Re: [PATCH RESEND v2 3/5] extcon: extcon-max77693.c: Fix potential work-queue cancellation race

Chanwoo Choi
2021-06-10T09:24:40Z

On 6/8/21 7:10 PM, Matti Vaittinen wrote:
> The extcon IRQ schedules a work item. IRQ is requested using devm while
> WQ is cancelld at remove(). This mixing of devm and manual unwinding has
> potential case where the WQ has been emptied (.remove() was ran) but
> devm unwinding of IRQ was not yet done. It may be possible the IRQ is
> triggered at this point scheduling new work item to the already flushed
> queue.
>
> According to the input documentation the input device allocated by
> devm_input_allocate_device() does not need to be explicitly unregistered.
> Use the new devm_work_autocancel() and remove the remove() to simplify the
> code.
>
> Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
> ---
>
> Please note that the change is compile-tested only. All proper testing is
> highly appreciated.
> ---
> drivers/extcon/extcon-max77693.c | 17 +++++------------
> 1 file changed, 5 insertions(+), 12 deletions(-)
>
> diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
> index 92af97e00828..1f1d9ab0c5c7 100644
> --- a/drivers/extcon/extcon-max77693.c
> +++ b/drivers/extcon/extcon-max77693.c
> @@ -5,6 +5,7 @@
> // Copyright (C) 2012 Samsung Electrnoics
> // Chanwoo Choi <cw00.choi@samsung.com>
>
> +#include <linux/devm-helpers.h>
> #include <linux/kernel.h>
> #include <linux/module.h>
> #include <linux/i2c.h>
> @@ -1127,7 +1128,10 @@ static int max77693_muic_probe(struct platform_device *pdev)
> platform_set_drvdata(pdev, info);
> mutex_init(&info->mutex);
>
> - INIT_WORK(&info->irq_work, max77693_muic_irq_work);
> + ret = devm_work_autocancel(&pdev->dev, &info->irq_work,
> + max77693_muic_irq_work);
> + if (ret)
> + return ret;
>
> /* Support irq domain for MAX77693 MUIC device */
> for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) {
> @@ -1254,22 +1258,11 @@ static int max77693_muic_probe(struct platform_device *pdev)
> return ret;
> }
>
> -static int max77693_muic_remove(struct platform_device *pdev)
> -{
> - struct max77693_muic_info *info = platform_get_drvdata(pdev);
> -
> - cancel_work_sync(&info->irq_work);
> - input_unregister_device(info->dock);

I think that you have to keep the input_unregister_device().

> -
> - return 0;
> -}
> -
> static struct platform_driver max77693_muic_driver = {
> .driver = {
> .name = DEV_NAME,
> },
> .probe = max77693_muic_probe,
> - .remove = max77693_muic_remove,
> };
>
> module_platform_driver(max77693_muic_driver);
>

--
Best Regards,
Chanwoo Choi
Samsung Electronics