[PATCH v1] usb: kbd: destroy device after console is stopped

[Tom Rini <trini@konsulko.com>]

On Thu, Jan 28, 2021 at 10:35:37PM +0200, Andy Shevchenko wrote:
> On Thu, Jan 28, 2021 at 06:19:56PM +0100, Nicolas Saenz Julienne wrote:
> > Hi Andy,
> > 
> > On Thu, 2021-01-28 at 18:55 +0200, Andy Shevchenko wrote:
> > > In case of IOMUX enabled it assumes that console devices in the list
> > > are available to get them stopped properly via ->stop() callback.
> > > However, the USB keyboard driver violates this assumption and tries
> > > to play tricks so the device get destroyed while being listed as
> > > an active console.
> > > 
> > > Swap the order of device deregistration and IOMUX update to avoid
> > > the use-after-free.
> > > 
> > > Fixes: 3cbcb2892809 ("usb: Fix usb_kbd_deregister when console-muxing is used")
> > > Fixes: 8a8348703081 ("dm: usb: Add a remove() method for USB keyboards")
> > > Reported-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
> > > Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> > > ---
> > > v2: Nicolas, can you test this one instead of yours?
> > 
> > Sadly this doesn't seem to work, and breaks a bunch of other tests in the
> > process. You can try it yourself by running: './test/py/test.py --bd sandbox
> > --build'
> 
> Now I'm able to run test cases. I see some of them failing even without my
> patch, but few definitely related. Can you give a list of failed ones on your
> side?  I can compare that we are on the same page here.

Running this here on sandbox I get:
FAILED test/py/tests/test_ut.py::test_ut[ut_dm_bootcount] - OSError: [Errno 5] Input/output ...
FAILED test/py/tests/test_ut.py::test_ut[ut_dm_usb_flash] - OSError: [Errno 5] Input/output ...
FAILED test/py/tests/test_ut.py::test_ut[ut_dm_usb_multi] - OSError: [Errno 5] Input/output ...
FAILED test/py/tests/test_ut.py::test_ut[ut_dm_video_ansi] - OSError: [Errno 5] Input/output...

and those 4 are segfaults of sandbox.

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20210128/e08d487d/attachment.sig>