USB: MUSB: fix kernel WARNING/oops when unloading module in OTG mode

Since commit c14f2f1a91b1615b09d77a59b2f4d8dd318719c5 (musb_core: don't call
musb_platform_exit() twice), unloading the driver module results in a WARNING
"kobject: '(null)' (c73de788): is not initialized, yet kobject_put() is being
called." (or even kernel oops) on e.g. DaVincis, though only in the OTG mode.
There exists dubious and unbalanced put_device() call in musb_free() which
takes place only in the OTG mode.  As this commit caused musb_platform_exit()
to be called (and so unregister the NOP transceiver) before this put_device()
call, this function references already freed memory.

On the other hand, all the glue layers miss the otg_put_transceiver() call,
complementary to the otg_get_transceiver() call that they do.  So, I think
the solution is to get rid of the strange put_device() call, and instead
call otg_put_transceiver() in the glue layers...

Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index b611420a8050a7d4f88e49bf4b99770ba72f6043..9733fe9b597ae8a8ba1302f11ab39c1fe62f9d5a 100644 (file)
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -397,5 +397,6 @@ int musb_platform_exit(struct musb *musb)
 
        gpio_free(musb->config->gpio_vrsel);
 
+       otg_put_transceiver(musb->xceiv);
        return 0;
 }

diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 57624361c1dea09e711740985cb79366349cb8b5..6e67629f50cc1874949f269cc5ca53719a9c3df2 100644 (file)
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -446,6 +446,7 @@ int __init musb_platform_init(struct musb *musb, void *board_data)
 fail:
        clk_disable(musb->clock);
 
+       otg_put_transceiver(musb->xceiv);
        usb_nop_xceiv_unregister();
        return -ENODEV;
 }
@@ -496,6 +497,7 @@ int musb_platform_exit(struct musb *musb)
 
        clk_disable(musb->clock);
 
+       otg_put_transceiver(musb->xceiv);
        usb_nop_xceiv_unregister();
 
        return 0;

diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 472b2a7e78960f6be2d7e1e9dae047503ceb35c2..7e2c353755d2ce316962e03f45160e3792fa4a70 100644 (file)
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1926,10 +1926,6 @@ static void musb_free(struct musb *musb)
                dma_controller_destroy(c);
        }
 
-#ifdef CONFIG_USB_MUSB_OTG
-       put_device(musb->xceiv->dev);
-#endif
-
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
        usb_put_hcd(musb_to_hcd(musb));
 #else

diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 2111a241dd037d0b1c6bbb654068a12851dd875a..ed618bde1eecfefec05bae9e7195b14b72b5fdab 100644 (file)
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -320,5 +320,6 @@ int musb_platform_exit(struct musb *musb)
 
        musb_platform_suspend(musb);
 
+       otg_put_transceiver(musb->xceiv);
        return 0;
 }

diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index 3c48e77a0aa2c6c73ec52fcb9832689bf557e5a0..bde40efc7046f1f415dab31001f80d92a40afb59 100644 (file)
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -1152,6 +1152,8 @@ done:
        if (ret < 0) {
                if (sync)
                        iounmap(sync);
+
+               otg_put_transceiver(musb->xceiv);
                usb_nop_xceiv_unregister();
        }
        return ret;
@@ -1166,6 +1168,8 @@ int musb_platform_exit(struct musb *musb)
                musb->board_set_power(0);
 
        iounmap(musb->sync_va);
+
+       otg_put_transceiver(musb->xceiv);
        usb_nop_xceiv_unregister();
        return 0;
 }