From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1436D2309A6; Mon, 10 Mar 2025 17:28:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741627683; cv=none; b=o774HQvzzDEzJMvLyHHvE2S9sCQem3PzwaevYlM9JREmCGiDAOiHc3/RHNrtGJUu/TnOR32yJqrCpF+KuKIevHtNJSLbL30EqTNKVw/aPHMcpRkwvg1VIrxNFv20l4pqXGnXI3Jf/zYGfnfVN/DyrsIUxlYk2I9KFza4rQ3RQZ4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1741627683; c=relaxed/simple; bh=mwylIw7E7ZrrG7mlV+m83IoKU4BFCkMTzqM7L1euvn4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=aF91Pb4TtIcNaYHu+cGgkWALAFBY/ju43hxc0EdHHjiSadU7YGi/lFsNZRAOB+Ir8wEOYVW3YcZ3oVG84AiNYJoiLzTCpxyBd4SYBeW3v5g0X2PY6xFGLXZxeionILl8+29gJ6mbnCD10CRF7mYwcSo2t2NHHbF03yhrMvZL5jE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Vp6hgzdI; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Vp6hgzdI" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 903A7C4CEE5; Mon, 10 Mar 2025 17:28:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1741627683; bh=mwylIw7E7ZrrG7mlV+m83IoKU4BFCkMTzqM7L1euvn4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Vp6hgzdIJoHoPZxGj/Mz7DQic9duIj52gkQ/earoqmZHm2mDSaLqRHWfUpG480PlY Kv1l5duP0ti6DMMi6AxUbHahEujMPOfO7ytAJ50omL4FL5hf7n2hKbpyYHnNC7Uplk j7VAPxrYl2nMTf0HplbyCtK2DxyGFfJFH5Tq9XKk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Andrei Kuchynski , Heikki Krogerus Subject: [PATCH 6.12 212/269] usb: typec: ucsi: Fix NULL pointer access Date: Mon, 10 Mar 2025 18:06:05 +0100 Message-ID: <20250310170506.142143696@linuxfoundation.org> X-Mailer: git-send-email 2.48.1 In-Reply-To: <20250310170457.700086763@linuxfoundation.org> References: <20250310170457.700086763@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Andrei Kuchynski commit b13abcb7ddd8d38de769486db5bd917537b32ab1 upstream. Resources should be released only after all threads that utilize them have been destroyed. This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them. Cc: stable Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking") Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250305111739.1489003-2-akuchynski@chromium.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -1809,11 +1809,11 @@ static int ucsi_init(struct ucsi *ucsi) err_unregister: for (con = connector; con->port; con++) { + if (con->wq) + destroy_workqueue(con->wq); ucsi_unregister_partner(con); ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON); ucsi_unregister_port_psy(con); - if (con->wq) - destroy_workqueue(con->wq); usb_power_delivery_unregister_capabilities(con->port_sink_caps); con->port_sink_caps = NULL; @@ -1997,10 +1997,6 @@ void ucsi_unregister(struct ucsi *ucsi) for (i = 0; i < ucsi->cap.num_connectors; i++) { cancel_work_sync(&ucsi->connector[i].work); - ucsi_unregister_partner(&ucsi->connector[i]); - ucsi_unregister_altmodes(&ucsi->connector[i], - UCSI_RECIPIENT_CON); - ucsi_unregister_port_psy(&ucsi->connector[i]); if (ucsi->connector[i].wq) { struct ucsi_work *uwork; @@ -2016,6 +2012,11 @@ void ucsi_unregister(struct ucsi *ucsi) destroy_workqueue(ucsi->connector[i].wq); } + ucsi_unregister_partner(&ucsi->connector[i]); + ucsi_unregister_altmodes(&ucsi->connector[i], + UCSI_RECIPIENT_CON); + ucsi_unregister_port_psy(&ucsi->connector[i]); + usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps); ucsi->connector[i].port_sink_caps = NULL; usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);