Patch "phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered" has been added to the 6.8-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     phy-ti-tusb1210-resolve-charger-det-crash-if-charger.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit e901d0f096ed001e63f2d6e4a06cb399557e0514
Author: Hans de Goede <hdegoede@xxxxxxxxxx>
Date:   Sat Apr 6 16:08:21 2024 +0200

    phy: ti: tusb1210: Resolve charger-det crash if charger psy is unregistered
    
    [ Upstream commit bf6e4ee5c43690e4c5a8a057bbcd4ff986bed052 ]
    
    The power_supply frame-work is not really designed for there to be
    long living in kernel references to power_supply devices.
    
    Specifically unregistering a power_supply while some other code has
    a reference to it triggers a WARN in power_supply_unregister():
    
            WARN_ON(atomic_dec_return(&psy->use_cnt));
    
    Folllowed by the power_supply still getting removed and the
    backing data freed anyway, leaving the tusb1210 charger-detect code
    with a dangling reference, resulting in a crash the next time
    tusb1210_get_online() is called.
    
    Fix this by only holding the reference in tusb1210_get_online()
    freeing it at the end of the function. Note this still leaves
    a theoretical race window, but it avoids the issue when manually
    rmmod-ing the charger chip driver during development.
    
    Fixes: 48969a5623ed ("phy: ti: tusb1210: Add charger detection")
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240406140821.18624-1-hdegoede@xxxxxxxxxx
    Signed-off-by: Vinod Koul <vkoul@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/phy/ti/phy-tusb1210.c b/drivers/phy/ti/phy-tusb1210.c
index b4881cb344759..c23eecc7d1800 100644
--- a/drivers/phy/ti/phy-tusb1210.c
+++ b/drivers/phy/ti/phy-tusb1210.c
@@ -65,7 +65,6 @@ struct tusb1210 {
 	struct delayed_work chg_det_work;
 	struct notifier_block psy_nb;
 	struct power_supply *psy;
-	struct power_supply *charger;
 #endif
 };
 
@@ -231,19 +230,24 @@ static const char * const tusb1210_chargers[] = {
 
 static bool tusb1210_get_online(struct tusb1210 *tusb)
 {
+	struct power_supply *charger = NULL;
 	union power_supply_propval val;
-	int i;
+	bool online = false;
+	int i, ret;
 
-	for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !tusb->charger; i++)
-		tusb->charger = power_supply_get_by_name(tusb1210_chargers[i]);
+	for (i = 0; i < ARRAY_SIZE(tusb1210_chargers) && !charger; i++)
+		charger = power_supply_get_by_name(tusb1210_chargers[i]);
 
-	if (!tusb->charger)
+	if (!charger)
 		return false;
 
-	if (power_supply_get_property(tusb->charger, POWER_SUPPLY_PROP_ONLINE, &val))
-		return false;
+	ret = power_supply_get_property(charger, POWER_SUPPLY_PROP_ONLINE, &val);
+	if (ret == 0)
+		online = val.intval;
+
+	power_supply_put(charger);
 
-	return val.intval;
+	return online;
 }
 
 static void tusb1210_chg_det_work(struct work_struct *work)
@@ -467,9 +471,6 @@ static void tusb1210_remove_charger_detect(struct tusb1210 *tusb)
 		cancel_delayed_work_sync(&tusb->chg_det_work);
 		power_supply_unregister(tusb->psy);
 	}
-
-	if (tusb->charger)
-		power_supply_put(tusb->charger);
 }
 #else
 static void tusb1210_probe_charger_detect(struct tusb1210 *tusb) { }