From nobody Fri Jul 24 21:52:34 2026 Received: from mail-m49198.qiye.163.com (mail-m49198.qiye.163.com [45.254.49.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D68E3793A2; Fri, 24 Jul 2026 05:28:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870942; cv=none; b=BlNDvETP/y1HfV/3MO8z7THcEMkX/Rkq2IGOMa5w+nspemWt7qNeAkkR3rP6sl1snp9V9QhhrmsA/ZTHOGuCHllGoFf3uF/wcZLHYbc+5s1EyaqdZzzoLqdW6B896LjRV5Fz0AvZTS2q1drS71KJNJKuoI/mVcl/7wygPzjPbzA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870942; c=relaxed/simple; bh=b0duXdXgYd99c3OOklMLakLWBcCVIfMdCNoL9ZH3seo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=d5ACzV31yYhSlvQqZJn0SX5HcPbHLLvjUdmeIQ1myDtCOvrEu8OQZ5g/EBBIyzOAhahGu4vKixRMw2V9hqveW27NgHrxU7/YEsq81JCky2SbCi5dlEBUDZKEWarbnyUg88RbxvQTh58OcLXmzF+Q5djLx8FxPw4t0Dhzyny7Ax4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=Kbc6/yfa; arc=none smtp.client-ip=45.254.49.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="Kbc6/yfa" Received: from LAPTOP-99KJFSET (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 47691a1b4; Fri, 24 Jul 2026 13:28:47 +0800 (GMT+08:00) From: Hongyan Xu To: gregkh@linuxfoundation.org, sashal@kernel.org, arnd@arndb.de Cc: linusw@kernel.org, brgl@kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org, linux-gpio@vger.kernel.org, jianhao.xu@seu.edu.cn, getshell@seu.edu.cn Subject: [RFC PATCH 6.6.y 1/4] misc: ti-st: publish the transport only after probe succeeds Date: Fri, 24 Jul 2026 13:28:39 +0800 Message-ID: <20260724052842.1052-2-getshell@seu.edu.cn> X-Mailer: git-send-email 2.50.1.windows.1 In-Reply-To: <20260724052842.1052-1-getshell@seu.edu.cn> References: <20260724052842.1052-1-getshell@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0a9f9298fba403a1kunm7e8f9dea2445d X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkZQkpOVh5PSEJMQhhOGEJPS1YeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSUhOQ0 NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=Kbc6/yfabJyf/03rYPQYNY0UIWXW3QZatn1worIhdRoiW7yPRYdqfkehkSSAxL1C9g84ipJ1aiIuju1WBp/OW1LihqCyXOubPXycyecxq/Rn6VNDt+RW1GBDMsdPkWniCJPLdh6Lx5bHR/gQEVTjxTYpHmAbdpHCASvtyu9G3C8=; s=default; c=relaxed/relaxed; d=seu.edu.cn; v=1; bh=XcpAFmWCemUPFvXUcajXloVAt1chJRe4T7S+wG8nQ+I=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" kim_probe() stores the platform device in st_kim_devices[] before the transport core and the remaining resources are initialized. If a later probe step fails, st_kim_ref() can follow that published device to freed driver data. Publish the device only after probe has completed, and clear drvdata when rolling probe back. Fixes: 53618cc1e51e ("Staging: sources for ST core") Cc: stable@vger.kernel.org Signed-off-by: Hongyan Xu --- drivers/misc/ti-st/st_kim.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c index fe682e0..ec265a6 100644 --- a/drivers/misc/ti-st/st_kim.c +++ b/drivers/misc/ti-st/st_kim.c @@ -699,15 +699,7 @@ static int kim_probe(struct platform_device *pdev) { struct kim_data_s *kim_gdata; struct ti_st_plat_data *pdata =3D pdev->dev.platform_data; - int err; - - if ((pdev->id !