[PATCH] usb: typec: tcpci: Don't skip cleanup in .remove() on error

[PATCH] usb: typec: tcpci: Don't skip cleanup in .remove() on error

[Uwe Kleine-König]

Returning an error value in an i2c remove callback results in an error
message being emitted by the i2c core, but otherwise it doesn't make a
difference. The device goes away anyhow and the devm cleanups are
called.

In this case the remove callback even returns early without stopping the
tcpm worker thread and various timers. A work scheduled on the work
queue, or a firing timer after tcpci_remove() returned probably results
in a use-after-free situation because the regmap and driver data were
freed. So better make sure that tcpci_unregister_port() is called even
if disabling the irq failed.

Also emit a more specific error message instead of the i2c core's
"remove failed (EIO), will be ignored" and return 0 to suppress the
core's warning.

This patch is (also) a preparation for making i2c remove callbacks
return void.

Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
---
 drivers/usb/typec/tcpm/tcpci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
index e07d26a3cd8e..f33e08eb7670 100644
--- a/drivers/usb/typec/tcpm/tcpci.c
+++ b/drivers/usb/typec/tcpm/tcpci.c
@@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client)
 	/* Disable chip interrupts before unregistering port */
 	err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0);
 	if (err < 0)
-		return err;
+		dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err));
 
 	tcpci_unregister_port(chip->tcpci);
 

base-commit: 3123109284176b1532874591f7c81f3837bbdc17
-- 
2.35.1

Re: [PATCH] usb: typec: tcpci: Don't skip cleanup in .remove() on error

[Heikki Krogerus]

On Mon, May 02, 2022 at 10:04:56AM +0200, Uwe Kleine-König wrote:
> Returning an error value in an i2c remove callback results in an error
> message being emitted by the i2c core, but otherwise it doesn't make a
> difference. The device goes away anyhow and the devm cleanups are
> called.
> 
> In this case the remove callback even returns early without stopping the
> tcpm worker thread and various timers. A work scheduled on the work
> queue, or a firing timer after tcpci_remove() returned probably results
> in a use-after-free situation because the regmap and driver data were
> freed. So better make sure that tcpci_unregister_port() is called even
> if disabling the irq failed.
> 
> Also emit a more specific error message instead of the i2c core's
> "remove failed (EIO), will be ignored" and return 0 to suppress the
> core's warning.
> 
> This patch is (also) a preparation for making i2c remove callbacks
> return void.
> 
> Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver")
> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>

> ---
>  drivers/usb/typec/tcpm/tcpci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
> index e07d26a3cd8e..f33e08eb7670 100644
> --- a/drivers/usb/typec/tcpm/tcpci.c
> +++ b/drivers/usb/typec/tcpm/tcpci.c
> @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client)
>  	/* Disable chip interrupts before unregistering port */
>  	err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0);
>  	if (err < 0)
> -		return err;
> +		dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err));
>  
>  	tcpci_unregister_port(chip->tcpci);
>  
> 
> base-commit: 3123109284176b1532874591f7c81f3837bbdc17
> -- 
> 2.35.1

thanks,

-- 
heikki

Re: [PATCH] usb: typec: tcpci: Don't skip cleanup in .remove() on error

[Guenter Roeck]

On 5/2/22 01:04, Uwe Kleine-König wrote:
> Returning an error value in an i2c remove callback results in an error
> message being emitted by the i2c core, but otherwise it doesn't make a
> difference. The device goes away anyhow and the devm cleanups are
> called.
> 
> In this case the remove callback even returns early without stopping the
> tcpm worker thread and various timers. A work scheduled on the work
> queue, or a firing timer after tcpci_remove() returned probably results
> in a use-after-free situation because the regmap and driver data were
> freed. So better make sure that tcpci_unregister_port() is called even
> if disabling the irq failed.
> 
> Also emit a more specific error message instead of the i2c core's
> "remove failed (EIO), will be ignored" and return 0 to suppress the
> core's warning.
> 
> This patch is (also) a preparation for making i2c remove callbacks
> return void.
> 
> Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver")
> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

Reviewed-by: Guenter Roeck <linux@roeck-us.net>

> ---
>   drivers/usb/typec/tcpm/tcpci.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
> index e07d26a3cd8e..f33e08eb7670 100644
> --- a/drivers/usb/typec/tcpm/tcpci.c
> +++ b/drivers/usb/typec/tcpm/tcpci.c
> @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client)
>   	/* Disable chip interrupts before unregistering port */
>   	err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0);
>   	if (err < 0)
> -		return err;
> +		dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err));
>   
>   	tcpci_unregister_port(chip->tcpci);
>   
> 
> base-commit: 3123109284176b1532874591f7c81f3837bbdc17

Re: [PATCH] usb: typec: tcpci: Don't skip cleanup in .remove() on error

[Guenter Roeck]

On Mon, May 02, 2022 at 10:04:56AM +0200, Uwe Kleine-König wrote:
> Returning an error value in an i2c remove callback results in an error
> message being emitted by the i2c core, but otherwise it doesn't make a
> difference. The device goes away anyhow and the devm cleanups are
> called.
> 
> In this case the remove callback even returns early without stopping the
> tcpm worker thread and various timers. A work scheduled on the work
> queue, or a firing timer after tcpci_remove() returned probably results
> in a use-after-free situation because the regmap and driver data were
> freed. So better make sure that tcpci_unregister_port() is called even
> if disabling the irq failed.
> 
> Also emit a more specific error message instead of the i2c core's
> "remove failed (EIO), will be ignored" and return 0 to suppress the
> core's warning.
> 
> This patch is (also) a preparation for making i2c remove callbacks
> return void.
> 
> Fixes: 3ba76256fc4e ("usb: typec: tcpci: mask event interrupts when remove driver")
> Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

Reviewed-by: Guenter Roeck <linux@roeck-us.net>

> ---
>  drivers/usb/typec/tcpm/tcpci.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
> index e07d26a3cd8e..f33e08eb7670 100644
> --- a/drivers/usb/typec/tcpm/tcpci.c
> +++ b/drivers/usb/typec/tcpm/tcpci.c
> @@ -877,7 +877,7 @@ static int tcpci_remove(struct i2c_client *client)
>  	/* Disable chip interrupts before unregistering port */
>  	err = tcpci_write16(chip->tcpci, TCPC_ALERT_MASK, 0);
>  	if (err < 0)
> -		return err;
> +		dev_warn(&client->dev, "Failed to disable irqs (%pe)\n", ERR_PTR(err));
>  
>  	tcpci_unregister_port(chip->tcpci);
>  
> 
> base-commit: 3123109284176b1532874591f7c81f3837bbdc17
> -- 
> 2.35.1
>