Re: [PATCH v4 1/5] mfd: Add support for Intel LJCA device

Oliver Neukum
2023-03-09T12:53:41Z

On 09.03.23 08:10, Ye Xiang wrote:

> +static int ljca_stub_write(struct ljca_stub *stub, u8 cmd, const void *obuf, unsigned int obuf_len,
> + void *ibuf, unsigned int *ibuf_len, bool wait_ack, unsigned long timeout)

Why do you make ibuf_len a pointer?

> +{
> + struct ljca_dev *dev = usb_get_intfdata(stub->intf);
> + u8 flags = LJCA_CMPL_FLAG;
> + struct ljca_msg *header;
> + unsigned int msg_len = sizeof(*header) + obuf_len;
> + int actual;
> + int ret;
> +
> + if (msg_len > LJCA_MAX_PACKET_SIZE)
> + return -EINVAL;
> +
> + if (wait_ack)
> + flags |= LJCA_ACK_FLAG;
> +
> + header = kmalloc(msg_len, GFP_KERNEL);
> + if (!header)
> + return -ENOMEM;
> +
> + header->type = stub->type;
> + header->cmd = cmd;
> + header->flags = flags;
> + header->len = obuf_len;
> +
> + if (obuf)
> + memcpy(header->data, obuf, obuf_len);
> +
> + dev_dbg(&dev->intf->dev, "send: type:%d cmd:%d flags:%d len:%d\n", header->type,
> + header->cmd, header->flags, header->len);
> +
> + usb_autopm_get_interface(dev->intf);
> + if (!dev->started) {

Memory leak in error case. You must free header.

> + ret = -ENODEV;
> + goto error_put;
> + }
> +
> + mutex_lock(&dev->mutex);
> + stub->cur_cmd = cmd;
> + stub->ipacket.ibuf = ibuf;
> + stub->ipacket.ibuf_len = ibuf_len;
> + stub->acked = false;
> + ret = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, dev->out_ep), header, msg_len,
> + &actual, LJCA_USB_WRITE_TIMEOUT_MS);
> + kfree(header);
> + if (ret) {
> + dev_err(&dev->intf->dev, "bridge write failed ret:%d\n", ret);
> + goto error_unlock;
> + }
> +
> + if (actual != msg_len) {
> + dev_err(&dev->intf->dev, "bridge write length mismatch (%d vs %d)\n", msg_len,
> + actual);
> + ret = -EINVAL;
> + goto error_unlock;
> + }
> +
> + if (wait_ack) {
> + ret = wait_event_timeout(dev->ack_wq, stub->acked, msecs_to_jiffies(timeout));
> + if (!ret) {
> + dev_err(&dev->intf->dev, "acked wait timeout\n");
> + ret = -ETIMEDOUT;

If that triggers, you may have a pending URB.
You must kill it.

> + goto error_unlock;
> + }
> + }
> +
> + stub->ipacket.ibuf = NULL;
> + stub->ipacket.ibuf_len = NULL;
> + ret = 0;
> +error_unlock:
> + mutex_unlock(&dev->mutex);
> +error_put:
> + usb_autopm_put_interface(dev->intf);
> + return ret;
> +}

> +static int ljca_i2c_stub_init(struct ljca_dev *dev, struct ljca_i2c_descriptor *desc)
> +{
> + struct ljca_i2c_info *i2c_info;
> + struct ljca_stub *stub;
> + int ret;
> + int i;
> +
> + stub = ljca_stub_alloc(dev, LJCA_I2C_STUB, size_mul(desc->num, sizeof(*i2c_info)));
> + if (IS_ERR(stub))
> + return PTR_ERR(stub);
> +
> + i2c_info = ljca_priv(stub);
> +
> + for (i = 0; i < desc->num; i++) {
> + struct mfd_cell cell = {};
> +
> + i2c_info[i].ljca = &stub->ljca;
> + i2c_info[i].id = desc->info[i].id;
> + i2c_info[i].capacity = desc->info[i].capacity;
> + i2c_info[i].intr_pin = desc->info[i].intr_pin;
> +
> + cell.name = "ljca-i2c";
> + cell.platform_data = &i2c_info[i];
> + cell.pdata_size = sizeof(i2c_info[i]);
> +
> + if (i < ARRAY_SIZE(ljca_acpi_match_i2cs))
> + cell.acpi_match = &ljca_acpi_match_i2cs[i];
> +
> + ret = ljca_add_mfd_cell(dev, &cell);
> + if (ret)
> + return ret;

What happens to stub in the error case?

> + }
> +
> + return 0;
> +}

> +
> +static void ljca_disconnect(struct usb_interface *intf)
> +{
> + struct ljca_dev *dev = usb_get_intfdata(intf);
> +
> + ljca_stop(dev);

What prevents restarting the device here?

> + mfd_remove_devices(&intf->dev);
> + ljca_stub_cleanup(dev);
> + ljca_delete(dev);
> +}
> +
> +static int ljca_suspend(struct usb_interface *intf, pm_message_t message)
> +{
> + struct ljca_dev *dev = usb_get_intfdata(intf);
> +
> + ljca_stop(dev);
> + return 0;
> +}
> +
> +static int ljca_resume(struct usb_interface *intf)
> +{
> + struct ljca_dev *dev = usb_get_intfdata(intf);
> +
> + return ljca_start(dev);

So here you report errors, but at the same time you set "started"
even if errors occur.

Regards
Oliver