=3D -1) && (pdev->id < MAX_ST_DEVICES)) { - /* multiple devices could exist */ - st_kim_devices[pdev->id] =3D pdev; - } else { - /* platform's sure about existence of 1 device */ - st_kim_devices[0] =3D pdev; - } + int err, id =3D 0; =20 kim_gdata =3D kzalloc(sizeof(struct kim_data_s), GFP_KERNEL); if (!kim_gdata) { @@ -762,12 +754,16 @@ static int kim_probe(struct platform_device *pdev) kim_gdata, &version_fops); debugfs_create_file("protocols", S_IRUGO, kim_debugfs_dir, kim_gdata, &list_fops); + if (pdev->id >=3D 0 && pdev->id < MAX_ST_DEVICES) + id =3D pdev->id; + st_kim_devices[id] =3D pdev; return 0; =20 err_sysfs_group: st_core_exit(kim_gdata->core_data); =20 err_core_init: + platform_set_drvdata(pdev, NULL); kfree(kim_gdata); =20 return err; --=20 2.50.1.windows.1 From nobody Fri Jul 24 21:52:34 2026 Received: from mail-m49197.qiye.163.com (mail-m49197.qiye.163.com [45.254.49.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 69DD5379EC1; Fri, 24 Jul 2026 05:28:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870939; cv=none; b=rI5Nkisp2Q3V9hLtYCyFLjFXAp3ojd91MwQ2IZOwkWTnzlN0gTLE4V2Q24UpxJI+WUfhMCnNIGcKmHLdU0sXSTUURfVRoh9uZOFOESEesf8WfT/G9Rpjn90BU5RF0wtjB0fVVCYnG/N5qzpK6y7JLGNWIu/KR3hbENxUDFQFTJw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870939; c=relaxed/simple; bh=KhlkVugzlpE2m2Z076VC1k1NZtnRSpmrA3zEGlb/8Us=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FEsNHn12FBDCXQwiuOat6aDEUxLhENPfkfTjkehvSG1wfwg3mkrjGjqDiV/6vE+f9yvj5PX8nbtdVZY1Qygx4w1Quznb7GwwbZQLiYWnTUOAC+oCSHUOQq2hKge903wYFpewlgAc5ny5nCjRM/rIPAf0/j22QtLSQ0nrOUkdkRI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=N9RYAFaj; arc=none smtp.client-ip=45.254.49.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="N9RYAFaj" Received: from LAPTOP-99KJFSET (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 47691a1b6; Fri, 24 Jul 2026 13:28:50 +0800 (GMT+08:00) From: Hongyan Xu To: gregkh@linuxfoundation.org, sashal@kernel.org, arnd@arndb.de Cc: linusw@kernel.org, brgl@kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org, linux-gpio@vger.kernel.org, jianhao.xu@seu.edu.cn, getshell@seu.edu.cn Subject: [RFC PATCH 6.6.y 2/4] misc: ti-st: account published transport users Date: Fri, 24 Jul 2026 13:28:40 +0800 Message-ID: <20260724052842.1052-3-getshell@seu.edu.cn> X-Mailer: git-send-email 2.50.1.windows.1 In-Reply-To: <20260724052842.1052-1-getshell@seu.edu.cn> References: <20260724052842.1052-1-getshell@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0a9f9299077803a1kunm7e8f9dea24465 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkZSRpLVh1MGExKQktOQhlPQ1YeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSUhOQ0 NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=N9RYAFajBgxwZb3bFT9wIVEjq1B40KqSvs176TDFeynDruYUCjZjb7MgWtt4qgxOJNBxSMR7E4b2eabEGxI2MtL1aCZ5sMDObCq0xS1oukIZdXm7+xTJXJ8T+UedHVE+VJAeSuSWJlLbswNjQzcIyZdEqDrjEHPEUsB7/v5sOkE=; s=default; c=relaxed/relaxed; d=seu.edu.cn; v=1; bh=0b5SmVX8NJaoxGM22f1jTM6RuLAr+x6459/O1As/FZA=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" The shared transport entry points obtain a raw core pointer through st_kim_ref(). Removal needs to stop new lookups and wait for existing users before freeing that core. Serialize publication and lookup, count successful lookups, and use a scope cleanup to release the count on every