Re: [PATCH v8 1/9] HID: hid-sensor-hub: don't use stale platform-data on remove

[srinivas pandruvada]

On Sun, 2024-09-08 at 23:07 +0200, Heiko Stuebner wrote:
> The hid-sensor-hub creates the individual device structs and
> transfers them
> to the created mfd platform-devices via the platform_data in the
> mfd_cell.
> 
> Before commit e651a1da442a ("HID: hid-sensor-hub: Allow parallel
> synchronous reads")
> the sensor-hub was managing access centrally, with one "completion"
> in the
> hub's data structure, which needed to be finished on removal at the
> latest.
> 
> The mentioned commit then moved this central management to each hid
> sensor
> device, resulting on a completion in each struct
> hid_sensor_hub_device.
> The remove procedure was adapted to go through all sensor devices and
> finish any pending "completion".
> 
> What this didn't take into account was, platform_device_add_data()
> that is
> used by mfd_add{_hotplug}_devices() does a kmemdup on the submitted
> platform-data. So the data the platform-device gets is a copy of the
> original data, meaning that the device worked on a different
> completion
> than what sensor_hub_remove() currently wants to access.
> 
> To fix that, use device_for_each_child() to go through each child-
> device
> similar to how mfd_remove_devices() unregisters the devices later and
> with that get the live platform_data to finalize the correct
> completion.
> 
> Fixes: e651a1da442a ("HID: hid-sensor-hub: Allow parallel synchronous
> reads")
> Signed-off-by: Heiko Stuebner <heiko@xxxxxxxxx>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@xxxxxxxxxxxxxxx>

> ---
>  drivers/hid/hid-sensor-hub.c | 21 ++++++++++++++-------
>  1 file changed, 14 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-
> hub.c
> index 26e93a331a51..3cd00afa453a 100644
> --- a/drivers/hid/hid-sensor-hub.c
> +++ b/drivers/hid/hid-sensor-hub.c
> @@ -730,23 +730,30 @@ static int sensor_hub_probe(struct hid_device
> *hdev,
>  	return ret;
>  }
>  
> +static int sensor_hub_finalize_pending_fn(struct device *dev, void
> *data)
> +{
> +	struct hid_sensor_hub_device *hsdev = dev->platform_data;
> +
> +	if (hsdev->pending.status)
> +		complete(&hsdev->pending.ready);
> +
> +	return 0;
> +}
> +
>  static void sensor_hub_remove(struct hid_device *hdev)
>  {
>  	struct sensor_hub_data *data = hid_get_drvdata(hdev);
>  	unsigned long flags;
> -	int i;
>  
>  	hid_dbg(hdev, " hardware removed\n");
>  	hid_hw_close(hdev);
>  	hid_hw_stop(hdev);
> +
>  	spin_lock_irqsave(&data->lock, flags);
> -	for (i = 0; i < data->hid_sensor_client_cnt; ++i) {
> -		struct hid_sensor_hub_device *hsdev =
> -			data-
> >hid_sensor_hub_client_devs[i].platform_data;
> -		if (hsdev->pending.status)
> -			complete(&hsdev->pending.ready);
> -	}
> +	device_for_each_child(&hdev->dev, NULL,
> +			      sensor_hub_finalize_pending_fn);
>  	spin_unlock_irqrestore(&data->lock, flags);
> +
>  	mfd_remove_devices(&hdev->dev);
>  	mutex_destroy(&data->mutex);
>  }