ENGR00308631 usb: chipidea: fix oops if unload module too fast

We have a 2s timer once the wakeup occurs, if we unload module within
2s before wakeup occurs, the timer is still active, so we need
to delete the timer before the destroy of struct ci_hdrc, otherwise,
the below oops will occur.

ci_hdrc ci_hdrc.1: remove, state 1
usb usb1: USB disconnect, device number 1
usb 1-1: USB disconnect, device number 2
ci_hdrc ci_hdrc.1: USB bus 1 deregistered
ci_hdrc ci_hdrc.1: ci_otg_thread quits
Unable to handle kernel NULL pointer dereference at virtual address 00000000
pgd = a9474000
[00000000] *pgd=a84b1831, *pte=00000000, *ppte=00000000
Internal error: Oops: 80000007 [#1] PREEMPT SMP ARM
Modules linked in: ci_hdrc_imx(-) usbmisc_imx ci_hdrc ehci_hcd udc_core phy_mxs_usb evbug [last unloaded: configfs]
CPU: 0 PID: 11542 Comm: modprobe Not tainted 3.10.17-01265-ga8a6771-dirty #561
task: a81243c0 ti: a94b4000 task.ti: a94b4000
PC is at 0x0
LR is at call_timer_fn.isra.29+0x24/0x84
pc : [<00000000>]    lr : [<8003189c>]    psr: 200b0113
sp : a94b5d68  ip : 00000000  fp : 00000000
r10: a94b5d88  r9 : 00000000  r8 : 00200200
r7 : 00000000  r6 : 80c320c0  r5 : 00000100  r4 : a94b4000
r3 : a94b5d68  r2 : a94b5d80  r1 : 00000000  r0 : 00000000
Flags: nzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
Control: 10c53c7d  Table: a947404a  DAC: 00000015
Process modprobe (pid: 11542, stack limit = 0xa94b4238)
Stack: (0xa94b5d68 to 0xa94b6000)
5d60:                   000797ae 00015220 80c2c620 80cc1ac0 00000000 80c320c0
5d80: 80cc22d4 80031ab4 a94b5d88 a94b5d88 00000000 00000101 80c32084 a94b4000
5da0: 00000100 80cc1880 00000000 80c32080 00000001 8002c4b4 000000c3 a8009240
5dc0: 00000004 0000000a 000797af 00404100 018c8300 600b0193 00000057 00000000
5de0: c0802100 8000e2c4 a94b4000 00000000 018c8300 8002c624 a94b4000 8002c898
5e00: 80c2cef0 8000ea04 c080210c 80c38904 a94b5e30 80008538 80115b7c 80115b8c
5e20: a00b0013 ffffffff a94b5e64 8000dd40 80c45808 00000000 00000001 00000000
5e40: a83f8900 00000000 a94b5e98 00000081 8000e2c4 a94b4000 00000000 018c8300
5e60: 00000001 a94b5e78 80115b7c 80115b8c a00b0013 ffffffff 00000000 00000000
5e80: a83f83c0 a83f83c0 a83f83c0 80b349b4 00000000 801140fc a83f83c0 a83f8900
5ea0: 80c56ae8 a83f83c0 a80c4610 80117454 00000000 80c56aa0 a88bc018 8030b9ac
5ec0: ffffffff a88bc010 a80c4610 8030437c a88bc000 a80c4600 a80c4610 80308510
5ee0: 7f7d21c0 a88bc000 a80c4600 803088b4 00000000 7f7c0500 a83c4c10 7f7d21e0
5f00: a80c4610 7f7d3250 a80c4644 8030827c 80308264 80306b70 7f7d3250 a80c4610
5f20: 7f7d3250 80307360 7f7d3290 7f7d3250 80c56710 803069a0 7f7d3290 00000000
5f40: a94b4000 800679d0 00000020 685f6963 5f637264 00786d69 a81243c0 800495b4
5f60: 80c2ceac 00000000 018c8300 80049578 018c8300 8003f614 8000e2c4 000f000f
5f80: a89b7840 004b4000 7f7d3290 00000800 a94b5f94 00000000 018c8300 018c8334
5fa0: 018c8334 8000e140 018c8300 018c8334 018c8334 00000800 7ee8aa50 0002e6b0
