Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed,  5 Apr 2023 09:31:32 +0000
Mime-Version: 1.0
Message-ID: <20230405093133.1858140-1-badhri@google.com>
Subject: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only
 when started
From:   Badhri Jagan Sridharan <badhri@google.com>
To:     gregkh@linuxfoundation.org, stern@rowland.harvard.edu,
        colin.i.king@gmail.com, xuetao09@huawei.com,
        quic_eserrao@quicinc.com, water.zhangjiantao@huawei.com,
        peter.chen@freescale.com, balbi@ti.com
Cc:     linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org, Badhri Jagan Sridharan <badhri@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

usb_udc_connect_control does not check to see if the udc
has already been started. This causes gadget->ops->pullup
to be called through usb_gadget_connect when invoked
from usb_udc_vbus_handler even before usb_gadget_udc_start
is called. Guard this by checking for udc->started in
usb_udc_connect_control before invoking usb_gadget_connect.

Guarding udc_connect_control, udc->started and udc->vbus
with its own mutex as usb_udc_connect_control_locked
can be simulataneously invoked from different code paths.

Cc: stable@vger.kernel.org

Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
---
 drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 3dcbba739db6..890f92cb6344 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -56,6 +56,8 @@ static LIST_HEAD(udc_list);
 /* Protects udc_list, udc->driver, driver->is_bound, and related calls */
 static DEFINE_MUTEX(udc_lock);
 
+/* Protects udc->vbus, udc-started and udc_connect_control_locked */
+static DEFINE_MUTEX(udc_connect_control_lock);
 /* ------------------------------------------------------------------------- */
 
 /**
@@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
 /* ------------------------------------------------------------------------- */
 
-static void usb_udc_connect_control(struct usb_udc *udc)
+/* Acquire udc_connect_control_lock before calling this function. */
+static void usb_udc_connect_control_locked(struct usb_udc *udc)
 {
-	if (udc->vbus)
+	if (udc->vbus && udc->started)
 		usb_gadget_connect(udc->gadget);
 	else
 		usb_gadget_disconnect(udc->gadget);
@@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
 {
 	struct usb_udc *udc = gadget->udc;
 
+	mutex_lock(&udc_connect_control_lock);
 	if (udc) {
 		udc->vbus = status;
-		usb_udc_connect_control(udc);
+		usb_udc_connect_control_locked(udc);
 	}
+	mutex_unlock(&udc_connect_control_lock);
 }
 EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
 
@@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
 {
 	int ret;
 
+	mutex_lock(&udc_connect_control_lock);
 	if (udc->started) {
 		dev_err(&udc->dev, "UDC had already started\n");
+		mutex_unlock(&udc_connect_control_lock);
 		return -EBUSY;
 	}
 
 	ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
 	if (!ret)
 		udc->started = true;
+	usb_udc_connect_control_locked(udc);
+	mutex_unlock(&udc_connect_control_lock);
 
 	return ret;
 }
@@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
  */
 static inline void usb_gadget_udc_stop(struct usb_udc *udc)
 {
+	mutex_lock(&udc_connect_control_lock);
 	if (!udc->started) {
 		dev_err(&udc->dev, "UDC had already stopped\n");
+		mutex_unlock(&udc_connect_control_lock);
 		return;
 	}
 
 	udc->gadget->ops->udc_stop(udc->gadget);
 	udc->started = false;
+	usb_udc_connect_control_locked(udc);
+	mutex_unlock(&udc_connect_control_lock);
 }
 
 /**
@@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
 	if (ret)
 		goto err_start;
 	usb_gadget_enable_async_callbacks(udc);
-	usb_udc_connect_control(udc);
 
 	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
 	return 0;

base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
-- 
2.40.0.348.gf938b09366-goog