[RFC PATCH 6.6.y 3/4] misc: ti-st: drain published users before transport removal

[Hongyan Xu]

kim_remove() leaves the transport published while it tears down GPIO,
sysfs state and the core.  A protocol registration or write can therefore
retain the core pointer across kfree().

Under the publication mutex, mark the core as removing and clear its
global slot.  Unregister the line discipline and wait for all previously
accounted users before releasing the core and its parent data.  Keep the
GPIO and platform data valid until those users have drained.

Fixes: 53618cc1e51e ("Staging: sources for ST core")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Hongyan Xu <getshell@xxxxxxxxxx>
---
 drivers/misc/ti-st/st_core.c | 25 ++++++++++++++-----------
 drivers/misc/ti-st/st_kim.c  | 22 ++++++++++++----------
 2 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index 43d2587..3aed6c3 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -906,20 +906,23 @@ err_unreg_ldisc:
 void st_core_exit(struct st_data_s *st_gdata)
 {
 	long err;
+
+	if (!st_gdata)
+		return;
+
+	tty_unregister_ldisc(&st_ldisc_ops);
+	wait_event(st_gdata->users_wait,
+		   !atomic_read(&st_gdata->active_users));
+
 	/* internal module cleanup */
 	err = st_ll_deinit(st_gdata);
 	if (err)
 		pr_err("error during deinit of ST LL %ld", err);
 
-	if (st_gdata != NULL) {
-		/* Free ST Tx Qs and skbs */
-		skb_queue_purge(&st_gdata->txq);
-		skb_queue_purge(&st_gdata->tx_waitq);
-		kfree_skb(st_gdata->rx_skb);
-		kfree_skb(st_gdata->tx_skb);
-		/* TTY ldisc cleanup */
-		tty_unregister_ldisc(&st_ldisc_ops);
-		/* free the global data pointer */
-		kfree(st_gdata);
-	}
+	/* Free ST Tx Qs and skbs */
+	skb_queue_purge(&st_gdata->txq);
+	skb_queue_purge(&st_gdata->tx_waitq);
+	kfree_skb(st_gdata->rx_skb);
+	kfree_skb(st_gdata->tx_skb);
+	kfree(st_gdata);
 }
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 11eadc1..ab84fe6 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -788,28 +788,30 @@ err_core_init:
 
 static int kim_remove(struct platform_device *pdev)
 {
-	/* free the GPIOs requested */
 	struct ti_st_plat_data	*pdata = pdev->dev.platform_data;
 	struct kim_data_s	*kim_gdata;
+	int id = 0;
 
 	kim_gdata = platform_get_drvdata(pdev);
-
-	/*
-	 * Free the Bluetooth/FM/GPIO
-	 * nShutdown gpio from the system
-	 */
-	gpio_free(pdata->nshutdown_gpio);
-	pr_info("nshutdown GPIO Freed");
+	if (pdev->id >= 0 && pdev->id < MAX_ST_DEVICES)
+		id = pdev->id;
+	mutex_lock(&st_kim_mutex);
+	kim_gdata->core_data->removing = true;
+	st_kim_devices[id] = NULL;
+	mutex_unlock(&st_kim_mutex);
 
 	debugfs_remove_recursive(kim_debugfs_dir);
 	sysfs_remove_group(&pdev->dev.kobj, &uim_attr_grp);
 	pr_info("sysfs entries removed");
 
-	kim_gdata->kim_pdev = NULL;
 	st_core_exit(kim_gdata->core_data);
+	kim_gdata->core_data = NULL;
+	kim_gdata->kim_pdev = NULL;
+	gpio_free(pdata->nshutdown_gpio);
+	pr_info("nshutdown GPIO Freed");
 
+	platform_set_drvdata(pdev, NULL);
 	kfree(kim_gdata);
-	kim_gdata = NULL;
 	return 0;
 }
 
-- 
2.50.1.windows.1