usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect.
Guarding udc_connect_control, udc->started and udc->vbus with its own mutex as usb_udc_connect_control_locked can be simulataneously invoked from different code paths.
Cc: stable@vger.kernel.org
Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler") --- drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 3dcbba739db6..890f92cb6344 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -56,6 +56,8 @@ static LIST_HEAD(udc_list); /* Protects udc_list, udc->driver, driver->is_bound, and related calls */ static DEFINE_MUTEX(udc_lock);
+/* Protects udc->vbus, udc-started and udc_connect_control_locked */ +static DEFINE_MUTEX(udc_connect_control_lock); /* ------------------------------------------------------------------------- */
/** @@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
/* ------------------------------------------------------------------------- */
-static void usb_udc_connect_control(struct usb_udc *udc) +/* Acquire udc_connect_control_lock before calling this function. */ +static void usb_udc_connect_control_locked(struct usb_udc *udc) { - if (udc->vbus) + if (udc->vbus && udc->started) usb_gadget_connect(udc->gadget); else usb_gadget_disconnect(udc->gadget); @@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status) { struct usb_udc *udc = gadget->udc;
+ mutex_lock(&udc_connect_control_lock); if (udc) { udc->vbus = status; - usb_udc_connect_control(udc); + usb_udc_connect_control_locked(udc); } + mutex_unlock(&udc_connect_control_lock); } EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
@@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) { int ret;
+ mutex_lock(&udc_connect_control_lock); if (udc->started) { dev_err(&udc->dev, "UDC had already started\n"); + mutex_unlock(&udc_connect_control_lock); return -EBUSY; }
ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver); if (!ret) udc->started = true; + usb_udc_connect_control_locked(udc); + mutex_unlock(&udc_connect_control_lock);
return ret; } @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) */ static inline void usb_gadget_udc_stop(struct usb_udc *udc) { + mutex_lock(&udc_connect_control_lock); if (!udc->started) { dev_err(&udc->dev, "UDC had already stopped\n"); + mutex_unlock(&udc_connect_control_lock); return; }
udc->gadget->ops->udc_stop(udc->gadget); udc->started = false; + usb_udc_connect_control_locked(udc); + mutex_unlock(&udc_connect_control_lock); }
/** @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev) if (ret) goto err_start; usb_gadget_enable_async_callbacks(udc); - usb_udc_connect_control(udc);
kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); return 0;
base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
usb_gadget_connect calls gadget->ops->pullup without checking whether gadget->connected was previously set. Make this symmetric to usb_gadget_disconnect by returning early if gadget->connected is already set.
Cc: stable@vger.kernel.org
Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected") --- drivers/usb/gadget/udc/core.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 890f92cb6344..7eeaf7dbb350 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -708,6 +708,9 @@ int usb_gadget_connect(struct usb_gadget *gadget) goto out; }
+ if (gadget->connected) + goto out; + if (gadget->deactivated) { /* * If gadget is deactivated we only save new state.
On Wed, Apr 05, 2023 at 09:31:33AM +0000, Badhri Jagan Sridharan wrote:
usb_gadget_connect calls gadget->ops->pullup without checking whether gadget->connected was previously set. Make this symmetric to usb_gadget_disconnect by returning early if gadget->connected is already set.
Cc: stable@vger.kernel.org
Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected")
Same changelog comment as before.
drivers/usb/gadget/udc/core.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 890f92cb6344..7eeaf7dbb350 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -708,6 +708,9 @@ int usb_gadget_connect(struct usb_gadget *gadget) goto out; }
- if (gadget->connected)
goto out;
What prevents this connected value from changing right after you check this?
thanks,
greg k-h
On Wed, Apr 5, 2023 at 10:16 AM Greg KH gregkh@linuxfoundation.org wrote:
On Wed, Apr 05, 2023 at 09:31:33AM +0000, Badhri Jagan Sridharan wrote:
usb_gadget_connect calls gadget->ops->pullup without checking whether gadget->connected was previously set. Make this symmetric to usb_gadget_disconnect by returning early if gadget->connected is already set.