5fc0: 018c8300 018c8334 018c8334 00000081 00000001 7ee8be0c 7ee8be04 018c8300
5fe0: 76ebcf40 7ee8aa2c 00019268 76ebcf4c 60070010 018c8334 abf58811 abf58c11
[<8003189c>] (call_timer_fn.isra.29+0x24/0x84) from [<80031ab4>] (run_timer_softirq+0x1b8/0x1cc)
[<80031ab4>] (run_timer_softirq+0x1b8/0x1cc) from [<8002c4b4>] (__do_softirq+0xd8/0x1b8)
[<8002c4b4>] (__do_softirq+0xd8/0x1b8) from [<8002c624>] (do_softirq+0x4c/0x58)
[<8002c624>] (do_softirq+0x4c/0x58) from [<8002c898>] (irq_exit+0x90/0xc8)
[<8002c898>] (irq_exit+0x90/0xc8) from [<8000ea04>] (handle_IRQ+0x3c/0x90)
[<8000ea04>] (handle_IRQ+0x3c/0x90) from [<80008538>] (gic_handle_irq+0x28/0x5c)
[<80008538>] (gic_handle_irq+0x28/0x5c) from [<8000dd40>] (__irq_svc+0x40/0x70)
Exception stack(0xa94b5e30 to 0xa94b5e78)
5e20:                                     80c45808 00000000 00000001 00000000
5e40: a83f8900 00000000 a94b5e98 00000081 8000e2c4 a94b4000 00000000 018c8300
5e60: 00000001 a94b5e78 80115b7c 80115b8c a00b0013 ffffffff
[<8000dd40>] (__irq_svc+0x40/0x70) from [<80115b8c>] (sysfs_addrm_finish+0x24/0xd4)
[<80115b8c>] (sysfs_addrm_finish+0x24/0xd4) from [<801140fc>] (sysfs_hash_and_remove+0x4c/0x88)
[<801140fc>] (sysfs_hash_and_remove+0x4c/0x88) from [<80117454>] (sysfs_unmerge_group+0x40/0x7c)
[<80117454>] (sysfs_unmerge_group+0x40/0x7c) from [<8030b9ac>] (dpm_sysfs_remove+0x20/0x3c)
[<8030b9ac>] (dpm_sysfs_remove+0x20/0x3c) from [<8030437c>] (device_del+0x34/0x178)
[<8030437c>] (device_del+0x34/0x178) from [<80308510>] (platform_device_del+0x14/0xa8)
[<80308510>] (platform_device_del+0x14/0xa8) from [<803088b4>] (platform_device_unregister+0xc/0x18)
[<803088b4>] (platform_device_unregister+0xc/0x18) from [<7f7c0500>] (ci_hdrc_remove_device+0xc/0x20 [ci_hdrc])
[<7f7c0500>] (ci_hdrc_remove_device+0xc/0x20 [ci_hdrc]) from [<7f7d21e0>] (ci_hdrc_imx_remove+0x20/0xc8 [ci_hdrc_imx])
[<7f7d21e0>] (ci_hdrc_imx_remove+0x20/0xc8 [ci_hdrc_imx]) from [<8030827c>] (platform_drv_remove+0x18/0x1c)
[<8030827c>] (platform_drv_remove+0x18/0x1c) from [<80306b70>] (__device_release_driver+0x70/0xcc)
[<80306b70>] (__device_release_driver+0x70/0xcc) from [<80307360>] (driver_detach+0xac/0xb0)
[<80307360>] (driver_detach+0xac/0xb0) from [<803069a0>] (bus_remove_driver+0x7c/0xc0)
[<803069a0>] (bus_remove_driver+0x7c/0xc0) from [<800679d0>] (SyS_delete_module+0x144/0x1f8)
[<800679d0>] (SyS_delete_module+0x144/0x1f8) from [<8000e140>] (ret_fast_syscall+0x0/0x30)
Code: bad PC value

Signed-off-by: Peter Chen <peter.chen@freescale.com>

1 files changed, 1 insertions, 0 deletions

diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index d2e98edc5b17..9d8f3fdb54fc 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -791,6 +791,7 @@ static int ci_hdrc_remove(struct platform_device *pdev)
 		pm_runtime_disable(&pdev->dev);
 		pm_runtime_put_noidle(&pdev->dev);
 	}
+	del_timer_sync(&ci->timer);
 	dbg_remove_files(ci);
 	free_irq(ci->irq, ci);
 	ci_role_destroy(ci);