Commit 74047eaa authored by Matti Vaittinen's avatar Matti Vaittinen Committed by Hans de Goede

extcon: extcon-max77693.c: Fix potential work-queue cancellation race

The extcon IRQ schedules a work item. IRQ is requested using devm while
WQ is cancelld at remove(). This mixing of devm and manual unwinding has
potential case where the WQ has been emptied (.remove() was ran) but
devm unwinding of IRQ was not yet done. It may be possible the IRQ is
triggered at this point scheduling new work item to the already flushed
queue.

According to the input documentation the input device allocated by
devm_input_allocate_device() does not need to be explicitly unregistered.
Use the new devm_work_autocancel() and remove the remove() to simplify the
code.
Signed-off-by: default avatarMatti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
Acked-by: default avatarChanwoo Choi <cw00.choi@samsung.com>
Link: https://lore.kernel.org/r/cbe8205eed8276f6e6db5003cfe51b8b0d4ac966.1623146580.git.matti.vaittinen@fi.rohmeurope.comSigned-off-by: default avatarHans de Goede <hdegoede@redhat.com>
parent 14ad7682
...@@ -5,6 +5,7 @@ ...@@ -5,6 +5,7 @@
// Copyright (C) 2012 Samsung Electrnoics // Copyright (C) 2012 Samsung Electrnoics
// Chanwoo Choi <cw00.choi@samsung.com> // Chanwoo Choi <cw00.choi@samsung.com>
#include <linux/devm-helpers.h>
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/i2c.h> #include <linux/i2c.h>
...@@ -1127,7 +1128,10 @@ static int max77693_muic_probe(struct platform_device *pdev) ...@@ -1127,7 +1128,10 @@ static int max77693_muic_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, info); platform_set_drvdata(pdev, info);
mutex_init(&info->mutex); mutex_init(&info->mutex);
INIT_WORK(&info->irq_work, max77693_muic_irq_work); ret = devm_work_autocancel(&pdev->dev, &info->irq_work,
max77693_muic_irq_work);
if (ret)
return ret;
/* Support irq domain for MAX77693 MUIC device */ /* Support irq domain for MAX77693 MUIC device */
for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) { for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) {
...@@ -1254,22 +1258,11 @@ static int max77693_muic_probe(struct platform_device *pdev) ...@@ -1254,22 +1258,11 @@ static int max77693_muic_probe(struct platform_device *pdev)
return ret; return ret;
} }
static int max77693_muic_remove(struct platform_device *pdev)
{
struct max77693_muic_info *info = platform_get_drvdata(pdev);
cancel_work_sync(&info->irq_work);
input_unregister_device(info->dock);
return 0;
}
static struct platform_driver max77693_muic_driver = { static struct platform_driver max77693_muic_driver = {
.driver = { .driver = {
.name = DEV_NAME, .name = DEV_NAME,
}, },
.probe = max77693_muic_probe, .probe = max77693_muic_probe,
.remove = max77693_muic_remove,
}; };
module_platform_driver(max77693_muic_driver); module_platform_driver(max77693_muic_driver);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment