usb: dwc3: of-simple: fix use-after-free on remove

Quoted 27 lines · Felipe Balbi

Quoted 25 lines · Roger Quadros

Hi Johan,

Quoted 22 lines · Johan Hovold

The clocks have already been explicitly disabled and put as part of remove() so the runtime suspend callback must not be run when balancing the runtime PM usage count before returning.

Fixes 16adc674d0d6 ("usb: dwc3: add generic OF glue layer")

Signed-off-by Johan Hovold <[email protected]>

---

Changes in v2
- balance usage count only after disabling runtime PM to avoid racing with pm_runtime_suspend() as suggested by Alan

 drivers/usb/dwc3/dwc3-of-simple.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

drivers/usb/dwc3/dwc3-of-simple.c +0 -0

index cb2ee96fd3e8..048922d549dd 100644
@@ -165,8 +165,9 @@ static int dwc3_of_simple_remove(struct platform_device *pdev)
 

Quoted 10 lines

Quoted 6 lines

drivers/usb/dwc3/dwc3-of-simple.c static int dwc3_of_simple_remove(struct platform_device *pdev) · line 168

Quoted 3 lines

drivers/usb/dwc3/dwc3-of-simple.c +0 -1

 	reset_control_put(simple->resets);
 
-	pm_runtime_put_sync(dev);

Wasn't this call there to balance out the pm_runtime_get_sync() call in probe()? The pm_runtime_get_sync() call is still there in probe().

that's now balanced by put_noidle below

OK.

I'm still trying to get my head around this.

in probe() we do

{
	enable all clocks;
        pm_runtime_set_active(dev);
        pm_runtime_enable(dev);
        pm_runtime_get_sync(dev);
}

How will runtime suspend work at all?
We're holding a positive RPM count in probe().