[PATCH v1] usb: kbd: destroy device after console is stopped

[Andy Shevchenko <andriy.shevchenko@linux.intel.com>]

On Wed, Feb 03, 2021 at 01:25:38PM +0100, Nicolas Saenz Julienne wrote:
> Andy, Tony,
> Sorry for my late reply, but I got a bad cold.

I hope you are doing well.

Unfortunately I haven't heard from you lately, so I have decided to send out
whatever I have as a patch series. You are Cc'ed on the last patch (it has
prerequisites, so better to apply entire series for easy going).

That said, I have dropped the 'iomux' branch from my public tree.

> On Thu, 2021-01-28 at 15:46 -0500, Tom Rini wrote:
> > On Thu, Jan 28, 2021 at 10:35:37PM +0200, Andy Shevchenko wrote:
> > > On Thu, Jan 28, 2021 at 06:19:56PM +0100, Nicolas Saenz Julienne wrote:
> > > > Hi Andy,
> > > > 
> > > > On Thu, 2021-01-28 at 18:55 +0200, Andy Shevchenko wrote:
> > > > > In case of IOMUX enabled it assumes that console devices in the list
> > > > > are available to get them stopped properly via ->stop() callback.
> > > > > However, the USB keyboard driver violates this assumption and tries
> > > > > to play tricks so the device get destroyed while being listed as
> > > > > an active console.
> > > > > 
> > > > > Swap the order of device deregistration and IOMUX update to avoid
> > > > > the use-after-free.
> > > > > 
> > > > > Fixes: 3cbcb2892809 ("usb: Fix usb_kbd_deregister when console-muxing is used")
> > > > > Fixes: 8a8348703081 ("dm: usb: Add a remove() method for USB keyboards")
> > > > > Reported-by: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
> > > > > Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> > > > > ---
> > > > > v2: Nicolas, can you test this one instead of yours?
> > > > 
> > > > Sadly this doesn't seem to work, and breaks a bunch of other tests in the
> > > > process. You can try it yourself by running: './test/py/test.py --bd sandbox
> > > > --build'
> > > 
> > > Now I'm able to run test cases. I see some of them failing even without my
> > > patch, but few definitely related. Can you give a list of failed ones on your
> > > side?  I can compare that we are on the same page here.
> > 
> > Running this here on sandbox I get:
> > FAILED test/py/tests/test_ut.py::test_ut[ut_dm_bootcount] - OSError: [Errno 5] Input/output ...
> > FAILED test/py/tests/test_ut.py::test_ut[ut_dm_usb_flash] - OSError: [Errno 5] Input/output ...
> > FAILED test/py/tests/test_ut.py::test_ut[ut_dm_usb_multi] - OSError: [Errno 5] Input/output ...
> > FAILED test/py/tests/test_ut.py::test_ut[ut_dm_video_ansi] - OSError: [Errno 5] Input/output...
> 
> This is what I'm seeing too.

-- 
With Best Regards,
Andy Shevchenko