diff mbox series

usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock

Message ID 20240613073959.1939608-1-Meng.Li@windriver.com (mailing list archive)
State Superseded
Headers show
Series usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock | expand

Commit Message

Li, Meng June 13, 2024, 7:39 a.m. UTC
When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system
to enter suspend status with below command:
echo mem > /sys/power/state
There will be a deadlock issue occurring. Because dwc3_gadget_suspend() also
try to get the lock again when previous invoked dwc3_suspend_common() has
got the lock . This issue is introduced by commit c7ebd8149ee5 ("usb: dwc3:
gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that removes
the code of checking whether dwc->gadget_driver is NULL or not. It causes the
following code is executed and deadlock occurs when trying to get the spinlock.
To fix the deadlock issue, refer to commit 5265397f9442("usb: dwc3: Remove
DWC3 locking during gadget suspend/resume"), remove lock of otg mode during
gadget suspend/resume.

Fixes: 61a348857e86 ("Fix NULL pointer dereference in dwc3_gadget_suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Meng Li <Meng.Li@windriver.com>
---
 drivers/usb/dwc3/core.c | 6 ------
 1 file changed, 6 deletions(-)

Comments

Greg KH June 13, 2024, 8:06 a.m. UTC | #1
On Thu, Jun 13, 2024 at 03:39:59PM +0800, Meng Li wrote:
> When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system
> to enter suspend status with below command:
> echo mem > /sys/power/state
> There will be a deadlock issue occurring. Because dwc3_gadget_suspend() also
> try to get the lock again when previous invoked dwc3_suspend_common() has
> got the lock . This issue is introduced by commit c7ebd8149ee5 ("usb: dwc3:
> gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that removes
> the code of checking whether dwc->gadget_driver is NULL or not. It causes the
> following code is executed and deadlock occurs when trying to get the spinlock.
> To fix the deadlock issue, refer to commit 5265397f9442("usb: dwc3: Remove
> DWC3 locking during gadget suspend/resume"), remove lock of otg mode during
> gadget suspend/resume.
> 
> Fixes: 61a348857e86 ("Fix NULL pointer dereference in dwc3_gadget_suspend")
> Cc: stable@vger.kernel.org
> Signed-off-by: Meng Li <Meng.Li@windriver.com>
> ---
>  drivers/usb/dwc3/core.c | 6 ------
>  1 file changed, 6 deletions(-)
> 
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index 7ee61a89520b..9d47c3aa5777 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -2250,7 +2250,6 @@ static int dwc3_core_init_for_resume(struct dwc3 *dwc)
>  
>  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
>  {
> -	unsigned long	flags;
>  	u32 reg;
>  	int i;
>  
> @@ -2293,9 +2292,7 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
>  			break;
>  
>  		if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> -			spin_lock_irqsave(&dwc->lock, flags);
>  			dwc3_gadget_suspend(dwc);
> -			spin_unlock_irqrestore(&dwc->lock, flags);
>  			synchronize_irq(dwc->irq_gadget);
>  		}
>  
> @@ -2312,7 +2309,6 @@ static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
>  
>  static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
>  {
> -	unsigned long	flags;
>  	int		ret;
>  	u32		reg;
>  	int		i;
> @@ -2366,9 +2362,7 @@ static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
>  		if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
>  			dwc3_otg_host_init(dwc);
>  		} else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> -			spin_lock_irqsave(&dwc->lock, flags);
>  			dwc3_gadget_resume(dwc);
> -			spin_unlock_irqrestore(&dwc->lock, flags);
>  		}
>  
>  		break;
> -- 
> 2.34.1
> 
> 

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him
a patch that has triggered this response.  He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created.  Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.

You are receiving this message because of the following common error(s)
as indicated below:

- This looks like a new version of a previously submitted patch, but you
  did not list below the --- line any changes from the previous version.
  Please read the section entitled "The canonical patch format" in the
  kernel file, Documentation/process/submitting-patches.rst for what
  needs to be done here to properly describe this.

