Skip to contentSkip to conversation

usb: typec: ucsi: Release debugfs only if it has been allocated

PATCH In review Chen Yu 2 participants 3 messages Sep 11, 2023 – Sep 12, 2023

Subsystems (2)
USB USB Type-C class
lore
Share & tools
lore

Chen Yu

author
#0 lore raw

PATCH 1/1 usb: typec: ucsi: Release debugfs only if it has been allocated

The following NULL pointer exception was found during boot up:

calling ucsi_acpi_platform_driver_init+0x0/0xff0 [ucsi_acpi] @ 394 initcall mac_hid_init+0x0/0xff0 [mac_hid] returned 0 after 5 usecs

 BUG: kernel NULL pointer dereference, address: 0000000000000020
 Call Trace:
  ? ucsi_debugfs_unregister+0x15/0x30 [typec_ucsi]
  ucsi_destroy+0x17/0x30 [typec_ucsi]
  ucsi_acpi_probe+0x1d5/0x230 [ucsi_acpi]

It is possible that ucsi_acpi_probe() fails to install the notifier, and calls ucsi_destroy() to release the resource. However at that moment the debugfs has not been registered yet, thus the NULL pointer exception is triggered. Add the check for debugfs pointer.

Fixes Commit df0383ffad64 ("usb: typec: ucsi: Add debugfs for ucsi commands")
Signed-off-by Chen Yu <[email protected]>
---
 drivers/usb/typec/ucsi/debugfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/debugfs.c +2 -1
index 0c7bf88d4a7f..55533dc3d539 100644
@@ -84,7 +84,8 @@ void ucsi_debugfs_register(struct ucsi *ucsi)
 
 void ucsi_debugfs_unregister(struct ucsi *ucsi)
 {
-	debugfs_remove_recursive(ucsi->debugfs->dentry);
+	if (ucsi->debugfs)
+		debugfs_remove_recursive(ucsi->debugfs->dentry);
 	kfree(ucsi->debugfs);
 }
Signature · 1 line
2.25.1
maintainer
#1 lore raw
Quoted 10 lines · Chen Yu

The following NULL pointer exception was found during boot up:

calling ucsi_acpi_platform_driver_init+0x0/0xff0 [ucsi_acpi] @ 394 initcall mac_hid_init+0x0/0xff0 [mac_hid] returned 0 after 5 usecs

 BUG: kernel NULL pointer dereference, address: 0000000000000020
 Call Trace:
  ? ucsi_debugfs_unregister+0x15/0x30 [typec_ucsi]
  ucsi_destroy+0x17/0x30 [typec_ucsi]
  ucsi_acpi_probe+0x1d5/0x230 [ucsi_acpi]
Quoted 6 lines

It is possible that ucsi_acpi_probe() fails to install the notifier, and calls ucsi_destroy() to release the resource. However at that moment the debugfs has not been registered yet, thus the NULL pointer exception is triggered. Add the check for debugfs pointer.

Fixes Commit df0383ffad64 ("usb: typec: ucsi: Add debugfs for ucsi commands")

Incorrect format :(

Quoted 10 lines
Signed-off-by Chen Yu <[email protected]>
---
 drivers/usb/typec/ucsi/debugfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/debugfs.c +0 -0
index 0c7bf88d4a7f..55533dc3d539 100644

drivers/usb/typec/ucsi/debugfs.c void ucsi_debugfs_register(struct ucsi *ucsi) · line 90

Quoted 8 lines
drivers/usb/typec/ucsi/debugfs.c +2 -1
@@ -84,7 +84,8 @@ void ucsi_debugfs_register(struct ucsi *ucsi)
 
 void ucsi_debugfs_unregister(struct ucsi *ucsi)
 {
-	debugfs_remove_recursive(ucsi->debugfs->dentry);
+	if (ucsi->debugfs)
+		debugfs_remove_recursive(ucsi->debugfs->dentry);
 	kfree(ucsi->debugfs);
 }

What's wrong with this patch instead:

	https://lore.kernel.org/all/[email protected]/

thanks,

greg k-h

author
#2 lore raw

Hi Greg,

thanks for your time,

Quoted 11 lines · Greg Kroah-Hartman
Quoted 10 lines · Chen Yu

The following NULL pointer exception was found during boot up:

calling ucsi_acpi_platform_driver_init+0x0/0xff0 [ucsi_acpi] @ 394 initcall mac_hid_init+0x0/0xff0 [mac_hid] returned 0 after 5 usecs

 BUG: kernel NULL pointer dereference, address: 0000000000000020
 Call Trace:
  ? ucsi_debugfs_unregister+0x15/0x30 [typec_ucsi]
  ucsi_destroy+0x17/0x30 [typec_ucsi]
  ucsi_acpi_probe+0x1d5/0x230 [ucsi_acpi]
Quoted 9 lines
Quoted 6 lines

It is possible that ucsi_acpi_probe() fails to install the notifier, and calls ucsi_destroy() to release the resource. However at that moment the debugfs has not been registered yet, thus the NULL pointer exception is triggered. Add the check for debugfs pointer.

Fixes Commit df0383ffad64 ("usb: typec: ucsi: Add debugfs for ucsi commands")

Incorrect format :(

Ah, the 'Commit' was incorrectly added.

Quoted 20 lines
Quoted 10 lines
Signed-off-by Chen Yu <[email protected]>
---
 drivers/usb/typec/ucsi/debugfs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/typec/ucsi/debugfs.c +0 -0
index 0c7bf88d4a7f..55533dc3d539 100644

drivers/usb/typec/ucsi/debugfs.c void ucsi_debugfs_register(struct ucsi *ucsi) · line 90

Quoted 8 lines
drivers/usb/typec/ucsi/debugfs.c +2 -1
@@ -84,7 +84,8 @@ void ucsi_debugfs_register(struct ucsi *ucsi)
 
 void ucsi_debugfs_unregister(struct ucsi *ucsi)
 {
-	debugfs_remove_recursive(ucsi->debugfs->dentry);
+	if (ucsi->debugfs)
+		debugfs_remove_recursive(ucsi->debugfs->dentry);
 	kfree(ucsi->debugfs);
 }

What's wrong with this patch instead:

Quoted 2 lines
	https://lore.kernel.org/all/[email protected]/

Thanks for this link, I'll patch my kernel using above version.

thanks,
Chenyu