* [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access
[not found] <20250305111739.1489003-1-akuchynski@chromium.org>
@ 2025-03-05 11:17 ` Andrei Kuchynski
2025-03-05 13:59 ` Heikki Krogerus
2025-03-06 20:28 ` Benson Leung
0 siblings, 2 replies; 3+ messages in thread
From: Andrei Kuchynski @ 2025-03-05 11:17 UTC (permalink / raw)
To: Heikki Krogerus, Greg Kroah-Hartman, Dmitry Baryshkov,
Benson Leung, Christian A. Ehrhardt, Jameson Thies, linux-usb,
linux-kernel
Cc: Andrei Kuchynski, stable
Resources should be released only after all threads that utilize them
have been destroyed.
This commit ensures that resources are not released prematurely by waiting
for the associated workqueue to complete before deallocating them.
Cc: stable@vger.kernel.org
Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking")
Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
---
drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index fcf499cc9458..43b4f8207bb3 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -1825,11 +1825,11 @@ static int ucsi_init(struct ucsi *ucsi)
err_unregister:
for (con = connector; con->port; con++) {
+ if (con->wq)
+ destroy_workqueue(con->wq);
ucsi_unregister_partner(con);
ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
ucsi_unregister_port_psy(con);
- if (con->wq)
- destroy_workqueue(con->wq);
usb_power_delivery_unregister_capabilities(con->port_sink_caps);
con->port_sink_caps = NULL;
@@ -2013,10 +2013,6 @@ void ucsi_unregister(struct ucsi *ucsi)
for (i = 0; i < ucsi->cap.num_connectors; i++) {
cancel_work_sync(&ucsi->connector[i].work);
- ucsi_unregister_partner(&ucsi->connector[i]);
- ucsi_unregister_altmodes(&ucsi->connector[i],
- UCSI_RECIPIENT_CON);
- ucsi_unregister_port_psy(&ucsi->connector[i]);
if (ucsi->connector[i].wq) {
struct ucsi_work *uwork;
@@ -2032,6 +2028,11 @@ void ucsi_unregister(struct ucsi *ucsi)
destroy_workqueue(ucsi->connector[i].wq);
}
+ ucsi_unregister_partner(&ucsi->connector[i]);
+ ucsi_unregister_altmodes(&ucsi->connector[i],
+ UCSI_RECIPIENT_CON);
+ ucsi_unregister_port_psy(&ucsi->connector[i]);
+
usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps);
ucsi->connector[i].port_sink_caps = NULL;
usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);
--
2.49.0.rc0.332.g42c0ae87b1-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access
2025-03-05 11:17 ` [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access Andrei Kuchynski
@ 2025-03-05 13:59 ` Heikki Krogerus
2025-03-06 20:28 ` Benson Leung
1 sibling, 0 replies; 3+ messages in thread
From: Heikki Krogerus @ 2025-03-05 13:59 UTC (permalink / raw)
To: Andrei Kuchynski
Cc: Greg Kroah-Hartman, Dmitry Baryshkov, Benson Leung,
Christian A. Ehrhardt, Jameson Thies, linux-usb, linux-kernel,
stable
On Wed, Mar 05, 2025 at 11:17:39AM +0000, Andrei Kuchynski wrote:
> Resources should be released only after all threads that utilize them
> have been destroyed.
> This commit ensures that resources are not released prematurely by waiting
> for the associated workqueue to complete before deallocating them.