If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.

thanks,

greg k-h's patch email bot
Li, Meng June 13, 2024, 11:59 a.m. UTC | #2
> -----Original Message-----
> From: Greg KH <gregkh@linuxfoundation.org>
> Sent: Thursday, June 13, 2024 4:06 PM
> To: Li, Meng <Meng.Li@windriver.com>
> Cc: Thinh.Nguyen@synopsys.com; quic_uaggarwa@quicinc.com; linux-
> usb@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH] usb: dwc3: core: remove lock of otg mode during gadget
> suspend/resume to avoid deadlock
> 
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and
> know the content is safe.
> 
> On Thu, Jun 13, 2024 at 03:39:59PM +0800, Meng Li wrote:
> > When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger
> system
> > to enter suspend status with below command:
> > echo mem > /sys/power/state
> > There will be a deadlock issue occurring. Because
> > dwc3_gadget_suspend() also try to get the lock again when previous
> > invoked dwc3_suspend_common() has got the lock . This issue is introduced
> by commit c7ebd8149ee5 ("usb: dwc3:
> > gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that
> > removes the code of checking whether dwc->gadget_driver is NULL or
> > not. It causes the following code is executed and deadlock occurs when
> trying to get the spinlock.
> > To fix the deadlock issue, refer to commit 5265397f9442("usb: dwc3:
> > Remove
> > DWC3 locking during gadget suspend/resume"), remove lock of otg mode
> > during gadget suspend/resume.
> >
> > Fixes: 61a348857e86 ("Fix NULL pointer dereference in
> > dwc3_gadget_suspend")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Meng Li <Meng.Li@windriver.com>
> > ---
> >  drivers/usb/dwc3/core.c | 6 ------
> >  1 file changed, 6 deletions(-)
> >
> > diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index
> > 7ee61a89520b..9d47c3aa5777 100644
> > --- a/drivers/usb/dwc3/core.c
> > +++ b/drivers/usb/dwc3/core.c
> > @@ -2250,7 +2250,6 @@ static int dwc3_core_init_for_resume(struct
> dwc3
> > *dwc)
> >
> >  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
> {
> > -     unsigned long   flags;
> >       u32 reg;
> >       int i;
> >
> > @@ -2293,9 +2292,7 @@ static int dwc3_suspend_common(struct dwc3
> *dwc, pm_message_t msg)
> >                       break;
> >
> >               if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> > -                     spin_lock_irqsave(&dwc->lock, flags);
> >                       dwc3_gadget_suspend(dwc);
> > -                     spin_unlock_irqrestore(&dwc->lock, flags);
> >                       synchronize_irq(dwc->irq_gadget);
> >               }
> >
> > @@ -2312,7 +2309,6 @@ static int dwc3_suspend_common(struct dwc3
> *dwc,
> > pm_message_t msg)
> >
> >  static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)  {
> > -     unsigned long   flags;
> >       int             ret;
> >       u32             reg;
> >       int             i;
> > @@ -2366,9 +2362,7 @@ static int dwc3_resume_common(struct dwc3
> *dwc, pm_message_t msg)
> >               if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
> >                       dwc3_otg_host_init(dwc);
> >               } else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> > -                     spin_lock_irqsave(&dwc->lock, flags);
> >                       dwc3_gadget_resume(dwc);
> > -                     spin_unlock_irqrestore(&dwc->lock, flags);
> >               }
> >
> >               break;
> > --
> > 2.34.1
> >
> >
> 
> Hi,
> 
> This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him a
> patch that has triggered this response.  He used to manually respond to these
> common problems, but in order to save his sanity (he kept writing the same
> thing over and over, yet to different people), I was created.  Hopefully you will
> not take offence and will fix the problem in your patch and resubmit it so that
> it can be accepted into the Linux kernel tree.
> 
> You are receiving this message because of the following common error(s) as
> indicated below:
> 
> - This looks like a new version of a previously submitted patch, but you
>   did not list below the --- line any changes from the previous version.
>   Please read the section entitled "The canonical patch format" in the
>   kernel file, Documentation/process/submitting-patches.rst for what
>   needs to be done here to properly describe this.
> 
> If you wish to discuss this problem further, or you have questions about how
> to resolve this issue, please feel free to respond to this email and Greg will
> reply once he has dug out from the pending patches received from other
> developers.
> 