Cc: stable@vger.kernel.org
Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected")
Same changelog comment as before.
Thanks for the feedback Greg ! Have fixed it in v2.
drivers/usb/gadget/udc/core.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 890f92cb6344..7eeaf7dbb350 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -708,6 +708,9 @@ int usb_gadget_connect(struct usb_gadget *gadget) goto out; }
if (gadget->connected)goto out;What prevents this connected value from changing right after you check this?
Nothing in V1 :) However, in v2, the newly introduced mutex guards gadget->connected as well.
thanks,
greg k-h
On Wed, Apr 05, 2023 at 09:31:32AM +0000, Badhri Jagan Sridharan wrote:
usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect.
Guarding udc_connect_control, udc->started and udc->vbus with its own mutex as usb_udc_connect_control_locked can be simulataneously invoked from different code paths.
You have a full 72 columns, please use them all :)
Cc: stable@vger.kernel.org
Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
No blank line after cc: stable, and put the fixes above your signed-off-by line please.
drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 3dcbba739db6..890f92cb6344 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -56,6 +56,8 @@ static LIST_HEAD(udc_list); /* Protects udc_list, udc->driver, driver->is_bound, and related calls */ static DEFINE_MUTEX(udc_lock); +/* Protects udc->vbus, udc-started and udc_connect_control_locked */ +static DEFINE_MUTEX(udc_connect_control_lock);
Why a global lock? Shouldn't this be a per-device lock?
/* ------------------------------------------------------------------------- */ /** @@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state); /* ------------------------------------------------------------------------- */ -static void usb_udc_connect_control(struct usb_udc *udc) +/* Acquire udc_connect_control_lock before calling this function. */ +static void usb_udc_connect_control_locked(struct usb_udc *udc) {
- if (udc->vbus)
- if (udc->vbus && udc->started) usb_gadget_connect(udc->gadget); else usb_gadget_disconnect(udc->gadget);
@@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status) { struct usb_udc *udc = gadget->udc;
- mutex_lock(&udc_connect_control_lock); if (udc) { udc->vbus = status;
usb_udc_connect_control(udc);
usb_udc_connect_control_locked(udc);- mutex_unlock(&udc_connect_control_lock);
} EXPORT_SYMBOL_GPL(usb_udc_vbus_handler); @@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) { int ret;
- mutex_lock(&udc_connect_control_lock); if (udc->started) { dev_err(&udc->dev, "UDC had already started\n");
mutex_unlock(&udc_connect_control_lock);ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver); if (!ret) udc->started = true;
- usb_udc_connect_control_locked(udc);
- mutex_unlock(&udc_connect_control_lock);
return ret; } @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) */ static inline void usb_gadget_udc_stop(struct usb_udc *udc) {
- mutex_lock(&udc_connect_control_lock); if (!udc->started) { dev_err(&udc->dev, "UDC had already stopped\n");
mutex_unlock(&udc_connect_control_lock);udc->gadget->ops->udc_stop(udc->gadget); udc->started = false;
- usb_udc_connect_control_locked(udc);
- mutex_unlock(&udc_connect_control_lock);
} /** @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev) if (ret) goto err_start; usb_gadget_enable_async_callbacks(udc);
- usb_udc_connect_control(udc);
Why drop this call here?
thanks,
greg k-h
On Wed, Apr 05, 2023 at 09:31:32AM +0000, Badhri Jagan Sridharan wrote:
usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect.
Guarding udc_connect_control, udc->started and udc->vbus with its own mutex as usb_udc_connect_control_locked can be simulataneously invoked from different code paths.
Cc: stable@vger.kernel.org
Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
There's a problem with this patch.
drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 3dcbba739db6..890f92cb6344 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c
@@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) { int ret;
- mutex_lock(&udc_connect_control_lock); if (udc->started) { dev_err(&udc->dev, "UDC had already started\n");
mutex_unlock(&udc_connect_control_lock);ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver); if (!ret) udc->started = true;
- usb_udc_connect_control_locked(udc);
- mutex_unlock(&udc_connect_control_lock);
You moved the connect_control call up here, into usb_gadget_udc_start().
return ret; } @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) */ static inline void usb_gadget_udc_stop(struct usb_udc *udc) {
- mutex_lock(&udc_connect_control_lock); if (!udc->started) { dev_err(&udc->dev, "UDC had already stopped\n");
mutex_unlock(&udc_connect_control_lock);udc->gadget->ops->udc_stop(udc->gadget); udc->started = false;
- usb_udc_connect_control_locked(udc);
- mutex_unlock(&udc_connect_control_lock);
} /** @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev) if (ret) goto err_start; usb_gadget_enable_async_callbacks(udc);
- usb_udc_connect_control(udc);
This is where it used to be.
The problem is that in the gadget_bind_driver pathway, usb_gadget_enable_async_callbacks() has to run _before_ the gadget connects. Maybe you can fix this by leaving the function call in its original location and protecting it with the new mutex?
There may be a similar problem with disconnecting and the gadget_unbind_driver pathway (usb_gadget_disable_async_callbacks() has to run _after_ the disconnect occurs). I haven't tried to follow the patch in enough detail to see whether that's an issue.
Alan Stern
kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); return 0;
base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
2.40.0.348.gf938b09366-goog
No blank line after cc: stable, and put the fixes above your
signed-off-by line please.
Fixed all commit message related concerns.
Why a global lock? Shouldn't this be a per-device lock?
Ack ! Addressed this in V2.
On Wed, Apr 5, 2023 at 6:29 PM Alan Stern stern@rowland.harvard.edu wrote:
On Wed, Apr 05, 2023 at 09:31:32AM +0000, Badhri Jagan Sridharan wrote:
usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect.
Guarding udc_connect_control, udc->started and udc->vbus with its own mutex as usb_udc_connect_control_locked can be simulataneously invoked from different code paths.
Cc: stable@vger.kernel.org
Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
There's a problem with this patch.
drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)
diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 3dcbba739db6..890f92cb6344 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c
@@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) { int ret;
mutex_lock(&udc_connect_control_lock); if (udc->started) { dev_err(&udc->dev, "UDC had already started\n");mutex_unlock(&udc_connect_control_lock); return -EBUSY; } ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver); if (!ret) udc->started = true;usb_udc_connect_control_locked(udc);mutex_unlock(&udc_connect_control_lock);You moved the connect_control call up here, into usb_gadget_udc_start().
Have moved it back into gadget_bind_driver.
return ret;} @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) */ static inline void usb_gadget_udc_stop(struct usb_udc *udc) {
mutex_lock(&udc_connect_control_lock); if (!udc->started) { dev_err(&udc->dev, "UDC had already stopped\n");mutex_unlock(&udc_connect_control_lock); return; } udc->gadget->ops->udc_stop(udc->gadget); udc->started = false;usb_udc_connect_control_locked(udc);mutex_unlock(&udc_connect_control_lock);}
/** @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev) if (ret) goto err_start; usb_gadget_enable_async_callbacks(udc);
usb_udc_connect_control(udc);This is where it used to be.
The problem is that in the gadget_bind_driver pathway, usb_gadget_enable_async_callbacks() has to run _before_ the gadget connects. Maybe you can fix this by leaving the function call in its original location and protecting it with the new mutex?
There may be a similar problem with disconnecting and the gadget_unbind_driver pathway (usb_gadget_disable_async_callbacks() has to run _after_ the disconnect occurs). I haven't tried to follow the patch in enough detail to see whether that's an issue.
Thanks for explaining what's the expectation here. I have incorporated the feedback in v2. The new lock now additionally guards gadget->connect and gadget->deactivate as well. Guarding all with the new lock as they are related to one another. I have made sure that the gadget_bind_driver and gadget_unbind_driver sequence remains unaltered.
Alan Stern
kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE); return 0;base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
2.40.0.348.gf938b09366-goog
linux-stable-mirror@lists.linaro.org
-
Alan Stern -
Badhri Jagan Sridharan -
Greg KH