[PATCH] usb: typec: ucsi: fix teardown races with late notifications
flat view
COOLING14d
From: Iván Ezequiel Rodriguez <hidden>
Date: 2026-09-03 03:04:03
Also in:
lkml
Subsystem:
the rest, usb subsystem, usb typec class · Maintainers:
Linus Torvalds, Greg Kroah-Hartman, Heikki Krogerus
ucsi_acpi_remove() freed the UCSI instance before removing the ACPI notify handler. A concurrent notify could call into ucsi_acpi_notify() and use ua->ucsi after it was destroyed. Clear ucsi->ntfy before disabling PPM notifications and NULL the connector array after free so ucsi_connector_change() cannot schedule work on a dangling connector while a backend still delivers events. Tested: built drivers/usb/typec/ucsi/ with CONFIG_TYPEC_UCSI=m and CONFIG_UCSI_ACPI=m via docker kbuild; checkpatch clean. Signed-off-by: Iván Ezequiel Rodriguez <redacted> --- drivers/usb/typec/ucsi/ucsi.c | 11 +++++++++++ drivers/usb/typec/ucsi/ucsi_acpi.c | 11 ++++++++--- 2 files changed, 19 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index bef3f9b71d71..3395614764cf 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c@@ -2369,6 +2369,15 @@ void ucsi_unregister(struct ucsi *ucsi) ucsi_debugfs_unregister(ucsi); + /* + * Stop accepting connector-change events before the PPM disable + * command and before freeing connectors. Backends may still deliver + * a late notification (e.g. ACPI) until their own handler is removed; + * with ntfy cleared, ucsi_connector_change() returns early instead of + * scheduling work on a connector that is about to be freed. + */ + ucsi->ntfy = 0; + /* Disable notifications */ ucsi->ops->async_control(ucsi, cmd);
@@ -2382,6 +2391,8 @@ void ucsi_unregister(struct ucsi *ucsi) } kfree(ucsi->connector); + ucsi->connector = NULL; + memset(&ucsi->cap, 0, sizeof(ucsi->cap)); } EXPORT_SYMBOL_GPL(ucsi_unregister);
diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c
index 18286d3e9cc5..5fc485121dbb 100644
--- a/drivers/usb/typec/ucsi/ucsi_acpi.c
+++ b/drivers/usb/typec/ucsi/ucsi_acpi.c@@ -256,11 +256,16 @@ static void ucsi_acpi_remove(struct platform_device *pdev) { struct ucsi_acpi *ua = platform_get_drvdata(pdev); - ucsi_unregister(ua->ucsi); - ucsi_destroy(ua->ucsi); - + /* + * Drop the ACPI notify handler before tearing down the UCSI instance. + * Otherwise a concurrent notify can race into ucsi_acpi_notify() and + * use ua->ucsi after it has been freed. + */ acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev), ACPI_DEVICE_NOTIFY, ucsi_acpi_notify); + + ucsi_unregister(ua->ucsi); + ucsi_destroy(ua->ucsi); } static int ucsi_acpi_suspend(struct device *dev)
--
2.43.0