On 16.8.2019 12.03, Schmid, Carsten wrote:
On driver removal, the platform_device_unregister call attached through devm_add_action_or_reset was executed after usb_hcd_pci_remove. This lead to a use-after-free for the iomem resource of the xhci-ext-caps driver in the platform removal because the parent of the resource was freed earlier. Fix this by reordering of the removal sequence.
Could all this be avoided if usb_hcd_pci_probe() used managed device resources as well? (using devm_request_mem_region(), and devm_ioremap_nocache()) This way the iomem resource would be added to the same devres list as the platform_unregister_call, and the iomem resource should be released after the platform_device_unregister as devres_release_all() releases the resources in reverse order. -Mathias
