diff mbox series

[core-for-CI] usb: typec: ucsi: Fix a potential deadlock in ucsi_send_command_common()

Message ID 20240807062729.3159701-1-chaitanya.kumar.borah@intel.com (mailing list archive)
State New, archived
Headers show
Series [core-for-CI] usb: typec: ucsi: Fix a potential deadlock in ucsi_send_command_common() | expand

Commit Message

Borah, Chaitanya Kumar Aug. 7, 2024, 6:27 a.m. UTC
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>

The function returns with the ppm_lock held if there's an
error or the PPM reports BUSY condition.

This is a core-for-ci patch for [1]

[1] https://lore.kernel.org/linux-usb/20240806112029.2984319-1-heikki.krogerus@linux.intel.com/

Reported-by: Luciano Coelho <luciano.coelho@intel.com>
Fixes: 5e9c1662a89b ("usb: typec: ucsi: rework command execution functions")
References: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11849
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
---
 drivers/usb/typec/ucsi/ucsi.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

Comments

Coelho, Luciano Aug. 7, 2024, 11:54 a.m. UTC | #1
On Wed, 2024-08-07 at 11:57 +0530, Chaitanya Kumar Borah wrote:
> From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> 
> The function returns with the ppm_lock held if there's an
> error or the PPM reports BUSY condition.
> 
> This is a core-for-ci patch for [1]
> 
> [1] https://lore.kernel.org/linux-usb/20240806112029.2984319-1-heikki.krogerus@linux.intel.com/
> 
> Reported-by: Luciano Coelho <luciano.coelho@intel.com>
> Fixes: 5e9c1662a89b ("usb: typec: ucsi: rework command execution functions")
> References: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11849
> Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
> ---
>  drivers/usb/typec/ucsi/ucsi.c | 11 ++++-------
>  1 file changed, 4 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
> index dcd3765cc1f5..432a2d6266d7 100644
> --- a/drivers/usb/typec/ucsi/ucsi.c
> +++ b/drivers/usb/typec/ucsi/ucsi.c
> @@ -238,13 +238,10 @@ static int ucsi_send_command_common(struct ucsi *ucsi, u64 cmd,
>  	mutex_lock(&ucsi->ppm_lock);
>  
>  	ret = ucsi_run_command(ucsi, cmd, &cci, data, size, conn_ack);
> -	if (cci & UCSI_CCI_BUSY) {
> -		ret = ucsi_run_command(ucsi, UCSI_CANCEL, &cci, NULL, 0, false);
> -		return ret ? ret : -EBUSY;
> -	}
> -
> -	if (cci & UCSI_CCI_ERROR)
> -		return ucsi_read_error(ucsi, connector_num);
> +	if (cci & UCSI_CCI_BUSY)
> +		ret = ucsi_run_command(ucsi, UCSI_CANCEL, &cci, NULL, 0, false) ?: -EBUSY;
> +	else if (cci & UCSI_CCI_ERROR)
> +		ret = ucsi_read_error(ucsi, connector_num);
>  
>  	mutex_unlock(&ucsi->ppm_lock);
>  	return ret;

This is not the exact patch that was sent upstream, where Heikki
changed my Reported-by to Reported-and-Tested-by (at least).  I think
the best is to have the patch that was actually sent upstream, because
it's easier to match later on, when it gets merged in the mainline.

In any case, I think this can be merged as is, so:

Acked-by: Luca Coelho <luciano.coelho@intel.com>

--
Cheers,
Luca.
Jani Nikula Aug. 7, 2024, 12:39 p.m. UTC | #2
On Wed, 07 Aug 2024, "Coelho, Luciano" <luciano.coelho@intel.com> wrote:
> On Wed, 2024-08-07 at 11:57 +0530, Chaitanya Kumar Borah wrote:
>> From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
>> 
>> The function returns with the ppm_lock held if there's an
>> error or the PPM reports BUSY condition.
>> 
>> This is a core-for-ci patch for [1]
>> 
>> [1] https://lore.kernel.org/linux-usb/20240806112029.2984319-1-heikki.krogerus@linux.intel.com/
>> 
>> Reported-by: Luciano Coelho <luciano.coelho@intel.com>
>> Fixes: 5e9c1662a89b ("usb: typec: ucsi: rework command execution functions")
>> References: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/11849
>> Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
>> ---
>>  drivers/usb/typec/ucsi/ucsi.c | 11 ++++-------
>>  1 file changed, 4 insertions(+), 7 deletions(-)
>> 
>> diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
>> index dcd3765cc1f5..432a2d6266d7 100644
>> --- a/drivers/usb/typec/ucsi/ucsi.c
>> +++ b/drivers/usb/typec/ucsi/ucsi.c
>> @@ -238,13 +238,10 @@ static int ucsi_send_command_common(struct ucsi *ucsi, u64 cmd,
>>  	mutex_lock(&ucsi->ppm_lock);
>>  
>>  	ret = ucsi_run_command(ucsi, cmd, &cci, data, size, conn_ack);
>> -	if (cci & UCSI_CCI_BUSY) {
>> -		ret = ucsi_run_command(ucsi, UCSI_CANCEL, &cci, NULL, 0, false);
>> -		return ret ? ret : -EBUSY;
>> -	}
>> -
>> -	if (cci & UCSI_CCI_ERROR)
>> -		return ucsi_read_error(ucsi, connector_num);
>> +	if (cci & UCSI_CCI_BUSY)
>> +		ret = ucsi_run_command(ucsi, UCSI_CANCEL, &cci, NULL, 0, false) ?: -EBUSY;
>> +	else if (cci & UCSI_CCI_ERROR)
>> +		ret = ucsi_read_error(ucsi, connector_num);
>>  
>>  	mutex_unlock(&ucsi->ppm_lock);
>>  	return ret;
>
> This is not the exact patch that was sent upstream, where Heikki
> changed my Reported-by to Reported-and-Tested-by (at least).  I think
> the best is to have the patch that was actually sent upstream, because
> it's easier to match later on, when it gets merged in the mainline.
>
> In any case, I think this can be merged as is, so:
>
> Acked-by: Luca Coelho <luciano.coelho@intel.com>

Thanks, pushed to topic/core-for-CI.

BR,
Jani.

>
> --
> Cheers,
> Luca.
diff mbox series

Patch

diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c
index dcd3765cc1f5..432a2d6266d7 100644
--- a/drivers/usb/typec/ucsi/ucsi.c
+++ b/drivers/usb/typec/ucsi/ucsi.c
@@ -238,13 +238,10 @@  static int ucsi_send_command_common(struct ucsi *ucsi, u64 cmd,
 	mutex_lock(&ucsi->ppm_lock);
 
 	ret = ucsi_run_command(ucsi, cmd, &cci, data, size, conn_ack);
-	if (cci & UCSI_CCI_BUSY) {
-		ret = ucsi_run_command(ucsi, UCSI_CANCEL, &cci, NULL, 0, false);
-		return ret ? ret : -EBUSY;
-	}
-
-	if (cci & UCSI_CCI_ERROR)
-		return ucsi_read_error(ucsi, connector_num);
+	if (cci & UCSI_CCI_BUSY)
+		ret = ucsi_run_command(ucsi, UCSI_CANCEL, &cci, NULL, 0, false) ?: -EBUSY;
+	else if (cci & UCSI_CCI_ERROR)
+		ret = ucsi_read_error(ucsi, connector_num);
 
 	mutex_unlock(&ucsi->ppm_lock);
 	return ret;