FAILED: patch "[PATCH] usb: typec: ucsi: Fix NULL pointer access" failed to apply to 6.1-stable tree

The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x b13abcb7ddd8d38de769486db5bd917537b32ab1
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2025030920-fancy-such-266d@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From b13abcb7ddd8d38de769486db5bd917537b32ab1 Mon Sep 17 00:00:00 2001
From: Andrei Kuchynski <[email protected]>
Date: Wed, 5 Mar 2025 11:17:39 +0000
Subject: [PATCH] usb: typec: ucsi: Fix NULL pointer access

Resources should be released only after all threads that utilize them have been destroyed.
This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them.

index 7a56d3f840d7..2a2915b0a645 100644
@@ -1825,11 +1825,11 @@ static int ucsi_init(struct ucsi *ucsi)
 
 err_unregister:
 	for (con = connector; con->port; con++) {
+		if (con->wq)
+			destroy_workqueue(con->wq);
 		ucsi_unregister_partner(con);
 		ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
 		ucsi_unregister_port_psy(con);
-		if (con->wq)
-			destroy_workqueue(con->wq);
 
 		usb_power_delivery_unregister_capabilities(con->port_sink_caps);
 		con->port_sink_caps = NULL;

@@ -2013,10 +2013,6 @@ void ucsi_unregister(struct ucsi *ucsi)
 
 	for (i = 0; i < ucsi->cap.num_connectors; i++) {
 		cancel_work_sync(&ucsi->connector[i].work);
-		ucsi_unregister_partner(&ucsi->connector[i]);
-		ucsi_unregister_altmodes(&ucsi->connector[i],
-					 UCSI_RECIPIENT_CON);
-		ucsi_unregister_port_psy(&ucsi->connector[i]);
 
 		if (ucsi->connector[i].wq) {
 			struct ucsi_work *uwork;

@@ -2032,6 +2028,11 @@ void ucsi_unregister(struct ucsi *ucsi)
 			destroy_workqueue(ucsi->connector[i].wq);
 		}
 
+		ucsi_unregister_partner(&ucsi->connector[i]);
+		ucsi_unregister_altmodes(&ucsi->connector[i],
+					 UCSI_RECIPIENT_CON);
+		ucsi_unregister_port_psy(&ucsi->connector[i]);
+
 		usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps);
 		ucsi->connector[i].port_sink_caps = NULL;
 		usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);

Resources should be released only after all threads that utilize them have been destroyed.
This commit ensures that resources are not released prematurely by waiting for the associated workqueue to complete before deallocating them.

---
 drivers/usb/typec/ucsi/ucsi.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

index 9c82dc94da81..2adf5fdc0c56 100644
@@ -1313,11 +1313,11 @@ static int ucsi_init(struct ucsi *ucsi)
 
 err_unregister:
 	for (con = connector; con->port; con++) {
+		if (con->wq)
+			destroy_workqueue(con->wq);
 		ucsi_unregister_partner(con);
 		ucsi_unregister_altmodes(con, UCSI_RECIPIENT_CON);
 		ucsi_unregister_port_psy(con);
-		if (con->wq)
-			destroy_workqueue(con->wq);
 		typec_unregister_port(con->port);
 		con->port = NULL;
 	}

@@ -1479,10 +1479,6 @@ void ucsi_unregister(struct ucsi *ucsi)
 
 	for (i = 0; i < ucsi->cap.num_connectors; i++) {
 		cancel_work_sync(&ucsi->connector[i].work);
-		ucsi_unregister_partner(&ucsi->connector[i]);
-		ucsi_unregister_altmodes(&ucsi->connector[i],
-					 UCSI_RECIPIENT_CON);
-		ucsi_unregister_port_psy(&ucsi->connector[i]);
 
 		if (ucsi->connector[i].wq) {
 			struct ucsi_work *uwork;

@@ -1497,6 +1493,11 @@ void ucsi_unregister(struct ucsi *ucsi)
 			mutex_unlock(&ucsi->connector[i].lock);
 			destroy_workqueue(ucsi->connector[i].wq);
 		}
+
+		ucsi_unregister_partner(&ucsi->connector[i]);
+		ucsi_unregister_altmodes(&ucsi->connector[i],
+					 UCSI_RECIPIENT_CON);
+		ucsi_unregister_port_psy(&ucsi->connector[i]);
 		typec_unregister_port(ucsi->connector[i].port);
 	}
 

2.49.0.395.g12beb8f557-goog

[ Sasha's backport helper bot ]

Hi,

Summary of potential issues:
⚠️ Found matching upstream commit but patch is missing proper reference to it

Found matching upstream commit: b13abcb7ddd8d38de769486db5bd917537b32ab1

Status in newer kernel trees:
6.13.y | Present (different SHA1: 592a0327d026)
6.12.y | Present (different SHA1: 079a3e52f3e7)
6.6.y | Present (different SHA1: 46fba7be161b)

Note: The patch differs from the upstream commit:
---
1: b13abcb7ddd8d ! 1: f2b614dccef6c usb: typec: ucsi: Fix NULL pointer access
@@ Commit message

+ (cherry picked from commit b13abcb7ddd8d38de769486db5bd917537b32ab1)

## drivers/usb/typec/ucsi/ucsi.c ##
@@ drivers/usb/typec/ucsi/ucsi.c: static int ucsi_init(struct ucsi *ucsi)
@@ drivers/usb/typec/ucsi/ucsi.c: static int ucsi_init(struct ucsi *ucsi)
ucsi_unregister_port_psy(con);
- if (con->wq)
- destroy_workqueue(con->wq);
-
- usb_power_delivery_unregister_capabilities(con->port_sink_caps);
- con->port_sink_caps = NULL;
+ typec_unregister_port(con->port);
+ con->port = NULL;
+ }
@@ drivers/usb/typec/ucsi/ucsi.c: void ucsi_unregister(struct ucsi *ucsi)

for (i = 0; i < ucsi->cap.num_connectors; i++) {
@@ drivers/usb/typec/ucsi/ucsi.c: void ucsi_unregister(struct ucsi *ucsi)
if (ucsi->connector[i].wq) {
struct ucsi_work *uwork;
@@ drivers/usb/typec/ucsi/ucsi.c: void ucsi_unregister(struct ucsi *ucsi)
+ mutex_unlock(&ucsi->connector[i].lock);
destroy_workqueue(ucsi->connector[i].wq);
}
-
++
+ ucsi_unregister_partner(&ucsi->connector[i]);
+ ucsi_unregister_altmodes(&ucsi->connector[i],
+ UCSI_RECIPIENT_CON);
+ ucsi_unregister_port_psy(&ucsi->connector[i]);
-+
- usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_sink_caps);
- ucsi->connector[i].port_sink_caps = NULL;
- usb_power_delivery_unregister_capabilities(ucsi->connector[i].port_source_caps);
+ typec_unregister_port(ucsi->connector[i].port);
+ }
+
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.1.y        |  Success    |  Success   |