Re: [PATCH RESEND v2 3/5] extcon: extcon-max77693.c: Fix potential work-queue cancellation race

[Chanwoo Choi]

On 6/8/21 7:10 PM, Matti Vaittinen wrote:
> The extcon IRQ schedules a work item. IRQ is requested using devm while
> WQ is cancelld at remove(). This mixing of devm and manual unwinding has
> potential case where the WQ has been emptied (.remove() was ran) but
> devm unwinding of IRQ was not yet done. It may be possible the IRQ is
> triggered at this point scheduling new work item to the already flushed
> queue.
> 
> According to the input documentation the input device allocated by
> devm_input_allocate_device() does not need to be explicitly unregistered.
> Use the new devm_work_autocancel() and remove the remove() to simplify the
> code.
> 
> Signed-off-by: Matti Vaittinen <matti.vaittinen@xxxxxxxxxxxxxxxxx>
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@xxxxxxxxxxxxx>
> Reviewed-by: Hans de Goede <hdegoede@xxxxxxxxxx>
> ---
> 
> Please note that the change is compile-tested only. All proper testing is
> highly appreciated.
> ---
>  drivers/extcon/extcon-max77693.c | 17 +++++------------
>  1 file changed, 5 insertions(+), 12 deletions(-)
> 
> diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
> index 92af97e00828..1f1d9ab0c5c7 100644
> --- a/drivers/extcon/extcon-max77693.c
> +++ b/drivers/extcon/extcon-max77693.c
> @@ -5,6 +5,7 @@
>  // Copyright (C) 2012 Samsung Electrnoics
>  // Chanwoo Choi <cw00.choi@xxxxxxxxxxx>
>  
> +#include <linux/devm-helpers.h>
>  #include <linux/kernel.h>
>  #include <linux/module.h>
>  #include <linux/i2c.h>
> @@ -1127,7 +1128,10 @@ static int max77693_muic_probe(struct platform_device *pdev)
>  	platform_set_drvdata(pdev, info);
>  	mutex_init(&info->mutex);
>  
> -	INIT_WORK(&info->irq_work, max77693_muic_irq_work);
> +	ret = devm_work_autocancel(&pdev->dev, &info->irq_work,
> +				   max77693_muic_irq_work);
> +	if (ret)
> +		return ret;
>  
>  	/* Support irq domain for MAX77693 MUIC device */
>  	for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) {
> @@ -1254,22 +1258,11 @@ static int max77693_muic_probe(struct platform_device *pdev)
>  	return ret;
>  }
>  
> -static int max77693_muic_remove(struct platform_device *pdev)
> -{
> -	struct max77693_muic_info *info = platform_get_drvdata(pdev);
> -
> -	cancel_work_sync(&info->irq_work);
> -	input_unregister_device(info->dock);

I think that you have to keep the input_unregister_device().

> -
> -	return 0;
> -}
> -
>  static struct platform_driver max77693_muic_driver = {
>  	.driver		= {
>  		.name	= DEV_NAME,
>  	},
>  	.probe		= max77693_muic_probe,
> -	.remove		= max77693_muic_remove,
>  };
>  
>  module_platform_driver(max77693_muic_driver);
> 

-- 
Best Regards,
Chanwoo Choi
Samsung Electronics