usb: typec: tcpci: Don't skip cleanup in .remove() on error
stable inclusion from stable-v5.10.117 commit 54979aa49e0f79d2e38e97416c6b9336749c7831 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5L66B Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=54979aa49e0f79d2e38e97416c6b9336749c7831 -------------------------------- commit bbc126ae upstream. Returning an error value in an i2c remove callback results in an error message being emitted by the i2c core, but otherwise it doesn't make a difference. The device goes away anyhow and the devm cleanups are called. In this case the remove callback even returns early without stopping the tcpm worker thread and various timers. A work scheduled on the work queue, or a firing timer after tcpci_remove() returned probably results in a use-after-free situation because the regmap and driver data were freed. So better make sure that tcpci_unregister_port() is called even if disabling the irq failed. Also emit a more specific error message instead of the i2c core's "remove failed (EIO), will be ignored" and return 0 to suppress the core's warning. This patch is (also) a preparation for making i2c remove callbacks return void. Fixes: 3ba76256 ("usb: typec: tcpci: mask event interrupts when remove driver") Signed-off-by:Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Cc: stable <stable@vger.kernel.org> Acked-by:
Heikki Krogerus <heikki.krogerus@linux.intel.com> Reviewed-by:
Guenter Roeck <linux@roeck-us.net> Link: https://lore.kernel.org/r/20220502080456.21568-1-u.kleine-koenig@pengutronix.de Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by:
Zheng Zengkai <zhengzengkai@huawei.com> Acked-by:
Xie XiuQi <xiexiuqi@huawei.com>
Loading
Please sign in to comment