return path. This prepares the removal path to drain the users without a large error-path rewrite. Fixes: 53618cc1e51e ("Staging: sources for ST core") Cc: stable@vger.kernel.org Signed-off-by: Hongyan Xu --- drivers/misc/ti-st/st_core.c | 15 +++++++++++---- drivers/misc/ti-st/st_kim.c | 29 +++++++++++++++++++++++------ include/linux/ti_wilink_st.h | 8 ++++++++ 3 files changed, 42 insertions(+), 10 deletions(-) diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c index b878431..43d2587 100644 --- a/drivers/misc/ti-st/st_core.c +++ b/drivers/misc/ti-st/st_core.c @@ -7,6 +7,7 @@ */ =20 #define pr_fmt(fmt) "(stc): " fmt +#include #include #include #include @@ -24,6 +25,8 @@ */ static void (*st_recv)(void *disc_data, const u8 *ptr, size_t count); =20 +DEFINE_FREE(st_kim, struct st_data_s *, st_kim_put(_T)); + /********************************************************************/ static void add_channel_to_table(struct st_data_s *st_gdata, struct st_proto_s *new_proto) @@ -522,7 +525,7 @@ void kim_st_list_protocols(struct st_data_s *st_gdata, = void *buf) */ long st_register(struct st_proto_s *new_proto) { - struct st_data_s *st_gdata; + struct st_data_s *st_gdata __free(st_kim) =3D NULL; long err =3D 0; unsigned long flags =3D 0; =20 @@ -640,7 +643,7 @@ long st_unregister(struct st_proto_s *proto) { long err =3D 0; unsigned long flags =3D 0; - struct st_data_s *st_gdata; + struct st_data_s *st_gdata __free(st_kim) =3D NULL; =20 pr_debug("%s: %d ", __func__, proto->chnl_id); =20 @@ -688,7 +691,7 @@ long st_unregister(struct st_proto_s *proto) */ long st_write(struct sk_buff *skb) { - struct st_data_s *st_gdata; + struct st_data_s *st_gdata __free(st_kim) =3D NULL; long len; =20 st_kim_ref(&st_gdata, 0); @@ -719,10 +722,12 @@ EXPORT_SYMBOL_GPL(st_unregister); */ static int st_tty_open(struct tty_struct *tty) { - struct st_data_s *st_gdata; + struct st_data_s *st_gdata __free(st_kim) =3D NULL; pr_info("%s ", __func__); =20 st_kim_ref(&st_gdata, 0); + if (!st_gdata) + return -ENODEV; st_gdata->tty =3D tty; tty->disc_data =3D st_gdata; =20 @@ -878,6 +883,8 @@ int st_core_init(struct st_data_s **core_data) =20 /* Locking used in st_int_enqueue() to avoid multiple execution */ spin_lock_init(&st_gdata->lock); + atomic_set(&st_gdata->active_users, 0); + init_waitqueue_head(&st_gdata->users_wait); =20 err =3D st_ll_init(st_gdata); if (err) { diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c index ec265a6..11eadc1 100644 --- a/drivers/misc/ti-st/st_kim.c +++ b/drivers/misc/ti-st/st_kim.c @@ -23,9 +23,11 @@ #include #include #include +#include =20 #define MAX_ST_DEVICES 3 /* Imagine 1 on each UART for now */ static struct platform_device *st_kim_devices[MAX_ST_DEVICES]; +static DEFINE_MUTEX(st_kim_mutex); =20 /**********************************************************************/ /* internal functions */ @@ -671,18 +673,31 @@ void st_kim_ref(struct st_data_s **core_data, int id) { struct platform_device *pdev; struct kim_data_s *kim_gdata; + + *core_data =3D NULL; + mutex_lock(&st_kim_mutex); /* get kim_gdata reference from platform device */ pdev =3D st_get_plat_device(id); if (!pdev) - goto err; + goto out; kim_gdata =3D platform_get_drvdata(pdev); - if (!kim_gdata) - goto err; + if (!kim_gdata || !kim_gdata->core_data || + kim_gdata->core_data->removing) + goto out; =20 + atomic_inc(&kim_gdata->core_data->active_users); *core_data =3D kim_gdata->core_data; - return; -err: - *core_data =3D NULL; +out: + mutex_unlock(&st_kim_mutex); +} + +void st_kim_put(struct st_data_s *st_gdata) +{ + if (!st_gdata) + return; + + if (atomic_dec_and_test(&st_gdata->active_users)) + wake_up(&st_gdata->users_wait); } =20 DEFINE_SHOW_ATTRIBUTE(version); @@ -756,7 +771,9 @@ static int kim_probe(struct platform_device *pdev) kim_gdata, &list_fops); if (pdev->id >=3D 0 && pdev->id < MAX_ST_DEVICES) id =3D pdev->id; + mutex_lock(&st_kim_mutex); st_kim_devices[id] =3D pdev; + mutex_unlock(&st_kim_mutex); return 0; =20 err_sysfs_group: diff --git a/include/linux/ti_wilink_st.h b/include/linux/ti_wilink_st.h index 10642d4..f91300d 100644 --- a/include/linux/ti_wilink_st.h +++ b/include/linux/ti_wilink_st.h @@ -13,6 +13,7 @@ #define TI_WILINK_ST_H =20 #include +#include =20 /** * enum proto-type - The protocol on WiLink chips which share a @@ -125,6 +126,9 @@ extern long st_unregister(struct st_proto_s *); * @ll_state: the various PM states the chip can be, the states are notifi= ed * to us, when the chip sends relevant PM packets(SLEEP_IND, WAKE_IND). * @kim_data: reference to the parent encapsulating structure. + * @active_users: number of published core users being drained by removal. + * @users_wait: wait queue used by removal to drain published core users. + * @removing: set once the core is no longer available to new users. * */ struct st_data_s { @@ -144,6 +148,9 @@ struct st_data_s { unsigned char protos_registered; unsigned long ll_state; void *kim_data; + atomic_t active_users; + wait_queue_head_t users_wait; + bool removing; struct tty_struct *tty; struct work_struct work_write_wakeup; }; @@ -179,6 +186,7 @@ void st_core_exit(struct st_data_s *); =20 /* ask for reference from KIM */ void st_kim_ref(struct st_data_s **, int); +void st_kim_put(struct st_data_s *st_gdata); =20 #define GPS_STUB_TEST #ifdef GPS_STUB_TEST --=20 2.50.1.windows.1 From nobody Fri Jul 24 21:52:34 2026 Received: from mail-m49197.qiye.163.com (mail-m49197.qiye.163.com [45.254.49.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF4173793AC; Fri, 24 Jul 2026 05:28:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870942; cv=none; b=CzD1d0RMSlx2SpeVRFcsZzYet/LhUPZoLGqfeBGr0L1muqjYpBuSfgExD+FA7tSx5aAAix6iQIGOfjyogzzdWza+Me7R+uoQR69+6lbGAL/Z+lEdOfBDmW62fRyeVujSP279vSHju7HZJiJzoOeryvXMFwIus5B9MnDJn1u/dL4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870942; c=relaxed/simple; bh=5F56TsAfK9IjGi9mmeCF0ZROJhca+Ukll/P8IGDtXgI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DU0e0PLd4ncl7ZQtg9G6Opd09aWwMlIMTAAaF1+Uj/rgkwjXsOKB3fo8KBibst89fUleGa+Zxqffvd/KXYj36QHt8eY0aZWSv8gI7Z0EPp3yXMMk1H6O53n+ycnEAe9gkVPsgDXsvERd0lzI8ZD2c3XNYTgSKbmNdDitkuxn24o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=CMEI6Eqf; arc=none smtp.client-ip=45.254.49.