Re: [PATCH RESEND v2 2/5] extcon: extcon-max14577: Fix potential work-queue cancellation race

Chanwoo Choi
2021-06-10T09:22:31Z

On 6/8/21 7:09 PM, Matti Vaittinen wrote:
> The extcon IRQ schedules a work item. IRQ is requested using devm while
> WQ is cancelld at remove(). This mixing of devm and manual unwinding has
> potential case where the WQ has been emptied (.remove() was ran) but
> devm unwinding of IRQ was not yet done. It is possible the IRQ is triggered
> at this point scheduling new work item to the already flushed queue.
>
> Use new devm_work_autocancel() to remove the remove() and to kill the bug.
>
> Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
> ---
>
> Please note that the change is compile-tested only. All proper testing is
> highly appreciated.
> ---
> drivers/extcon/extcon-max14577.c | 16 +++++-----------
> 1 file changed, 5 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/extcon/extcon-max14577.c b/drivers/extcon/extcon-max14577.c
> index ace523924e58..5476f48ed74b 100644
> --- a/drivers/extcon/extcon-max14577.c
> +++ b/drivers/extcon/extcon-max14577.c
> @@ -6,6 +6,7 @@
> // Chanwoo Choi <cw00.choi@samsung.com>
> // Krzysztof Kozlowski <krzk@kernel.org>
>
> +#include <linux/devm-helpers.h>
> #include <linux/kernel.h>
> #include <linux/module.h>
> #include <linux/i2c.h>
> @@ -673,7 +674,10 @@ static int max14577_muic_probe(struct platform_device *pdev)
> platform_set_drvdata(pdev, info);
> mutex_init(&info->mutex);
>
> - INIT_WORK(&info->irq_work, max14577_muic_irq_work);
> + ret = devm_work_autocancel(&pdev->dev, &info->irq_work,
> + max14577_muic_irq_work);
> + if (ret)
> + return ret;
>
> switch (max14577->dev_type) {
> case MAXIM_DEVICE_TYPE_MAX77836:
> @@ -766,15 +770,6 @@ static int max14577_muic_probe(struct platform_device *pdev)
> return ret;
> }
>
> -static int max14577_muic_remove(struct platform_device *pdev)
> -{
> - struct max14577_muic_info *info = platform_get_drvdata(pdev);
> -
> - cancel_work_sync(&info->irq_work);
> -
> - return 0;
> -}
> -
> static const struct platform_device_id max14577_muic_id[] = {
> { "max14577-muic", MAXIM_DEVICE_TYPE_MAX14577, },
> { "max77836-muic", MAXIM_DEVICE_TYPE_MAX77836, },
> @@ -797,7 +792,6 @@ static struct platform_driver max14577_muic_driver = {
> .of_match_table = of_max14577_muic_dt_match,
> },
> .probe = max14577_muic_probe,
> - .remove = max14577_muic_remove,
> .id_table = max14577_muic_id,
> };
>
>

Acked-by: Chanwoo Choi <cw00.choi@samsung.com>

--
Best Regards,
Chanwoo Choi
Samsung Electronics