>
> Cc: stable@vger.kernel.org
> Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking")
> Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> ---
> drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index fcf499cc9458..43b4f8207bb3 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -1825,11 +1825,11 @@ static int ucsi_init(struct ucsi *ucsi)
>
> err_unregister:
> for (con = connector; con->port; con++) {
> + if (con->wq)
> + destroy_workqueue(con->wq);
> ucsi_unregister_partner(con);
> ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
> ucsi_unregister_port_psy(con);
> - if (con->wq)
> - destroy_workqueue(con->wq);
>
> usb_power_delivery_unregister_capabilities(con->port_sink_caps);
> con->port_sink_caps = NULL;
> @@ -2013,10 +2013,6 @@ void ucsi_unregister(struct ucsi *ucsi)
>
> for (i = 0; i < ucsi->cap.num_connectors; i++) {
> cancel_work_sync(&ucsi->connector[i].work);
> - ucsi_unregister_partner(&ucsi->connector[i]);
> - ucsi_unregister_altmodes(&ucsi->connector[i],
> - UCSI_RECIPIENT_CON);
> - ucsi_unregister_port_psy(&ucsi->connector[i]);
>
> if (ucsi->connector[i].wq) {
> struct ucsi_work *uwork;
> @@ -2032,6 +2028,11 @@ void ucsi_unregister(struct ucsi *ucsi)
> destroy_workqueue(ucsi->connector[i].wq);
> }
>
> + ucsi_unregister_partner(&ucsi->connector[i]);
> + ucsi_unregister_altmodes(&ucsi->connector[i],
> + UCSI_RECIPIENT_CON);
> + ucsi_unregister_port_psy(&ucsi->connector[i]);
> +
> usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps);
> ucsi->connector[i].port_sink_caps = NULL;
> usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);
> --
> 2.49.0.rc0.332.g42c0ae87b1-goog
--
heikki
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access
2025-03-05 11:17 ` [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access Andrei Kuchynski
2025-03-05 13:59 ` Heikki Krogerus
@ 2025-03-06 20:28 ` Benson Leung
1 sibling, 0 replies; 3+ messages in thread
From: Benson Leung @ 2025-03-06 20:28 UTC (permalink / raw)
To: Andrei Kuchynski
Cc: Heikki Krogerus, Greg Kroah-Hartman, Dmitry Baryshkov,
Benson Leung, Christian A. Ehrhardt, Jameson Thies, linux-usb,
linux-kernel, stable
[-- Attachment #1: Type: text/plain, Size: 2408 bytes --]
Hi Andrei,
On Wed, Mar 05, 2025 at 11:17:39AM +0000, Andrei Kuchynski wrote:
> Resources should be released only after all threads that utilize them
> have been destroyed.
> This commit ensures that resources are not released prematurely by waiting
> for the associated workqueue to complete before deallocating them.
>
> Cc: stable@vger.kernel.org
> Fixes: b9aa02ca39a4 ("usb: typec: ucsi: Add polling mechanism for partner tasks like alt mode checking")
> Signed-off-by: Andrei Kuchynski <akuchynski@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
> ---
> drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------
> 1 file changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index fcf499cc9458..43b4f8207bb3 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -1825,11 +1825,11 @@ static int ucsi_init(struct ucsi *ucsi)
>
> err_unregister:
> for (con = connector; con->port; con++) {
> + if (con->wq)
> + destroy_workqueue(con->wq);
> ucsi_unregister_partner(con);
> ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
> ucsi_unregister_port_psy(con);
> - if (con->wq)
> - destroy_workqueue(con->wq);
>
> usb_power_delivery_unregister_capabilities(con->port_sink_caps);
> con->port_sink_caps = NULL;
> @@ -2013,10 +2013,6 @@ void ucsi_unregister(struct ucsi *ucsi)
>
> for (i = 0; i < ucsi->cap.num_connectors; i++) {
> cancel_work_sync(&ucsi->connector[i].work);
> - ucsi_unregister_partner(&ucsi->connector[i]);
> - ucsi_unregister_altmodes(&ucsi->connector[i],
> - UCSI_RECIPIENT_CON);
> - ucsi_unregister_port_psy(&ucsi->connector[i]);
>
> if (ucsi->connector[i].wq) {
> struct ucsi_work *uwork;
> @@ -2032,6 +2028,11 @@ void ucsi_unregister(struct ucsi *ucsi)
> destroy_workqueue(ucsi->connector[i].wq);
> }
>
> + ucsi_unregister_partner(&ucsi->connector[i]);
> + ucsi_unregister_altmodes(&ucsi->connector[i],
> + UCSI_RECIPIENT_CON);
> + ucsi_unregister_port_psy(&ucsi->connector[i]);
> +
> usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps);
> ucsi->connector[i].port_sink_caps = NULL;
> usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);
> --
> 2.49.0.rc0.332.g42c0ae87b1-goog
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-03-06 20:28 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20250305111739.1489003-1-akuchynski@chromium.org>
2025-03-05 11:17 ` [PATCH v2 1/1] usb: typec: ucsi: Fix NULL pointer access Andrei Kuchynski
2025-03-05 13:59 ` Heikki Krogerus
2025-03-06 20:28 ` Benson Leung
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox