[PATCH] pwm: gpio: unregister the chip on driver unbind

[PATCH] pwm: gpio: unregister the chip on driver unbind

[Yu Zhang]

pwm_gpio_probe() registers the chip with pwmchip_add(), but the driver
has neither a remove callback nor a devm action calling
pwmchip_remove(). On unbind the devres callbacks release the GPIO
descriptor, cancel the hrtimer and drop the reference taken by
devm_pwmchip_alloc(), while the chip stays registered: it is still in
the pwm_chips idr, its sysfs attributes and character device are still
there and chip->operational is still true.

The chip can therefore still be reached through sysfs export, the
character device, debugfs and pwm_get() from a consumer. Those paths
call into chip->ops, which point into unloaded module text once the
module is gone, and pwm_gpio_apply() re-arms the cancelled hrtimer and
drives a GPIO descriptor the driver no longer owns.

Use devm_pwmchip_add() so that the chip is removed before the hrtimer
is cancelled and the GPIO is released.

Fixes: 7f61257cd6e1 ("pwm: Add GPIO PWM driver")
Cc: stable@vger.kernel.org
Signed-off-by: Yu Zhang <yuz08559@gmail.com>
---
 drivers/pwm/pwm-gpio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/pwm/pwm-gpio.c b/drivers/pwm/pwm-gpio.c
index 5644d78..cffdbcd 100644
--- a/drivers/pwm/pwm-gpio.c
+++ b/drivers/pwm/pwm-gpio.c
@@ -212,7 +212,7 @@ static int pwm_gpio_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
-	ret = pwmchip_add(chip);
+	ret = devm_pwmchip_add(dev, chip);
 	if (ret < 0)
 		return dev_err_probe(dev, ret, "could not add pwmchip\n");
 
-- 
2.43.0

Re: [PATCH] pwm: gpio: unregister the chip on driver unbind

[Stefan Wahren]

Am 01.11.26 um 04:26 schrieb Yu Zhang:
> pwm_gpio_probe() registers the chip with pwmchip_add(), but the driver
> has neither a remove callback nor a devm action calling
> pwmchip_remove(). On unbind the devres callbacks release the GPIO
> descriptor, cancel the hrtimer and drop the reference taken by
> devm_pwmchip_alloc(), while the chip stays registered: it is still in
> the pwm_chips idr, its sysfs attributes and character device are still
> there and chip->operational is still true.
>
> The chip can therefore still be reached through sysfs export, the
> character device, debugfs and pwm_get() from a consumer. Those paths
> call into chip->ops, which point into unloaded module text once the
> module is gone, and pwm_gpio_apply() re-arms the cancelled hrtimer and
> drives a GPIO descriptor the driver no longer owns.
>
> Use devm_pwmchip_add() so that the chip is removed before the hrtimer
> is cancelled and the GPIO is released.
>
> Fixes: 7f61257cd6e1 ("pwm: Add GPIO PWM driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yu Zhang <yuz08559@gmail.com>
Reviewed-by: Stefan Wahren <wahrenst@gmx.net>