usb: dwc3: of-simple: fix use-after-free on remove

Quoted 31 lines · Rafael J. Wysocki

Quoted 30 lines · Johan Hovold

Quoted 29 lines · Rafael J. Wysocki

Quoted 28 lines · CEST Johan Hovold

Quoted 26 lines · Tony Lindgren

Hi,

Adding Rafael and linux-pm to Cc as well.

Quoted 21 lines · Felipe Balbi

This is a direct consequence of not paying attention to the order of things. If driver were to assume that pm_domain->activate() would do the right thing for the device -- meaning that probe would run with an active device --, then we wouldn't need that pm_runtime_get() call on probe at all. Rather we would follow the sequence:

        pm_runtime_forbid()
        pm_runtime_set_active()
        pm_runtime_enable()

        /* do your probe routine */

        pm_runtime_put_noidle()

Then you remove you would need to call pm_runtime_get_noresume() to balance out the pm_runtime_put_noidle() there.

(If you need to know why the pm_runtime_put_noidle(), remember that pm_runtime_set_active() increments the usage counter, so pm_runtime_put_noidle is basically allowing pm_runtime to happen as soon as userspace writes "auto" to /sys/..../power/control)

Quoted 4 lines

Quoted 4 lines

Quoted 4 lines

Quoted 4 lines

That's not correct; pm_runtime_set_active() only increments the usage counter of a parent (under some circumstances), so unless you have bus code incrementing the usage counter before probe, the above pm_runtime_put_noidle() would actually introduce an imbalance.

The confusion regarding the pm_runtime_put_noidle() at the end may come from the special requirement of the PCI bus type as per the comment in local_pci_probe().