It is possible that the driver of the mux device has been
unbind by the time typec_mux_put() or typec_switch_put() is
called.
To prevent the NULL Pointer Dereference from happening in
this case when decrementing the reference count of the
module by using dev->driver->owner, storing the module
handle to the mux and switch data structures, and using the
stored value instead.
Fixes: ("3e3b81965cbf usb: typec: mux: Take care of driver module reference
counting")
Cc: [email protected]
Signed-off-by: Heikki Krogerus <[email protected]>
---
drivers/usb/typec/mux.c | 10 ++++++----
include/linux/usb/typec_mux.h | 2 ++
2 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/typec/mux.c b/drivers/usb/typec/mux.c
index 2ce54f3fc79c..617687c4eb20 100644
--- a/drivers/usb/typec/mux.c
+++ b/drivers/usb/typec/mux.c
@@ -63,7 +63,8 @@ struct typec_switch *typec_switch_get(struct device *dev)
sw = device_connection_find_match(dev, "orientation-switch", NULL,
typec_switch_match);
if (!IS_ERR_OR_NULL(sw)) {
- WARN_ON(!try_module_get(sw->dev->driver->owner));
+ sw->module = sw->dev->driver->owner;
+ WARN_ON(!try_module_get(sw->module));
get_device(sw->dev);
}
mutex_unlock(&switch_lock);
@@ -81,7 +82,7 @@ EXPORT_SYMBOL_GPL(typec_switch_get);
void typec_switch_put(struct typec_switch *sw)
{
if (!IS_ERR_OR_NULL(sw)) {
- module_put(sw->dev->driver->owner);
+ module_put(sw->module);
put_device(sw->dev);
}
}
@@ -206,7 +207,8 @@ struct typec_mux *typec_mux_get(struct device *dev,
mux = device_connection_find_match(dev, "mode-switch", (void *)desc,
typec_mux_match);
if (!IS_ERR_OR_NULL(mux)) {
- WARN_ON(!try_module_get(mux->dev->driver->owner));
+ mux->module = mux->dev->driver->owner;
+ WARN_ON(!try_module_get(mux->module));
get_device(mux->dev);
}
mutex_unlock(&mux_lock);
@@ -224,7 +226,7 @@ EXPORT_SYMBOL_GPL(typec_mux_get);
void typec_mux_put(struct typec_mux *mux)
{
if (!IS_ERR_OR_NULL(mux)) {
- module_put(mux->dev->driver->owner);
+ module_put(mux->module);
put_device(mux->dev);
}
}
diff --git a/include/linux/usb/typec_mux.h b/include/linux/usb/typec_mux.h
index 43f40685e53c..b31498020bf3 100644
--- a/include/linux/usb/typec_mux.h
+++ b/include/linux/usb/typec_mux.h
@@ -20,6 +20,7 @@ struct device;
*/
struct typec_switch {
struct device *dev;
+ struct module *module;
struct list_head entry;
int (*set)(struct typec_switch *sw, enum typec_orientation orientation);
@@ -37,6 +38,7 @@ struct typec_switch {
*/
struct typec_mux {
struct device *dev;
+ struct module *module;
struct list_head entry;
int (*set)(struct typec_mux *mux, int state);
--
2.20.1
