[PATCH] usb: typec: ucsi: yoga-c630: unregister EC notifier before UCSI teardown

[Fan Wu]

Both yoga_c630_ucsi_remove() and the probe error path call
ucsi_unregister() while the EC notifier is still registered.
ucsi_unregister() frees the connector array, so an EC event (USB, HPD or
UCSI) arriving before yoga_c630_ec_unregister_notify() makes
yoga_c630_ucsi_notify() run on freed memory: typec_set_orientation() on the
freed port and ucsi_connector_change() queuing work in the freed connector
array. USB and HPD events do not depend on the UCSI notification-enable
state, so the disable command ucsi_unregister() sends to the EC does not
close this window.

Fix this by unregistering the EC notifier before ucsi_unregister() in both
paths, restoring the teardown ordering from before the error and remove
paths were reworked. blocking_notifier_chain_unregister() waits for a
running callback, so once it returns the EC interrupt thread can no longer
reach the UCSI instance and ucsi_unregister() can tear the connectors down
undisturbed.

The callback is also the only external source that requeues the connector
work, so the cancel_work_sync() calls in ucsi_unregister() can no longer
race with a new connector-change event.

This issue was found by an in-house static analysis tool.

Fixes: 168c3896f32e ("usb: typec: ucsi: yoga-c630: fix error and remove paths")
Cc: stable@xxxxxxxxxxxxxxx
Co-developed-by: Song Li <songl@xxxxxxxxxx>
Signed-off-by: Song Li <songl@xxxxxxxxxx>
Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>
---
 drivers/usb/typec/ucsi/ucsi_yoga_c630.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/typec/ucsi/ucsi_yoga_c630.c b/drivers/usb/typec/ucsi/ucsi_yoga_c630.c
index 1be18d1..59738dc 100644
--- a/drivers/usb/typec/ucsi/ucsi_yoga_c630.c
+++ b/drivers/usb/typec/ucsi/ucsi_yoga_c630.c
@@ -296,7 +296,9 @@ static int yoga_c630_ucsi_probe(struct auxiliary_device *adev,
 	return 0;
 
 err_ucsi_unregister:
+	yoga_c630_ec_unregister_notify(uec->ec, &uec->nb);
 	ucsi_unregister(uec->ucsi);
+	goto err_destroy;
 
 err_unregister:
 	yoga_c630_ec_unregister_notify(uec->ec, &uec->nb);
@@ -311,8 +313,8 @@ static void yoga_c630_ucsi_remove(struct auxiliary_device *adev)
 {
 	struct yoga_c630_ucsi *uec = auxiliary_get_drvdata(adev);
 
-	ucsi_unregister(uec->ucsi);
 	yoga_c630_ec_unregister_notify(uec->ec, &uec->nb);
+	ucsi_unregister(uec->ucsi);
 	ucsi_destroy(uec->ucsi);
 }