Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
MIME-Version: 1.0
References: <20230406061905.2460827-1-badhri@google.com>
In-Reply-To: <20230406061905.2460827-1-badhri@google.com>
From:   Badhri Jagan Sridharan <badhri@google.com>
Date:   Wed, 5 Apr 2023 23:28:20 -0700
Message-ID: <CAPTae5JuYfbRin3M9AngtLouUo7T1wCETY0YrzUhwP+KTMviuA@mail.gmail.com>
Subject: Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect
 only when started
To:     gregkh@linuxfoundation.org, stern@rowland.harvard.edu,
        colin.i.king@gmail.com, xuetao09@huawei.com,
        quic_eserrao@quicinc.com, water.zhangjiantao@huawei.com,
        peter.chen@freescale.com, balbi@ti.com
Cc:     linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Apologies resent V1 again instead of V2. Have sent V2 for real.


On Wed, Apr 5, 2023 at 11:19=E2=80=AFPM Badhri Jagan Sridharan
<badhri@google.com> wrote:
>
> usb_udc_connect_control does not check to see if the udc
> has already been started. This causes gadget->ops->pullup
> to be called through usb_gadget_connect when invoked
> from usb_udc_vbus_handler even before usb_gadget_udc_start
> is called. Guard this by checking for udc->started in
> usb_udc_connect_control before invoking usb_gadget_connect.
>
> Guarding udc_connect_control, udc->started and udc->vbus
> with its own mutex as usb_udc_connect_control_locked
> can be simulataneously invoked from different code paths.
>
> Cc: stable@vger.kernel.org
>
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
> ---
>  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.=
c
> index 3dcbba739db6..890f92cb6344 100644
> --- a/drivers/usb/gadget/udc/core.c
> +++ b/drivers/usb/gadget/udc/core.c
> @@ -56,6 +56,8 @@ static LIST_HEAD(udc_list);
>  /* Protects udc_list, udc->driver, driver->is_bound, and related calls *=
/
>  static DEFINE_MUTEX(udc_lock);
>
> +/* Protects udc->vbus, udc-started and udc_connect_control_locked */
> +static DEFINE_MUTEX(udc_connect_control_lock);
>  /* ---------------------------------------------------------------------=
---- */
>
>  /**
> @@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
>
>  /* ---------------------------------------------------------------------=
---- */
>
> -static void usb_udc_connect_control(struct usb_udc *udc)
> +/* Acquire udc_connect_control_lock before calling this function. */
> +static void usb_udc_connect_control_locked(struct usb_udc *udc)
>  {
> -       if (udc->vbus)
> +       if (udc->vbus && udc->started)
>                 usb_gadget_connect(udc->gadget);
>         else
>                 usb_gadget_disconnect(udc->gadget);
> @@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadg=
et, bool status)
>  {
>         struct usb_udc *udc =3D gadget->udc;
>
> +       mutex_lock(&udc_connect_control_lock);
>         if (udc) {
>                 udc->vbus =3D status;
> -               usb_udc_connect_control(udc);
> +               usb_udc_connect_control_locked(udc);
>         }
> +       mutex_unlock(&udc_connect_control_lock);
>  }
>  EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
>
> @@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb=
_udc *udc)
>  {
>         int ret;
>
> +       mutex_lock(&udc_connect_control_lock);
>         if (udc->started) {
>                 dev_err(&udc->dev, "UDC had already started\n");
> +               mutex_unlock(&udc_connect_control_lock);
>                 return -EBUSY;
>         }
>
>         ret =3D udc->gadget->ops->udc_start(udc->gadget, udc->driver);
>         if (!ret)
>                 udc->started =3D true;
> +       usb_udc_connect_control_locked(udc);
> +       mutex_unlock(&udc_connect_control_lock);
>
>         return ret;
>  }
> @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb=
_udc *udc)
>   */
>  static inline void usb_gadget_udc_stop(struct usb_udc *udc)
>  {
> +       mutex_lock(&udc_connect_control_lock);
>         if (!udc->started) {
>                 dev_err(&udc->dev, "UDC had already stopped\n");
> +               mutex_unlock(&udc_connect_control_lock);
>                 return;
>         }
>
>         udc->gadget->ops->udc_stop(udc->gadget);
>         udc->started =3D false;
> +       usb_udc_connect_control_locked(udc);
> +       mutex_unlock(&udc_connect_control_lock);
>  }
>
>  /**
> @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
>         if (ret)
>                 goto err_start;
>         usb_gadget_enable_async_callbacks(udc);
> -       usb_udc_connect_control(udc);
>
>         kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
>         return 0;
>
> base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
> --
> 2.40.0.348.gf938b09366-goog
>