usb_gadget_connect calls gadget->ops->pullup without checking whether gadget->connected was previously set. Make this symmetric to usb_gadget_disconnect by returning early if gadget->connected is already set.

Cc: stable@vger.kernel.org

Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected") --- drivers/usb/gadget/udc/core.c | 3 +++ 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 890f92cb6344..7eeaf7dbb350 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -708,6 +708,9 @@ int usb_gadget_connect(struct usb_gadget *gadget) goto out; }

+ if (gadget->connected) + goto out; + if (gadget->deactivated) { /* * If gadget is deactivated we only save new state.

Apologies resent V1 again instead of V2. Have sent V2 for real.

On Wed, Apr 5, 2023 at 11:19 PM Badhri Jagan Sridharan badhri@google.com wrote:

usb_udc_connect_control does not check to see if the udc has already been started. This causes gadget->ops->pullup to be called through usb_gadget_connect when invoked from usb_udc_vbus_handler even before usb_gadget_udc_start is called. Guard this by checking for udc->started in usb_udc_connect_control before invoking usb_gadget_connect.

Guarding udc_connect_control, udc->started and udc->vbus with its own mutex as usb_udc_connect_control_locked can be simulataneously invoked from different code paths.

Cc: stable@vger.kernel.org

Signed-off-by: Badhri Jagan Sridharan badhri@google.com Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")

---

drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c index 3dcbba739db6..890f92cb6344 100644 --- a/drivers/usb/gadget/udc/core.c +++ b/drivers/usb/gadget/udc/core.c @@ -56,6 +56,8 @@ static LIST_HEAD(udc_list); /* Protects udc_list, udc->driver, driver->is_bound, and related calls */ static DEFINE_MUTEX(udc_lock);

+/* Protects udc->vbus, udc-started and udc_connect_control_locked */ +static DEFINE_MUTEX(udc_connect_control_lock); /* ------------------------------------------------------------------------- */

/** @@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);

/* ------------------------------------------------------------------------- */

-static void usb_udc_connect_control(struct usb_udc *udc) +/* Acquire udc_connect_control_lock before calling this function. */ +static void usb_udc_connect_control_locked(struct usb_udc *udc) {

•   if (udc->vbus)
  

•   if (udc->vbus && udc->started)
            usb_gadget_connect(udc->gadget);
    else
            usb_gadget_disconnect(udc->gadget);
  

@@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status) { struct usb_udc *udc = gadget->udc;

•   mutex_lock(&udc_connect_control_lock);
    if (udc) {
            udc->vbus = status;
  

•           usb_udc_connect_control(udc);
  

•           usb_udc_connect_control_locked(udc);
    }
  

•   mutex_unlock(&udc_connect_control_lock);
  

} EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);

@@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) { int ret;

•   mutex_lock(&udc_connect_control_lock);
    if (udc->started) {
            dev_err(&udc->dev, "UDC had already started\n");
  

•           mutex_unlock(&udc_connect_control_lock);
            return -EBUSY;
    }
  
    ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
    if (!ret)
            udc->started = true;
  

•   usb_udc_connect_control_locked(udc);
  

•   mutex_unlock(&udc_connect_control_lock);
  
    return ret;
  

} @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc) */ static inline void usb_gadget_udc_stop(struct usb_udc *udc) {

•   mutex_lock(&udc_connect_control_lock);
    if (!udc->started) {
            dev_err(&udc->dev, "UDC had already stopped\n");
  

•           mutex_unlock(&udc_connect_control_lock);
            return;
    }
  
    udc->gadget->ops->udc_stop(udc->gadget);
    udc->started = false;
  

•   usb_udc_connect_control_locked(udc);
  

•   mutex_unlock(&udc_connect_control_lock);
  

}

/** @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev) if (ret) goto err_start; usb_gadget_enable_async_callbacks(udc);

•   usb_udc_connect_control(udc);
  
    kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
    return 0;
  
  

base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423

2.40.0.348.gf938b09366-goog