Sorry! I sent the patch of linux-stable version firstly, and then I realize my fault, so send a correct version for mainline upstream.
So, I think I received this email from patch-bot to remind me to add the --- for change log.
Let me clarify that this patch is the first version for mainline upstream. And please ignore the previous wrong one for linux-stable.

Best Regards,
Meng

> thanks,
> 
> greg k-h's patch email bot
Thinh Nguyen June 17, 2024, 11:59 p.m. UTC | #3
+Xu Yang,

On Thu, Jun 13, 2024, Li, Meng wrote:
> 
> 
> > -----Original Message-----
> > From: Greg KH <gregkh@linuxfoundation.org>
> > Sent: Thursday, June 13, 2024 4:06 PM
> > To: Li, Meng <Meng.Li@windriver.com>
> > Cc: Thinh.Nguyen@synopsys.com; quic_uaggarwa@quicinc.com; linux-
> > usb@vger.kernel.org; linux-kernel@vger.kernel.org
> > Subject: Re: [PATCH] usb: dwc3: core: remove lock of otg mode during gadget
> > suspend/resume to avoid deadlock
> > 
> > CAUTION: This email comes from a non Wind River email account!
> > Do not click links or open attachments unless you recognize the sender and
> > know the content is safe.
> > 
> > On Thu, Jun 13, 2024 at 03:39:59PM +0800, Meng Li wrote:
> > > When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger
> > system
> > > to enter suspend status with below command:
> > > echo mem > /sys/power/state
> > > There will be a deadlock issue occurring. Because
> > > dwc3_gadget_suspend() also try to get the lock again when previous
> > > invoked dwc3_suspend_common() has got the lock . This issue is introduced
> > by commit c7ebd8149ee5 ("usb: dwc3:
> > > gadget: Fix NULL pointer dereference in dwc3_gadget_suspend") that
> > > removes the code of checking whether dwc->gadget_driver is NULL or
> > > not. It causes the following code is executed and deadlock occurs when
> > trying to get the spinlock.
> > > To fix the deadlock issue, refer to commit 5265397f9442("usb: dwc3:
> > > Remove
> > > DWC3 locking during gadget suspend/resume"), remove lock of otg mode
> > > during gadget suspend/resume.
> > >
> > > Fixes: 61a348857e86 ("Fix NULL pointer dereference in
> > > dwc3_gadget_suspend")
> > > Cc: stable@vger.kernel.org
> > > Signed-off-by: Meng Li <Meng.Li@windriver.com>
> > > ---
> > >  drivers/usb/dwc3/core.c | 6 ------
> > >  1 file changed, 6 deletions(-)
> > >
> > > diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index
> > > 7ee61a89520b..9d47c3aa5777 100644
> > > --- a/drivers/usb/dwc3/core.c
> > > +++ b/drivers/usb/dwc3/core.c
> > > @@ -2250,7 +2250,6 @@ static int dwc3_core_init_for_resume(struct
> > dwc3
> > > *dwc)
> > >
> > >  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
> > {
> > > -     unsigned long   flags;
> > >       u32 reg;
> > >       int i;
> > >
> > > @@ -2293,9 +2292,7 @@ static int dwc3_suspend_common(struct dwc3
> > *dwc, pm_message_t msg)
> > >                       break;
> > >
> > >               if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> > > -                     spin_lock_irqsave(&dwc->lock, flags);
> > >                       dwc3_gadget_suspend(dwc);
> > > -                     spin_unlock_irqrestore(&dwc->lock, flags);
> > >                       synchronize_irq(dwc->irq_gadget);
> > >               }
> > >
> > > @@ -2312,7 +2309,6 @@ static int dwc3_suspend_common(struct dwc3
> > *dwc,
> > > pm_message_t msg)
> > >
> > >  static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)  {
> > > -     unsigned long   flags;
> > >       int             ret;
> > >       u32             reg;
> > >       int             i;
> > > @@ -2366,9 +2362,7 @@ static int dwc3_resume_common(struct dwc3
> > *dwc, pm_message_t msg)
> > >               if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
> > >                       dwc3_otg_host_init(dwc);
> > >               } else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
> > > -                     spin_lock_irqsave(&dwc->lock, flags);
> > >                       dwc3_gadget_resume(dwc);
> > > -                     spin_unlock_irqrestore(&dwc->lock, flags);
> > >               }
> > >
> > >               break;
> > > --
> > > 2.34.1
> > >
> > >
> > 
> > Hi,
> > 
> > This is the friendly patch-bot of Greg Kroah-Hartman.  You have sent him a
> > patch that has triggered this response.  He used to manually respond to these
> > common problems, but in order to save his sanity (he kept writing the same
> > thing over and over, yet to different people), I was created.  Hopefully you will
> > not take offence and will fix the problem in your patch and resubmit it so that
> > it can be accepted into the Linux kernel tree.
> > 
> > You are receiving this message because of the following common error(s) as
> > indicated below:
> > 
> > - This looks like a new version of a previously submitted patch, but you
> >   did not list below the --- line any changes from the previous version.
> >   Please read the section entitled "The canonical patch format" in the
> >   kernel file, Documentation/process/submitting-patches.rst for what
> >   needs to be done here to properly describe this.
> > 
> > If you wish to discuss this problem further, or you have questions about how
> > to resolve this issue, please feel free to respond to this email and Greg will
> > reply once he has dug out from the pending patches received from other
> > developers.
> > 
> 
> Sorry! I sent the patch of linux-stable version firstly, and then I realize my fault, so send a correct version for mainline upstream.
> So, I think I received this email from patch-bot to remind me to add the --- for change log.
> Let me clarify that this patch is the first version for mainline upstream. And please ignore the previous wrong one for linux-stable.
> 
> Best Regards,
> Meng
> 