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="CMEI6Eqf" Received: from LAPTOP-99KJFSET (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 47691a1b8; Fri, 24 Jul 2026 13:28:53 +0800 (GMT+08:00) From: Hongyan Xu To: gregkh@linuxfoundation.org, sashal@kernel.org, arnd@arndb.de Cc: linusw@kernel.org, brgl@kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org, linux-gpio@vger.kernel.org, jianhao.xu@seu.edu.cn, getshell@seu.edu.cn Subject: [RFC PATCH 6.6.y 3/4] misc: ti-st: drain published users before transport removal Date: Fri, 24 Jul 2026 13:28:41 +0800 Message-ID: <20260724052842.1052-4-getshell@seu.edu.cn> X-Mailer: git-send-email 2.50.1.windows.1 In-Reply-To: <20260724052842.1052-1-getshell@seu.edu.cn> References: <20260724052842.1052-1-getshell@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0a9f9299147803a1kunm7e8f9dea24470 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVkaTBpPVk9ISBlMTx5OTBpMGFYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSUhOQ0 NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=CMEI6EqfRkbPAyZ4/NWzA69ns+NcAMh2q4jCVxIwO2UowSu6NoxGGwMfZLF+oyKUzulzc8cYneHyxszwuAosHRG3uulDDplJ9z26CVi1sO3XenKKrLxq0bcrihawCOqB+nlZOMFhftlhwfeNGTMqlMFNIM1nJDXIPEC9tqlwuao=; s=default; c=relaxed/relaxed; d=seu.edu.cn; v=1; bh=L+6y4ptf2rF2GMgt6YAjXEKmOTtNZ8dQMZKG+Yhgwa4=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" kim_remove() leaves the transport published while it tears down GPIO, sysfs state and the core. A protocol registration or write can therefore retain the core pointer across kfree(). Under the publication mutex, mark the core as removing and clear its global slot. Unregister the line discipline and wait for all previously accounted users before releasing the core and its parent data. Keep the GPIO and platform data valid until those users have drained. Fixes: 53618cc1e51e ("Staging: sources for ST core") Cc: stable@vger.kernel.org Signed-off-by: Hongyan Xu --- drivers/misc/ti-st/st_core.c | 25 ++++++++++++++----------- drivers/misc/ti-st/st_kim.c | 22 ++++++++++++---------- 2 files changed, 26 insertions(+), 21 deletions(-) diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c index 43d2587..3aed6c3 100644 --- a/drivers/misc/ti-st/st_core.c +++ b/drivers/misc/ti-st/st_core.c @@ -906,20 +906,23 @@ err_unreg_ldisc: void st_core_exit(struct st_data_s *st_gdata) { long err; + + if (!st_gdata) + return; + + tty_unregister_ldisc(&st_ldisc_ops); + wait_event(st_gdata->users_wait, + !atomic_read(&st_gdata->active_users)); + /* internal module cleanup */ err =3D st_ll_deinit(st_gdata); if (err) pr_err("error during deinit of ST LL %ld", err); =20 - if (st_gdata !=3D NULL) { - /* Free ST Tx Qs and skbs */ - skb_queue_purge(&st_gdata->txq); - skb_queue_purge(&st_gdata->tx_waitq); - kfree_skb(st_gdata->rx_skb); - kfree_skb(st_gdata->tx_skb); - /* TTY ldisc cleanup */ - tty_unregister_ldisc(&st_ldisc_ops); - /* free the global data pointer */ - kfree(st_gdata); - } + /* Free ST Tx Qs and skbs */ + skb_queue_purge(&st_gdata->txq); + skb_queue_purge(&st_gdata->tx_waitq); + kfree_skb(st_gdata->rx_skb); + kfree_skb(st_gdata->tx_skb); + kfree(st_gdata); } diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c index 11eadc1..ab84fe6 100644 --- a/drivers/misc/ti-st/st_kim.c +++ b/drivers/misc/ti-st/st_kim.c @@ -788,28 +788,30 @@ err_core_init: =20 static int kim_remove(struct platform_device *pdev) { - /* free the GPIOs requested */ struct ti_st_plat_data *pdata =3D pdev->dev.platform_data; struct kim_data_s *kim_gdata; + int id =3D 0; =20 kim_gdata =3D platform_get_drvdata(pdev); - - /* - * Free the Bluetooth/FM/GPIO - * nShutdown gpio from the system - */ - gpio_free(pdata->nshutdown_gpio); - pr_info("nshutdown GPIO Freed"); + if (pdev->id >=3D 0 && pdev->id < MAX_ST_DEVICES) + id =3D pdev->id; + mutex_lock(&st_kim_mutex); + kim_gdata->core_data->removing =3D true; + st_kim_devices[id] =3D NULL; + mutex_unlock(&st_kim_mutex); =20 debugfs_remove_recursive(kim_debugfs_dir); sysfs_remove_group(&pdev->dev.kobj, &uim_attr_grp); pr_info("sysfs entries removed"); =20 - kim_gdata->kim_pdev =3D NULL; st_core_exit(kim_gdata->core_data); + kim_gdata->core_data =3D NULL; + kim_gdata->kim_pdev =3D NULL; + gpio_free(pdata->nshutdown_gpio); + pr_info("nshutdown GPIO Freed"); =20 + platform_set_drvdata(pdev, NULL); kfree(kim_gdata); - kim_gdata =3D NULL; return 0; } =20 --=20 2.50.1.windows.1 From nobody Fri Jul 24 21:52:34 2026 Received: from mail-m49197.qiye.163.com (mail-m49197.qiye.163.com [45.254.49.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13E7837AA91; Fri, 24 Jul 2026 05:29:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.254.49.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870945; cv=none; b=Ix1413M/CrhpNfEPj+MXuXN6AbluT8+wOqw6EMvhNFCxSr/82IlTcBOPMq6MK6eow2a+qZfOMuK/6W8meseyd3gyhe8XkQ8VqkzWPi5E3Gq7jf6g/D85QjD3IgF6xb5+KuDjvgLlbeM1+FsqcmO55tpB2R812nC6mPjXnnnUkHM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784870945; c=relaxed/simple; bh=yWgAvsNfonKTzfPkF9NE3ARZQUZfJDMAM38Ys+Q7+OM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=av9Fg2MwOnKSrixy9ghsT8yev9KbJQzLPsP88A0QN8XWjHMK4EU7huvccty1qmlt3lDRh42DH6DFx5mVtRN455I+uo6fQm/vrimguge+I5NOxectzfZ2DF8N/hBicgaRNsnfWU/vEL39aHOvcUZItNBVCDeCsFlgb2O4QmE8XAY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn; spf=pass smtp.mailfrom=seu.edu.cn; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b=BbvA2g9H; arc=none smtp.client-ip=45.254.49.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=seu.edu.cn Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=seu.edu.cn header.i=@seu.edu.cn header.b="BbvA2g9H" Received: from LAPTOP-99KJFSET (unknown [58.241.16.34]) by smtp.qiye.163.com (Hmail) with ESMTP id 47691a1ba; Fri, 24 Jul 2026 13:28:57 +0800 (GMT+08:00) From: Hongyan Xu To: gregkh@linuxfoundation.org, sashal@kernel.org, arnd@arndb.de Cc: linusw@kernel.org, brgl@kernel.org, stable@vger.kernel.org, linux-kernel@vger.kernel.org, linux-gpio@vger.kernel.org, jianhao.xu@seu.edu.cn, getshell@seu.edu.cn Subject: [RFC PATCH 6.6.y 4/4] misc: ti-st: synchronize TTY teardown with transport removal Date: Fri, 24 Jul 2026 13:28:42 +0800 Message-ID: <20260724052842.1052-5-getshell@seu.edu.cn> X-Mailer: git-send-email 2.50.1.windows.1 In-Reply-To: <20260724052842.1052-1-getshell@seu.edu.cn> References: <20260724052842.1052-1-getshell@seu.