[PATCH v2 03/19] USB: Lock registered interfaces during manual driver binding

[Leon Romanovsky <leon@kernel.org>]

From: Leon Romanovsky <leonro@nvidia.com>

Interface claims hold the USB device lock, but device_bind_driver()
requires the target interface lock. Without it, trust-policy writes can
race admission. The MediaTek btusb setup path instead holds the target
interface lock and would deadlock if the claim took it again.

Lock registered interfaces around binding. Change btusb setup to hold the
USB device lock with a PM reference and disconnect-aware acquisition,
because disconnect waits for this work while holding that lock. Publish
the claim state before releasing the lock.

Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
---
 drivers/bluetooth/btusb_main.c | 42 ++++++++++++++++++++++++++++++------------
 drivers/usb/core/driver.c      |  5 ++++-
 2 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/drivers/bluetooth/btusb_main.c b/drivers/bluetooth/btusb_main.c
index 92a78a7e60396..8fe6bd1bff906 100644
--- a/drivers/bluetooth/btusb_main.c
+++ b/drivers/bluetooth/btusb_main.c
@@ -2993,10 +2993,13 @@ static int btusb_recv_event_realtek(struct hci_dev *hdev, struct sk_buff *skb)
 	return hci_recv_frame(hdev, skb);
 }
 
+/* usb_lock_device_for_reset() gives up after one second of contention */
+#define BTUSB_MTK_ISO_LOCK_TRIES	5
+
 static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
 {
 	struct btmtk_data *btmtk_data;
-	int err;
+	int err, i;
 
 	if (!data->hdev)
 		return;
@@ -3011,22 +3014,37 @@ static void btusb_mtk_claim_iso_intf(struct btusb_data *data)
 	}
 
 	/*
-	 * The function usb_driver_claim_interface() is documented to need
-	 * locks held if it's not called from a probe routine. The code here
-	 * is called from the hci_power_on workqueue, so grab the lock.
+	 * Disconnect holds the device lock while draining this setup work, so
+	 * the lock must be taken with disconnect-aware acquisition. Hold a PM
+	 * reference so the device cannot suspend first. A slow interface
+	 * registration can keep the lock past the one-second limit of a single
+	 * attempt, so retry a few times, but not without bound: a teardown
+	 * that holds the lock may be waiting for this work.
 	 */
-	device_lock(&btmtk_data->isopkt_intf->dev);
-	err = usb_driver_claim_interface(&btusb_driver,
-					 btmtk_data->isopkt_intf, data);
-	device_unlock(&btmtk_data->isopkt_intf->dev);
+	err = usb_autopm_get_interface(data->intf);
+	if (!err) {
+		for (i = 0; i < BTUSB_MTK_ISO_LOCK_TRIES; i++) {
+			err = usb_lock_device_for_reset(data->udev, data->intf);
+			if (err != -EBUSY)
+				break;
+		}
+		if (!err) {
+			err = usb_driver_claim_interface(&btusb_driver,
+							 btmtk_data->isopkt_intf,
+							 data);
+			if (!err) {
+				init_usb_anchor(&btmtk_data->isopkt_anchor);
+				set_bit(BTMTK_ISOPKT_OVER_INTR,
+					&btmtk_data->flags);
+			}
+			usb_unlock_device(data->udev);
+		}
+		usb_autopm_put_interface(data->intf);
+	}
 	if (err < 0) {
 		btmtk_data->isopkt_intf = NULL;
 		bt_dev_err(data->hdev, "Failed to claim iso interface: %d", err);
-		return;
 	}
-
-	set_bit(BTMTK_ISOPKT_OVER_INTR, &btmtk_data->flags);
-	init_usb_anchor(&btmtk_data->isopkt_anchor);
 }
 
 static void btusb_mtk_release_iso_intf(struct hci_dev *hdev)
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index d3a61ebc6afb0..ad5d9d5fc7598 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -584,8 +584,11 @@ int usb_driver_claim_interface(struct usb_driver *driver,
 	/* if interface was already added, bind now; else let
 	 * the future device_add() bind it, bypassing probe()
 	 */
-	if (device_is_registered(dev))
+	if (device_is_registered(dev)) {
+		device_lock(dev);
 		retval = device_bind_driver(dev);
+		device_unlock(dev);
+	}
 
 	if (retval) {
 		dev->driver = NULL;

-- 
2.56.0