Linux USB
 help / color / mirror / Atom feed
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
To: Biju Das <biju.das.jz@bp.renesas.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Biju Das <biju.das@bp.renesas.com>,
	"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
	Geert Uytterhoeven <geert+renesas@glider.be>,
	Fabrizio Castro <fabrizio.castro.jz@renesas.com>,
	"linux-renesas-soc@vger.kernel.org" 
	<linux-renesas-soc@vger.kernel.org>,
	"stable@vger.kernel.org" <stable@vger.kernel.org>
Subject: Re: [PATCH v2] usb: typec: hd3ss3220: Fix NULL pointer crash
Date: Tue, 13 Dec 2022 10:36:32 +0200	[thread overview]
Message-ID: <Y5g5kPYu9+tGfriE@kuha.fi.intel.com> (raw)
In-Reply-To: <OS0PR01MB5922FC3A7C5F0507292F99AF86E29@OS0PR01MB5922.jpnprd01.prod.outlook.com>

Hi,

On Mon, Dec 12, 2022 at 10:54:25AM +0000, Biju Das wrote:
> > Looks It is a bug in renesas_usb3.c rather than this driver.
> > 
> > But how we will prevent hd3ss3220_set_role being called after
> > usb_role_switch_unregister(usb3->role_sw) from renesas_usb3.c driver??

Normally that should not be a problem. When you get a reference to the
role switch, also the reference count of the switch driver module (on
top of the device) is incremented.

From where is usb_role_switch_unregister() being called in this case -
is it renesas_usb3_probe()?

If it is, would something like this help:

diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c
index 615ba0a6fbee1..d2e01f7cfef11 100644
--- a/drivers/usb/gadget/udc/renesas_usb3.c
+++ b/drivers/usb/gadget/udc/renesas_usb3.c
@@ -2907,18 +2907,13 @@ static int renesas_usb3_probe(struct platform_device *pdev)
        renesas_usb3_role_switch_desc.driver_data = usb3;
 
        INIT_WORK(&usb3->role_work, renesas_usb3_role_work);
-       usb3->role_sw = usb_role_switch_register(&pdev->dev,
-                                       &renesas_usb3_role_switch_desc);
-       if (!IS_ERR(usb3->role_sw)) {
-               usb3->host_dev = usb_of_get_companion_dev(&pdev->dev);
-               if (!usb3->host_dev) {
-                       /* If not found, this driver will not use a role sw */
-                       usb_role_switch_unregister(usb3->role_sw);
-                       usb3->role_sw = NULL;
-               }
-       } else {
+
+       usb3->host_dev = usb_of_get_companion_dev(&pdev->dev);
+       if (usb3->host_dev)
+               usb3->role_sw = usb_role_switch_register(&pdev->dev,
+                                                        &renesas_usb3_role_switch_desc);
+       if (IS_ERR(usb3->role_sw))
                usb3->role_sw = NULL;
-       }
 
        usb3->workaround_for_vbus = priv->workaround_for_vbus;
 


> Do we need to add additional check for "fwnode_usb_role_switch_get" and
> "usb_role_switch_get" to return error if there is no registered role_switch device
> Like the scenario above??

No. The switch is always an optional resource.

Error means that there is a switch that you can control, but you can't
get a handle to it for some reason.

NULL means you don't need to worry about it - there is no switch on
your platform that you could control.

thanks,

-- 
heikki

  reply	other threads:[~2022-12-13  8:37 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-12-09 17:07 [PATCH v2] usb: typec: hd3ss3220: Fix NULL pointer crash Biju Das
2022-12-12  9:39 ` Heikki Krogerus
2022-12-12  9:58   ` Biju Das
2022-12-12 10:26   ` Biju Das
2022-12-12 10:54     ` Biju Das
2022-12-13  8:36       ` Heikki Krogerus [this message]
2022-12-13  8:46         ` Biju Das

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=Y5g5kPYu9+tGfriE@kuha.fi.intel.com \
    --to=heikki.krogerus@linux.intel.com \
    --cc=biju.das.jz@bp.renesas.com \
    --cc=biju.das@bp.renesas.com \
    --cc=fabrizio.castro.jz@renesas.com \
    --cc=geert+renesas@glider.be \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-renesas-soc@vger.kernel.org \
    --cc=linux-usb@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox