EHCI: HSIC: Fix a race between root hub resume and controller removal
The pm_qos request is removed before unregistering the HCD in remove
function. If root hub resume runs in parallel, there is a possibility
of adding the pm_qos request back to the active list. The pm_qos request
memory is freed after unregistering the HCD and this would lead to
pm_qos list corruption. A crash is observed when another driver is
submitting a pm_qos request after HSIC controller is removed during
shutdown. Remove HCD prior to releasing controller resources.
CRs-Fixed: 444928
Change-Id: Iaed6964e7d4245b8ae6c295ed6c76f5a9d32e20f
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
diff --git a/drivers/usb/host/ehci-msm-hsic.c b/drivers/usb/host/ehci-msm-hsic.c
index 0512381..c9b91da 100644
--- a/drivers/usb/host/ehci-msm-hsic.c
+++ b/drivers/usb/host/ehci-msm-hsic.c
@@ -1811,6 +1811,9 @@
struct msm_hsic_hcd *mehci = hcd_to_hsic(hcd);
struct msm_hsic_host_platform_data *pdata = mehci->dev->platform_data;
+ /* Remove the HCD prior to releasing our resources. */
+ usb_remove_hcd(hcd);
+
if (pdata && pdata->swfi_latency)
pm_qos_remove_request(&mehci->pm_qos_req_dma);
@@ -1840,7 +1843,6 @@
destroy_workqueue(ehci_wq);
- usb_remove_hcd(hcd);
msm_hsic_config_gpios(mehci, 0);
msm_hsic_init_vddcx(mehci, 0);