diff mbox series

usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock

Message ID 20240613073959.1939608-1-Meng.Li@windriver.com
State New
Headers show
Series usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock | expand

Commit Message

Li, Meng June 13, 2024, 7:39 a.m. UTC 
When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system
to enter suspend status with below command:
echo mem > /sys/power/state
There will be a deadlock issue occurring. Because dwc3_gadget_suspend() also
try to get the lock again when previous invoked dwc3_suspend_common() has
got the lock . This issue is introduced by commit c7ebd8149ee5 ("usb: dwc3:
gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that removes
the code of checking whether dwc->gadget_driver is NULL or not. It causes the
following code is executed and deadlock occurs when trying to get the spinlock.
To fix the deadlock issue, refer to commit 5265397f9442("usb: dwc3: Remove
DWC3 locking during gadget suspend/resume"), remove lock of otg mode during
gadget suspend/resume.

Fixes: 61a348857e86 ("Fix NULL pointer dereference in dwc3_gadget_suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Meng Li <Meng.Li@windriver.com>
---
 drivers/usb/dwc3/core.c | 6 ------
 1 file changed, 6 deletions(-)

Comments

Thinh Nguyen June 17, 2024, 11:59 p.m. UTC | #1 
+Xu Yang,

On Thu, Jun 13, 2024, Li, Meng wrote:
> 
> 
> > -----Original Message-----
> > From: Greg KH <gregkh@linuxfoundation.org>
> > Sent: Thursday, June 13, 2024 4:06 PM
> > To: Li, Meng <Meng.Li@windriver.com>
> > Cc: Thinh.Nguyen@synopsys.com; quic_uaggarwa@quicinc.com; linux-
> > usb@vger.kernel.org; linux-kernel@vger.kernel.org
> > Subject: Re: [PATCH] usb: dwc3: core: remove lock of otg mode during gadget
> > suspend/resume to avoid deadlock
> > 
> > CAUTION: This email comes from a non Wind River email account!
> > Do not click links or open attachments unless you recognize the sender and
> > know the content is safe.
> > 
> > On Thu, Jun 13, 2024 at 03:39:59PM +0800, Meng Li wrote:
> > > When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger
> > system
> > > to enter suspend status with below command:
> > > echo mem > /sys/power/state
> > > There will be a deadlock issue occurring. Because
> > > dwc3_gadget_suspend() also try to get the lock again when previous
> > > invoked dwc3_suspend_common() has got the lock . This issue is introduced
> > by commit c7ebd8149ee5 ("usb: dwc3:
> > > gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that
> > > removes the code of checking whether dwc->gadget_driver is NULL or
> > > not. It causes the following code is executed and deadlock occurs when
> > trying to get the spinlock.
> > > To fix the deadlock issue, refer to commit 5265397f9442("usb: dwc3:
> > > Remove
> > > DWC3 locking during gadget suspend/resume"), remove lock of otg mode
> > > during gadget suspend/resume.
> > >
> > > Fixes: 61a348857e86 ("Fix NULL pointer dereference in
> > > dwc3_gadget_suspend")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Meng Li <Meng.Li@windriver.com>
> > > ---
> > >  drivers/usb/dwc3/core.c | 6 ------
> > >  1 file changed, 6 deletions(-)
> > >
> > > diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index
> > > 7ee61a89520b..9d47c3aa5777 100644
> > > --- a/drivers/usb/dwc3/core.c
> > > +++ b/drivers/usb/dwc3/core.c
> > > @@ -2250,7 +2250,6 @@ static int dwc3_core_init_for_resume(struct
> > dwc3
> > > *dwc)
> > >
> > >  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
> > {
> > > -     unsigned long   flags;
> > >       u32 reg;
> > >       int i;
> > >
> > > @@ -2293,9 +2292,7 @@ static int dwc3_suspend_common(struct dwc3
> > *dwc, pm_message_t msg)
> > >                       break;
> > >
> > >               if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> > > -                     spin_lock_irqsave(&dwc->lock, flags);
> > >                       dwc3_gadget_suspend(dwc);
> > > -                     spin_unlock_irqrestore(&dwc->lock, flags);
> > >                       synchronize_irq(dwc->irq_gadget);
> > >               }
> > >
> > > @@ -2312,7 +2309,6 @@ static int dwc3_suspend_common(struct dwc3
> > *dwc,
> > > pm_message_t msg)
> > >
> > >  static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)  {
> > > -     unsigned long   flags;
> > >       int             ret;
> > >       u32             reg;
> > >       int             i;
> > > @@ -2366,9 +2362,7 @@ static int dwc3_resume_common(struct dwc3
> > *dwc, pm_message_t msg)
> > >               if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
> > >                       dwc3_otg_host_init(dwc);
> > >               } else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> > > -                     spin_lock_irqsave(&dwc->lock, flags);
> > >                       dwc3_gadget_resume(dwc);
> > > -                     spin_unlock_irqrestore(&dwc->lock, flags);
> > >               }
> > >
> > >               break;
> > > --
> > > 2.34.1
> > >
> > >
> > 
> > Hi,
> > 
> > This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him a
> > patch that has triggered this response.  He used to manually respond to these
> > common problems, but in order to save his sanity (he kept writing the same
> > thing over and over, yet to different people), I was created.  Hopefully you will
> > not take offence and will fix the problem in your patch and resubmit it so that
> > it can be accepted into the Linux kernel tree.
> > 
> > You are receiving this message because of the following common error(s) as
> > indicated below:
> > 
> > - This looks like a new version of a previously submitted patch, but you
> >   did not list below the --- line any changes from the previous version.
> >   Please read the section entitled "The canonical patch format" in the
> >   kernel file, Documentation/process/submitting-patches.rst for what
> >   needs to be done here to properly describe this.
> > 
> > If you wish to discuss this problem further, or you have questions about how
> > to resolve this issue, please feel free to respond to this email and Greg will
> > reply once he has dug out from the pending patches received from other
> > developers.
> > 
> 
> Sorry! I sent the patch of linux-stable version firstly, and then I realize my fault, so send a correct version for mainline upstream.
> So, I think I received this email from patch-bot to remind me to add the --- for change log.
> Let me clarify that this patch is the first version for mainline upstream. And please ignore the previous wrong one for linux-stable.
> 
> Best Regards,
> Meng
> 

