
+ if (IS_ERR(usb3->role_sw))
usb3->role_sw = NULL;
- }
usb3->workaround_for_vbus = priv->workaround_for_vbus;
> Do we need to add additional check for "fwnode_usb_role_switch_get" and
> "usb_role_switch_get" to return error if there is no registered role_switch device
> Like the scenario above??
No. The switch is always an optional resource.
Error means that there is a switch that you can control, but you can't
get a handle to it for some reason.
NULL means you don't need to worry about it - there is no switch on
your platform that you could control.
thanks,
--
heikki
next prev parent reply other threads:[~2022-12-13 8:37 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-09 17:07 [PATCH v2] usb: typec: hd3ss3220: Fix NULL pointer crash Biju Das
2022-12-12 9:39 ` Heikki Krogerus
2022-12-12 9:58 ` Biju Das
2022-12-12 10:26 ` Biju Das
2022-12-12 10:54 ` Biju Das
2022-12-13 8:36 ` Heikki Krogerus [this message]
2022-12-13 8:46 ` Biju Das
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y5g5kPYu9+tGfriE@kuha.fi.intel.com \
--to=heikki.krogerus@linux.intel.com \
--cc=biju.das.jz@bp.renesas.com \
--cc=biju.das@bp.renesas.com \
--cc=fabrizio.castro.jz@renesas.com \
--cc=geert+renesas@glider.be \
--cc=gregkh@linuxfoundation.org \
--cc=linux-renesas-soc@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox