Re: [PATCH] pwm: gpio: unregister the chip on driver unbind

[Stefan Wahren]

Am 01.11.26 um 04:26 schrieb Yu Zhang:
> pwm_gpio_probe() registers the chip with pwmchip_add(), but the driver
> has neither a remove callback nor a devm action calling
> pwmchip_remove(). On unbind the devres callbacks release the GPIO
> descriptor, cancel the hrtimer and drop the reference taken by
> devm_pwmchip_alloc(), while the chip stays registered: it is still in
> the pwm_chips idr, its sysfs attributes and character device are still
> there and chip->operational is still true.
>
> The chip can therefore still be reached through sysfs export, the
> character device, debugfs and pwm_get() from a consumer. Those paths
> call into chip->ops, which point into unloaded module text once the
> module is gone, and pwm_gpio_apply() re-arms the cancelled hrtimer and
> drives a GPIO descriptor the driver no longer owns.
>
> Use devm_pwmchip_add() so that the chip is removed before the hrtimer
> is cancelled and the GPIO is released.
>
> Fixes: 7f61257cd6e1 ("pwm: Add GPIO PWM driver")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yu Zhang <yuz08559@xxxxxxxxx>
Reviewed-by: Stefan Wahren <wahrenst@xxxxxxx>