diff mbox series

[v3,2/9] usb: typec: Add retimer handle to port

Message ID 20220707222045.1415417-3-pmalani@chromium.org (mailing list archive)
State Superseded
Headers show
Series Type-C switch driver and Type-C framework updates | expand

Commit Message

Prashant Malani July 7, 2022, 10:20 p.m. UTC
Similar to mux and orientation switch, add a handle for registered
retimer to the port, so that it has handles to the various switches
connected to it.

Signed-off-by: Prashant Malani <pmalani@chromium.org>
---

Changes since v2:
- No changes.

Changes since v1:
- Relinquish retimer reference during typec_release.

 drivers/usb/typec/class.c | 9 +++++++++
 drivers/usb/typec/class.h | 1 +
 2 files changed, 10 insertions(+)

Comments

Sergey Shtylyov July 8, 2022, 8:46 a.m. UTC | #1
Hello!

On 7/8/22 1:20 AM, Prashant Malani wrote:

> Similar to mux and orientation switch, add a handle for registered
> retimer to the port, so that it has handles to the various switches
> connected to it.
> 
> Signed-off-by: Prashant Malani <pmalani@chromium.org>
> ---
> 
> Changes since v2:
> - No changes.
> 
> Changes since v1:
> - Relinquish retimer reference during typec_release.
> 
>  drivers/usb/typec/class.c | 9 +++++++++
>  drivers/usb/typec/class.h | 1 +
>  2 files changed, 10 insertions(+)
> 
> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> index 9062836bb638..f08e32d552b4 100644
> --- a/drivers/usb/typec/class.c
> +++ b/drivers/usb/typec/class.c
[...]
> @@ -2249,6 +2251,13 @@ struct typec_port *typec_register_port(struct device *parent,
>  		return ERR_PTR(ret);
>  	}
>  
> +	port->retimer = typec_retimer_get(&port->dev);
> +	if (IS_ERR(port->retimer)) {
> +		ret = PTR_ERR(port->retimer);
> +		put_device(&port->dev);
> +		return ERR_PTR(ret);

   Why convert it to and fro, and not just return port->retimer?

[...]

MBR, Sergey
Greg Kroah-Hartman July 8, 2022, 9:21 a.m. UTC | #2
On Fri, Jul 08, 2022 at 11:46:44AM +0300, Sergey Shtylyov wrote:
> Hello!
> 
> On 7/8/22 1:20 AM, Prashant Malani wrote:
> 
> > Similar to mux and orientation switch, add a handle for registered
> > retimer to the port, so that it has handles to the various switches
> > connected to it.
> > 
> > Signed-off-by: Prashant Malani <pmalani@chromium.org>
> > ---
> > 
> > Changes since v2:
> > - No changes.
> > 
> > Changes since v1:
> > - Relinquish retimer reference during typec_release.
> > 
> >  drivers/usb/typec/class.c | 9 +++++++++
> >  drivers/usb/typec/class.h | 1 +
> >  2 files changed, 10 insertions(+)
> > 
> > diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
> > index 9062836bb638..f08e32d552b4 100644
> > --- a/drivers/usb/typec/class.c
> > +++ b/drivers/usb/typec/class.c
> [...]
> > @@ -2249,6 +2251,13 @@ struct typec_port *typec_register_port(struct device *parent,
> >  		return ERR_PTR(ret);
> >  	}
> >  
> > +	port->retimer = typec_retimer_get(&port->dev);
> > +	if (IS_ERR(port->retimer)) {
> > +		ret = PTR_ERR(port->retimer);
> > +		put_device(&port->dev);
> > +		return ERR_PTR(ret);
> 
>    Why convert it to and fro, and not just return port->retimer?

That would be a use-after-free as port might now be gone.

thanks,

greg k-h
Sergey Shtylyov July 8, 2022, 9:39 a.m. UTC | #3
On 7/8/22 12:21 PM, Greg Kroah-Hartman wrote:
[...]
>>> Similar to mux and orientation switch, add a handle for registered
>>> retimer to the port, so that it has handles to the various switches
>>> connected to it.
>>>
>>> Signed-off-by: Prashant Malani <pmalani@chromium.org>
>>> ---
>>>
>>> Changes since v2:
>>> - No changes.
>>>
>>> Changes since v1:
>>> - Relinquish retimer reference during typec_release.
>>>
>>>  drivers/usb/typec/class.c | 9 +++++++++
>>>  drivers/usb/typec/class.h | 1 +
>>>  2 files changed, 10 insertions(+)
>>>
>>> diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
>>> index 9062836bb638..f08e32d552b4 100644
>>> --- a/drivers/usb/typec/class.c
>>> +++ b/drivers/usb/typec/class.c
>> [...]
>>> @@ -2249,6 +2251,13 @@ struct typec_port *typec_register_port(struct device *parent,
>>>  		return ERR_PTR(ret);
>>>  	}
>>>  
>>> +	port->retimer = typec_retimer_get(&port->dev);
>>> +	if (IS_ERR(port->retimer)) {
>>> +		ret = PTR_ERR(port->retimer);
>>> +		put_device(&port->dev);
>>> +		return ERR_PTR(ret);
>>
>>    Why convert it to and fro, and not just return port->retimer?
> 
> That would be a use-after-free as port might now be gone.

   Ah, indeed!
   It would also ensue an explicit pointer cast...

> thanks,
> 
> greg k-h

MBR, Sergey
diff mbox series

Patch

diff --git a/drivers/usb/typec/class.c b/drivers/usb/typec/class.c
index 9062836bb638..f08e32d552b4 100644
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -12,6 +12,7 @@ 
 #include <linux/slab.h>
 #include <linux/usb/pd_vdo.h>
 #include <linux/usb/typec_mux.h>
+#include <linux/usb/typec_retimer.h>
 
 #include "bus.h"
 #include "class.h"
@@ -1736,6 +1737,7 @@  static void typec_release(struct device *dev)
 	ida_destroy(&port->mode_ids);
 	typec_switch_put(port->sw);
 	typec_mux_put(port->mux);
+	typec_retimer_put(port->retimer);
 	kfree(port->cap);
 	kfree(port);
 }
@@ -2249,6 +2251,13 @@  struct typec_port *typec_register_port(struct device *parent,
 		return ERR_PTR(ret);
 	}
 
+	port->retimer = typec_retimer_get(&port->dev);
+	if (IS_ERR(port->retimer)) {
+		ret = PTR_ERR(port->retimer);
+		put_device(&port->dev);
+		return ERR_PTR(ret);
+	}
+
 	ret = device_add(&port->dev);
 	if (ret) {
 		dev_err(parent, "failed to register port (%d)\n", ret);
diff --git a/drivers/usb/typec/class.h b/drivers/usb/typec/class.h
index 43fcf9e37a8c..673b2952b074 100644
--- a/drivers/usb/typec/class.h
+++ b/drivers/usb/typec/class.h
@@ -55,6 +55,7 @@  struct typec_port {
 	enum typec_orientation		orientation;
 	struct typec_switch		*sw;
 	struct typec_mux		*mux;
+	struct typec_retimer		*retimer;
 
 	const struct typec_capability	*cap;
 	const struct typec_operations   *ops;