[PATCH] usb: gadget: composite: unlock spinlock before usb_gadget_disconnect()

[PATCH] usb: gadget: composite: unlock spinlock before usb_gadget_disconnect()

[Robert Baldyga]

usb_gadget_disconnect() shouldn't be called under spinlock to avoid
spinlock recursion. Function usb_gadget_disconnect() calls pullup(),
which is callback from UDC driver, usually calling composite_disconnect().
This function wants to lock spinlock used in usb_function_deactivate()
causing spinlock recursion.

Signed-off-by: Robert Baldyga <r.baldyga@samsung.com>
---
 drivers/usb/gadget/composite.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index d41103e..77cae4b 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -260,8 +260,11 @@ int usb_function_deactivate(struct usb_function *function)
 
 	spin_lock_irqsave(&cdev->lock, flags);
 
-	if (cdev->deactivations == 0)
+	if (cdev->deactivations == 0) {
+		spin_unlock_irqrestore(&cdev->lock, flags);
 		status = usb_gadget_disconnect(cdev->gadget);
+		spin_lock_irqsave(&cdev->lock, flags);
+	}
 	if (status == 0)
 		cdev->deactivations++;
 
-- 
1.9.1

RE: [PATCH] usb: gadget: composite: unlock spinlock before usb_gadget_disconnect()

[David Laight]

From: Robert Baldyga
> usb_gadget_disconnect() shouldn't be called under spinlock to avoid
> spinlock recursion. Function usb_gadget_disconnect() calls pullup(),
> which is callback from UDC driver, usually calling composite_disconnect().
> This function wants to lock spinlock used in usb_function_deactivate()
> causing spinlock recursion.
...
> +++ b/drivers/usb/gadget/composite.c
> @@ -260,8 +260,11 @@ int usb_function_deactivate(struct usb_function *function)
> 
>  	spin_lock_irqsave(&cdev->lock, flags);
> 
> -	if (cdev->deactivations == 0)
> +	if (cdev->deactivations == 0) {
> +		spin_unlock_irqrestore(&cdev->lock, flags);
>  		status = usb_gadget_disconnect(cdev->gadget);
> +		spin_lock_irqsave(&cdev->lock, flags);
> +	}
>  	if (status == 0)
>  		cdev->deactivations++;

That sort of change rings big alarm bells.
You've effectively isolated the usb_gadget_disconnect() call
from the check that cdev->deactivations == 0.
And then you increment cdev->deactivations below.

Looks like it will be racy to me.

	David

Re: [PATCH] usb: gadget: composite: unlock spinlock before usb_gadget_disconnect()

[Felipe Balbi]

[-- Attachment #1: Type: text/plain, Size: 1246 bytes --]

On Fri, Jun 13, 2014 at 11:36:24AM +0000, David Laight wrote:
> From: Robert Baldyga
> > usb_gadget_disconnect() shouldn't be called under spinlock to avoid
> > spinlock recursion. Function usb_gadget_disconnect() calls pullup(),
> > which is callback from UDC driver, usually calling composite_disconnect().
> > This function wants to lock spinlock used in usb_function_deactivate()
> > causing spinlock recursion.
> ...
> > +++ b/drivers/usb/gadget/composite.c
> > @@ -260,8 +260,11 @@ int usb_function_deactivate(struct usb_function *function)
> > 
> >  	spin_lock_irqsave(&cdev->lock, flags);
> > 
> > -	if (cdev->deactivations == 0)
> > +	if (cdev->deactivations == 0) {
> > +		spin_unlock_irqrestore(&cdev->lock, flags);
> >  		status = usb_gadget_disconnect(cdev->gadget);
> > +		spin_lock_irqsave(&cdev->lock, flags);
> > +	}
> >  	if (status == 0)
> >  		cdev->deactivations++;
> 
> That sort of change rings big alarm bells.
> You've effectively isolated the usb_gadget_disconnect() call
> from the check that cdev->deactivations == 0.
> And then you increment cdev->deactivations below.
> 
> Looks like it will be racy to me.

yes, it will. Fixing this requires a much more involved change.

-- 
balbi

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 819 bytes --]