Xu Yang reported and sent a patch[*] and I reviewed and Acked a while
ago. However, he and I did missed about removing the lock during
dwc3_resume_common().

Please resend the patch so we can apply the fix.

Thanks,
Thinh

[*] https://lore.kernel.org/linux-usb/20240528230951.23ac5yqwkpalxdzz@synopsys.com/
diff mbox series

Patch

diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
index 7ee61a89520b..9d47c3aa5777 100644
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -2250,7 +2250,6 @@  static int dwc3_core_init_for_resume(struct dwc3 *dwc)
 
 static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 {
-	unsigned long	flags;
 	u32 reg;
 	int i;
 
@@ -2293,9 +2292,7 @@  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 			break;
 
 		if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
-			spin_lock_irqsave(&dwc->lock, flags);
 			dwc3_gadget_suspend(dwc);
-			spin_unlock_irqrestore(&dwc->lock, flags);
 			synchronize_irq(dwc->irq_gadget);
 		}
 
@@ -2312,7 +2309,6 @@  static int dwc3_suspend_common(struct dwc3 *dwc, pm_message_t msg)
 
 static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
 {
-	unsigned long	flags;
 	int		ret;
 	u32		reg;
 	int		i;
@@ -2366,9 +2362,7 @@  static int dwc3_resume_common(struct dwc3 *dwc, pm_message_t msg)
 		if (dwc->current_otg_role == DWC3_OTG_ROLE_HOST) {
 			dwc3_otg_host_init(dwc);
 		} else if (dwc->current_otg_role == DWC3_OTG_ROLE_DEVICE) {
-			spin_lock_irqsave(&dwc->lock, flags);
 			dwc3_gadget_resume(dwc);
-			spin_unlock_irqrestore(&dwc->lock, flags);
 		}
 
 		break;