When typec_altmode_put_partner is called by a plug altmode upon release, the port altmode the plug belongs to will not remove its reference to the plug. The check to see if the altmode being released is a plug evaluates against the released altmode's partner instead of the calling altmode, so change adev in typec_altmode_put_partner to properly refer to the altmode being released.
Because typec_altmode_set_partner calls get_device() on the port altmode, add partner_adev that points to the port altmode in typec_put_partner to call put_device() on. typec_altmode_set_partner is not called for port altmodes, so add a check in typec_altmode_release to prevent typec_altmode_put_partner() calls on port altmode release.
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes") Cc: stable@vger.kernel.org Co-developed-by: Christian A. Ehrhardt lk@c--e.de Signed-off-by: Christian A. Ehrhardt lk@c--e.de Signed-off-by: RD Babiera rdbabiera@google.com --- Changes since v3: * added partner_adev to properly put_device() on port altmode. --- drivers/usb/typec/class.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c index 4d11f2b536fa..015aa9253353 100644 --- a/drivers/usb/typec/class.c +++ b/drivers/usb/typec/class.c @@ -263,11 +263,13 @@ static void typec_altmode_put_partner(struct altmode *altmode) { struct altmode *partner = altmode->partner; struct typec_altmode *adev; + struct typec_altmode *partner_adev;
if (!partner) return;
- adev = &partner->adev; + adev = &altmode->adev; + partner_adev = &partner->adev;
if (is_typec_plug(adev->dev.parent)) { struct typec_plug *plug = to_typec_plug(adev->dev.parent); @@ -276,7 +278,7 @@ static void typec_altmode_put_partner(struct altmode *altmode) } else { partner->partner = NULL; } - put_device(&adev->dev); + put_device(&partner_adev->dev); }
/** @@ -497,7 +499,8 @@ static void typec_altmode_release(struct device *dev) { struct altmode *alt = to_altmode(to_typec_altmode(dev));
- typec_altmode_put_partner(alt); + if (!is_typec_port(dev->parent)) + typec_altmode_put_partner(alt);
altmode_id_remove(alt->adev.dev.parent, alt->id); kfree(alt);
base-commit: e7d3b9f28654dbfce7e09f8028210489adaf6a33
On Wed, Jan 03, 2024 at 06:17:55PM +0000, RD Babiera wrote:
When typec_altmode_put_partner is called by a plug altmode upon release, the port altmode the plug belongs to will not remove its reference to the plug. The check to see if the altmode being released is a plug evaluates against the released altmode's partner instead of the calling altmode, so change adev in typec_altmode_put_partner to properly refer to the altmode being released.
Because typec_altmode_set_partner calls get_device() on the port altmode, add partner_adev that points to the port altmode in typec_put_partner to call put_device() on. typec_altmode_set_partner is not called for port altmodes, so add a check in typec_altmode_release to prevent typec_altmode_put_partner() calls on port altmode release.
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes") Cc: stable@vger.kernel.org Co-developed-by: Christian A. Ehrhardt lk@c--e.de Signed-off-by: Christian A. Ehrhardt lk@c--e.de Signed-off-by: RD Babiera rdbabiera@google.com
I was able to reproduce the bug of the original report from here
https://lore.kernel.org/all/CAP-bSRb3SXpgo_BEdqZB-p1K5625fMegRZ17ZkPE1J8ZYgE...
(with some hacks) and verified that this change on top of a revert of b17b7fe6dd (already in linux-usb) fixes the original bug. The test does not excercise the code that deals with cable plugs, though. Thus:
Tested-by: Christian A. Ehrhardt lk@c--e.de
Given that this is otherwise a 6.7 regression it might be a good idea to consider this for 6.7?
Changes since v3:
- added partner_adev to properly put_device() on port altmode.
drivers/usb/typec/class.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c index 4d11f2b536fa..015aa9253353 100644 --- a/drivers/usb/typec/class.c +++ b/drivers/usb/typec/class.c @@ -263,11 +263,13 @@ static void typec_altmode_put_partner(struct altmode *altmode) { struct altmode *partner = altmode->partner; struct typec_altmode *adev;
- struct typec_altmode *partner_adev;
if (!partner) return;
- adev = &partner->adev;
- adev = &altmode->adev;
- partner_adev = &partner->adev;
if (is_typec_plug(adev->dev.parent)) { struct typec_plug *plug = to_typec_plug(adev->dev.parent); @@ -276,7 +278,7 @@ static void typec_altmode_put_partner(struct altmode *altmode) } else { partner->partner = NULL; }
- put_device(&adev->dev);
- put_device(&partner_adev->dev);
} /** @@ -497,7 +499,8 @@ static void typec_altmode_release(struct device *dev) { struct altmode *alt = to_altmode(to_typec_altmode(dev));
- typec_altmode_put_partner(alt);
- if (!is_typec_port(dev->parent))
typec_altmode_put_partner(alt);altmode_id_remove(alt->adev.dev.parent, alt->id); kfree(alt);
base-commit: e7d3b9f28654dbfce7e09f8028210489adaf6a33
2.43.0.472.g3155946c3a-goog
regards Christian
On Wed, Jan 03, 2024 at 06:17:55PM +0000, RD Babiera wrote:
When typec_altmode_put_partner is called by a plug altmode upon release, the port altmode the plug belongs to will not remove its reference to the plug. The check to see if the altmode being released is a plug evaluates against the released altmode's partner instead of the calling altmode, so change adev in typec_altmode_put_partner to properly refer to the altmode being released.
Because typec_altmode_set_partner calls get_device() on the port altmode, add partner_adev that points to the port altmode in typec_put_partner to call put_device() on. typec_altmode_set_partner is not called for port altmodes, so add a check in typec_altmode_release to prevent typec_altmode_put_partner() calls on port altmode release.
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes") Cc: stable@vger.kernel.org Co-developed-by: Christian A. Ehrhardt lk@c--e.de Signed-off-by: Christian A. Ehrhardt lk@c--e.de Signed-off-by: RD Babiera rdbabiera@google.com
Acked-by: Heikki Krogerus heikki.krogerus@linux.intel.com
Changes since v3:
- added partner_adev to properly put_device() on port altmode.
drivers/usb/typec/class.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c index 4d11f2b536fa..015aa9253353 100644 --- a/drivers/usb/typec/class.c +++ b/drivers/usb/typec/class.c @@ -263,11 +263,13 @@ static void typec_altmode_put_partner(struct altmode *altmode) { struct altmode *partner = altmode->partner; struct typec_altmode *adev;
- struct typec_altmode *partner_adev;
if (!partner) return;
- adev = &partner->adev;
- adev = &altmode->adev;
- partner_adev = &partner->adev;
if (is_typec_plug(adev->dev.parent)) { struct typec_plug *plug = to_typec_plug(adev->dev.parent); @@ -276,7 +278,7 @@ static void typec_altmode_put_partner(struct altmode *altmode) } else { partner->partner = NULL; }
- put_device(&adev->dev);
- put_device(&partner_adev->dev);
} /** @@ -497,7 +499,8 @@ static void typec_altmode_release(struct device *dev) { struct altmode *alt = to_altmode(to_typec_altmode(dev));
- typec_altmode_put_partner(alt);
- if (!is_typec_port(dev->parent))
typec_altmode_put_partner(alt);altmode_id_remove(alt->adev.dev.parent, alt->id); kfree(alt);
base-commit: e7d3b9f28654dbfce7e09f8028210489adaf6a33
2.43.0.472.g3155946c3a-goog
linux-stable-mirror@lists.linaro.org
-
Christian Ehrhardt -
Heikki Krogerus -
RD Babiera