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-HM-Tid: 0a9f9299221003a1kunm7e8f9dea24473 X-HM-MType: 10 X-HM-Spam-Status: e1kfGhgUHx5ZQUpXWQgPGg8OCBgUHx5ZQUlOS1dZFg8aDwILHllBWSg2Ly tZV1koWUFITzdXWRgWCB1ZQUpXWS1ZQUlXWQ8JGhUIEh9ZQVlDS05JVkJPTB8dGB1LTUJOSFYeHw 5VEwETFhoSFyQUDg9ZV1kYEgtZQVlOQ1VJT0pVSk1VSE9ZV1kWGg8SFR0UWUFZT0tIVUpLSUhOQ0 NVSktLVUtZBg++ DKIM-Signature: a=rsa-sha256; b=BbvA2g9HBERQfRYGmFLzd191JpR5LbAqX9MHF3QYqBLr0zr0J8EjZ95m3PGNIgIHAlAKQIbCBsA0gtvwHktgP6/9+VOED0NuGvRgop0lE8tuBZHIqDjrTtn58U++xB/hdlZin+aTPv9lL7V1Krh4POO1FTDu6Spt3hQ7Xejqte4=; s=default; c=relaxed/relaxed; d=seu.edu.cn; v=1; bh=ltIi9JVhQVE+wcK24T3nnvz4EpLs16l0x4XUOVFM3FI=; h=date:mime-version:subject:message-id:from; Content-Type: text/plain; charset="utf-8" Unregistering the line discipline does not close an instance which is already attached to a TTY. Its callbacks and work_write_wakeup can keep using the transport after st_core_exit() frees it. Protect the attached TTY pointer with the core lock. On removal, take a TTY reference and synchronously hang it up, then cancel the wakeup work before releasing the core. Also cancel the work in normal close and clear disc_data only after the close cleanup is complete. Fixes: 53618cc1e51e ("Staging: sources for ST core") Cc: stable@vger.kernel.org Signed-off-by: Hongyan Xu --- drivers/misc/ti-st/st_core.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c index 3aed6c3..7610656 100644 --- a/drivers/misc/ti-st/st_core.c +++ b/drivers/misc/ti-st/st_core.c @@ -723,13 +723,18 @@ EXPORT_SYMBOL_GPL(st_unregister); static int st_tty_open(struct tty_struct *tty) { struct st_data_s *st_gdata __free(st_kim) =3D NULL; + unsigned long flags; + pr_info("%s ", __func__); =20 st_kim_ref(&st_gdata, 0); if (!st_gdata) return -ENODEV; + + spin_lock_irqsave(&st_gdata->lock, flags); st_gdata->tty =3D tty; tty->disc_data =3D st_gdata; + spin_unlock_irqrestore(&st_gdata->lock, flags); =20 /* don't do an wakeup for now */ clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); @@ -757,6 +762,7 @@ static void st_tty_close(struct tty_struct *tty) struct st_data_s *st_gdata =3D tty->disc_data; =20 pr_info("%s ", __func__); + cancel_work_sync(&st_gdata->work_write_wakeup); =20 /* * TODO: @@ -777,7 +783,6 @@ static void st_tty_close(struct tty_struct *tty) * N_TI_WL ldisc is un-installed */ st_kim_complete(st_gdata->kim_data); - st_gdata->tty =3D NULL; /* Flush any pending characters in the driver and discipline. */ tty_ldisc_flush(tty); tty_driver_flush_buffer(tty); @@ -791,6 +796,8 @@ static void st_tty_close(struct tty_struct *tty) st_gdata->rx_state =3D ST_W4_PACKET_TYPE; kfree_skb(st_gdata->rx_skb); st_gdata->rx_skb =3D NULL; + st_gdata->tty =3D NULL; + tty->disc_data =3D NULL; spin_unlock_irqrestore(&st_gdata->lock, flags); =20 pr_debug("%s: done ", __func__); @@ -905,6 +912,8 @@ err_unreg_ldisc: =20 void st_core_exit(struct st_data_s *st_gdata) { + struct tty_struct *tty; + unsigned long flags; long err; =20 if (!st_gdata) @@ -914,6 +923,14 @@ void st_core_exit(struct st_data_s *st_gdata) wait_event(st_gdata->users_wait, !atomic_read(&st_gdata->active_users)); =20 + spin_lock_irqsave(&st_gdata->lock, flags); + tty =3D tty_kref_get(st_gdata->tty); + spin_unlock_irqrestore(&st_gdata->lock, flags); + if (tty) + tty_vhangup(tty); + cancel_work_sync(&st_gdata->work_write_wakeup); + tty_kref_put(tty); + /* internal module cleanup */ err =3D st_ll_deinit(st_gdata); if (err) --=20 2.50.1.windows.1