Re: [PATCH RESEND v2 3/5] extcon: extcon-max77693.c: Fix potential work-queue cancellation race

From: Hans de Goede <hdegoede@redhat.com>
To: Chanwoo Choi <cw00.choi@samsung.com>,
	Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>,
	Matti Vaittinen <mazziesaccount@gmail.com>
Cc: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>,
	Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>,
	MyungJoo Ham <myungjoo.ham@samsung.com>,
	Marek Szyprowski <m.szyprowski@samsung.com>,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH RESEND v2 3/5] extcon: extcon-max77693.c: Fix potential work-queue cancellation race
Date: Thu, 10 Jun 2021 11:49:03 +0200	[thread overview]
Message-ID: <2d32dbab-7972-d064-6b5f-0789872db834@redhat.com> (raw)
In-Reply-To: <7f39c731-b644-0122-d68f-7da7e78b4252@samsung.com>

Hi,

On 6/10/21 11:43 AM, Chanwoo Choi wrote:
> On 6/8/21 7:10 PM, Matti Vaittinen wrote:
>> The extcon IRQ schedules a work item. IRQ is requested using devm while
>> WQ is cancelld at remove(). This mixing of devm and manual unwinding has
>> potential case where the WQ has been emptied (.remove() was ran) but
>> devm unwinding of IRQ was not yet done. It may be possible the IRQ is
>> triggered at this point scheduling new work item to the already flushed
>> queue.
>>
>> According to the input documentation the input device allocated by
>> devm_input_allocate_device() does not need to be explicitly unregistered.
>> Use the new devm_work_autocancel() and remove the remove() to simplify the
>> code.
>>
>> Signed-off-by: Matti Vaittinen <matti.vaittinen@fi.rohmeurope.com>
>> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
>> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
>> ---
>>
>> Please note that the change is compile-tested only. All proper testing is
>> highly appreciated.
>> ---
>>  drivers/extcon/extcon-max77693.c | 17 +++++------------
>>  1 file changed, 5 insertions(+), 12 deletions(-)
>>
>> diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
>> index 92af97e00828..1f1d9ab0c5c7 100644
>> --- a/drivers/extcon/extcon-max77693.c
>> +++ b/drivers/extcon/extcon-max77693.c
>> @@ -5,6 +5,7 @@
>>  // Copyright (C) 2012 Samsung Electrnoics
>>  // Chanwoo Choi <cw00.choi@samsung.com>
>>  
>> +#include <linux/devm-helpers.h>
>>  #include <linux/kernel.h>
>>  #include <linux/module.h>
>>  #include <linux/i2c.h>
>> @@ -1127,7 +1128,10 @@ static int max77693_muic_probe(struct platform_device *pdev)
>>  	platform_set_drvdata(pdev, info);
>>  	mutex_init(&info->mutex);
>>  
>> -	INIT_WORK(&info->irq_work, max77693_muic_irq_work);
>> +	ret = devm_work_autocancel(&pdev->dev, &info->irq_work,
>> +				   max77693_muic_irq_work);
>> +	if (ret)
>> +		return ret;
>>  
>>  	/* Support irq domain for MAX77693 MUIC device */
>>  	for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) {
>> @@ -1254,22 +1258,11 @@ static int max77693_muic_probe(struct platform_device *pdev)
>>  	return ret;
>>  }
>>  
>> -static int max77693_muic_remove(struct platform_device *pdev)
>> -{
>> -	struct max77693_muic_info *info = platform_get_drvdata(pdev);
>> -
>> -	cancel_work_sync(&info->irq_work);
>> -	input_unregister_device(info->dock);
> 
> I think that you have to keep the input_unregister_device().

As mentioned in the commit message, in input_unregister_device
is not necessary for input-devices created with
devm_input_allocate_device():

"According to the input documentation the input device allocated by
devm_input_allocate_device() does not need to be explicitly unregistered."

I have verified that the documentation is correct here, so there is
no need to keep the input_unregister_device() as it was never necessary
to have that there.

Regards,

Hans

> 
>> -
>> -	return 0;
>> -}
>> -
>>  static struct platform_driver max77693_muic_driver = {
>>  	.driver		= {
>>  		.name	= DEV_NAME,
>>  	},
>>  	.probe		= max77693_muic_probe,
>> -	.remove		= max77693_muic_remove,
>>  };
>>  
>>  module_platform_driver(max77693_muic_driver);
>>
> 