From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F9BB230BF6; Mon, 10 Mar 2025 17:15:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741626920; cv=none; b=oC2NExogUq2R320wVQ1KCaQ/SCWFDvA4TFbKSizQyZ40uBn4NQ6ccSFlsVNGnGqRZPkyvjF1T9INrxEYAjhjEx5gOZi1KzoTwStjprJdf6TzR+p7+fmfuQ6A6gEqL6Jq2tTSeNUbqrgvifba7jqHmh1cZJs9wPKLQn4lH5rDb2o= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741626920; c=relaxed/simple; bh=lpBvOJ7iacnTcEMd/g6bgHzeaXnrq92QgbevZwBIoEM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=i2RcLmk3gU6yltQ2S5El9PW2OT9ABxTATeAcaiZuMA0JO1/y7SHNrXpi0vR5Uqr7Sxz4rh3eezE6ohm5OL9eWTUxiuEDmmR5seGkpULHyiOrIEdeNB3wo1Nhtu4i03HK1TeevbNDjAc9P88ZHR7ZrvpN7oUMKSYtDuW41ofkUfU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=qSlSF1Ly; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="qSlSF1Ly" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17CB6C4CEE5; Mon, 10 Mar 2025 17:15:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1741626920; bh=lpBvOJ7iacnTcEMd/g6bgHzeaXnrq92QgbevZwBIoEM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qSlSF1LyCLpDJxwQ5hcKpfmhCkg4SZ3f8IJirB9ofZIwUdl0gKtsb1mj7KbGojBuH dM6rCL567+u8IYPWZb+WRBZQU+CsHEm8Pjkw+lEsB+B1ByI8jwBkCMYpInct0nZsi7 iEcA8+mmJI6uxkvkDcDOm9SSsFgETh1WX+/yIdpQ= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Andrei Kuchynski , Heikki Krogerus Subject: [PATCH 6.13 158/207] usb: typec: ucsi: Fix NULL pointer access Date: Mon, 10 Mar 2025 18:05:51 +0100 Message-ID: <20250310170454.073935817@linuxfoundation.org> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250310170447.729440535@linuxfoundation.org> References: <20250310170447.729440535@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.13-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrei Kuchynski commit b13abcb7ddd8d38de769486db5bd917537b32ab1 upstream. Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them. Cc: stable Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking") Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250305111739.1489003-2-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -1825,11 +1825,11 @@ static int ucsi_init(struct ucsi *ucsi) err_unregister: for (con = connector; con->port; con++) { + if (con->wq) + destroy_workqueue(con->wq); ucsi_unregister_partner(con); ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); ucsi_unregister_port_psy(con); - if (con->wq) - destroy_workqueue(con->wq); usb_power_delivery_unregister_capabilities(con->port_sink_caps); con->port_sink_caps = NULL; @@ -2013,10 +2013,6 @@ void ucsi_unregister(struct ucsi *ucsi) for (i = 0; i < ucsi->cap.num_connectors; i++) { cancel_work_sync(&ucsi->connector[i].work); - ucsi_unregister_partner(&ucsi->connector[i]); - ucsi_unregister_altmodes(&ucsi->connector[i], - UCSI_RECIPIENT_CON); - ucsi_unregister_port_psy(&ucsi->connector[i]); if (ucsi->connector[i].wq) { struct ucsi_work *uwork; @@ -2032,6 +2028,11 @@ void ucsi_unregister(struct ucsi *ucsi) destroy_workqueue(ucsi->connector[i].wq); } + ucsi_unregister_partner(&ucsi->connector[i]); + ucsi_unregister_altmodes(&ucsi->connector[i], + UCSI_RECIPIENT_CON); + ucsi_unregister_port_psy(&ucsi->connector[i]); + usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps); ucsi->connector[i].port_sink_caps = NULL; usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);