Xu Yang reported and sent a patch[*] and I reviewed and Acked a while
ago. However, he and I did missed about removing the lock during
dwc3_resume_common().

Please resend the patch so we can apply the fix.

Thanks,
Thinh

[*] https://lore.kernel.org/linux-usb/20240528230951.23ac5yqwkpalxdzz@synopsys.com/
diff mbox series

Patch

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 7ee61a89520b..9d47c3aa5777 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -2250,7 +2250,6 @@  static int dwc3_core_init_for_resume(struct dwc3 *dwc)
 
 static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 {
-	unsigned long	flags;
 	u32 reg;
 	int i;
 
@@ -2293,9 +2292,7 @@  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 			break;
 
 		if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
-			spin_lock_irqsave(&dwc->lock, flags);
 			dwc3_gadget_suspend(dwc);
-			spin_unlock_irqrestore(&dwc->lock, flags);
 			synchronize_irq(dwc->irq_gadget);
 		}
 
@@ -2312,7 +2309,6 @@  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 
 static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
 {
-	unsigned long	flags;
 	int		ret;
 	u32		reg;
 	int		i;
@@ -2366,9 +2362,7 @@  static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
 		if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
 			dwc3_otg_host_init(dwc);
 		} else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
-			spin_lock_irqsave(&dwc->lock, flags);
 			dwc3_gadget_resume(dwc);
-			spin_unlock_irqrestore(&dwc->lock, flags);
 		}
 
 		break;