From patchwork Tue Oct 27 16:41:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Cercueil X-Patchwork-Id: 11860863 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1A299921 for ; Tue, 27 Oct 2020 16:42:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0543122264 for ; Tue, 27 Oct 2020 16:42:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1811790AbgJ0Qmb (ORCPT ); Tue, 27 Oct 2020 12:42:31 -0400 Received: from aposti.net ([89.234.176.197]:47456 "EHLO aposti.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1801863AbgJ0Qma (ORCPT ); Tue, 27 Oct 2020 12:42:30 -0400 From: Paul Cercueil To: Bin Liu Cc: Greg Kroah-Hartman , Tony Lindgren , od@zcrc.me, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Paul Cercueil , stable@vger.kernel.org Subject: [RESEND PATCH 1/4] usb: musb: Fix runtime PM race in musb_queue_resume_work Date: Tue, 27 Oct 2020 16:41:57 +0000 Message-Id: <20201027164200.18602-2-paul@crapouillou.net> In-Reply-To: <20201027164200.18602-1-paul@crapouillou.net> References: <20201027164200.18602-1-paul@crapouillou.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org musb_queue_resume_work() would call the provided callback if the runtime PM status was 'active'. Otherwise, it would enqueue the request if the hardware was still suspended (musb->is_runtime_suspended is true). This causes a race with the runtime PM handlers, as it is possible to be in the case where the runtime PM status is not yet 'active', but the hardware has been awaken (PM resume function has been called). When hitting the race, the resume work was not enqueued, which probably triggered other bugs further down the stack. For instance, a telnet connection on Ingenic SoCs would result in a 50/50 chance of a segmentation fault somewhere in the musb code. Rework the code so that either we call the callback directly if (musb->is_runtime_suspended == 0), or enqueue the query otherwise. Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue") Cc: stable@vger.kernel.org # v4.9 Signed-off-by: Paul Cercueil Reviewed-by: Tony Lindgren Tested-by: Tony Lindgren --- drivers/usb/musb/musb_core.c | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c index 849e0b770130..1cd87729ba60 100644 --- a/drivers/usb/musb/musb_core.c +++ b/drivers/usb/musb/musb_core.c @@ -2240,32 +2240,35 @@ int musb_queue_resume_work(struct musb *musb, { struct musb_pending_work *w; unsigned long flags; + bool is_suspended; int error; if (WARN_ON(!callback)) return -EINVAL; - if (pm_runtime_active(musb->controller)) - return callback(musb, data); + spin_lock_irqsave(&musb->list_lock, flags); + is_suspended = musb->is_runtime_suspended; + + if (is_suspended) { + w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC); + if (!w) { + error = -ENOMEM; + goto out_unlock; + } - w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC); - if (!w) - return -ENOMEM; + w->callback = callback; + w->data = data; - w->callback = callback; - w->data = data; - spin_lock_irqsave(&musb->list_lock, flags); - if (musb->is_runtime_suspended) { list_add_tail(&w->node, &musb->pending_list); error = 0; - } else { - dev_err(musb->controller, "could not add resume work %p\n", - callback); - devm_kfree(musb->controller, w); - error = -EINPROGRESS; } + +out_unlock: spin_unlock_irqrestore(&musb->list_lock, flags); + if (!is_suspended) + error = callback(musb, data); + return error; } EXPORT_SYMBOL_GPL(musb_queue_resume_work); From patchwork Tue Oct 27 16:41:58 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Cercueil X-Patchwork-Id: 11860865 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2E03D6A2 for ; Tue, 27 Oct 2020 16:42:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 166EF22275 for ; Tue, 27 Oct 2020 16:42:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1811810AbgJ0Qmi (ORCPT ); Tue, 27 Oct 2020 12:42:38 -0400 Received: from aposti.net ([89.234.176.197]:47482 "EHLO aposti.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1802032AbgJ0Qmh (ORCPT ); Tue, 27 Oct 2020 12:42:37 -0400 From: Paul Cercueil To: Bin Liu Cc: Greg Kroah-Hartman , Tony Lindgren , od@zcrc.me, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Paul Cercueil , Maarten ter Huurne Subject: [RESEND PATCH 2/4] usb: musb: Fix NULL check on struct musb_request field Date: Tue, 27 Oct 2020 16:41:58 +0000 Message-Id: <20201027164200.18602-3-paul@crapouillou.net> In-Reply-To: <20201027164200.18602-1-paul@crapouillou.net> References: <20201027164200.18602-1-paul@crapouillou.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org The 'request' variable is a pointer to the 'request' field of the struct musb_request 'req' pointer. It only worked until now because the 'request' field is the first one in the musb_request structure, but as soon as that changes, the check will be invalid. Fix it preventively by doing the NULL-check on the 'req' pointer instead. Signed-off-by: Paul Cercueil Suggested-by: Maarten ter Huurne Acked-by: Tony Lindgren --- drivers/usb/musb/musb_gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c index f62ffaede1ab..ef374d4dd94a 100644 --- a/drivers/usb/musb/musb_gadget.c +++ b/drivers/usb/musb/musb_gadget.c @@ -451,7 +451,7 @@ void musb_g_tx(struct musb *musb, u8 epnum) return; } - if (request) { + if (req) { trace_musb_req_tx(req); From patchwork Tue Oct 27 16:41:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Cercueil X-Patchwork-Id: 11860869 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5F264921 for ; Tue, 27 Oct 2020 16:42:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 45C89206ED for ; Tue, 27 Oct 2020 16:42:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1811831AbgJ0Qmr (ORCPT ); Tue, 27 Oct 2020 12:42:47 -0400 Received: from aposti.net ([89.234.176.197]:47530 "EHLO aposti.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1801689AbgJ0Qmp (ORCPT ); Tue, 27 Oct 2020 12:42:45 -0400 From: Paul Cercueil To: Bin Liu Cc: Greg Kroah-Hartman , Tony Lindgren , od@zcrc.me, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Paul Cercueil Subject: [RESEND PATCH 3/4] usb: musb: dma: Remove unused variable Date: Tue, 27 Oct 2020 16:41:59 +0000 Message-Id: <20201027164200.18602-4-paul@crapouillou.net> In-Reply-To: <20201027164200.18602-1-paul@crapouillou.net> References: <20201027164200.18602-1-paul@crapouillou.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Remove unused-but-set devctl variable. Signed-off-by: Paul Cercueil --- drivers/usb/musb/musbhsdma.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/usb/musb/musbhsdma.c b/drivers/usb/musb/musbhsdma.c index 0aacfc8be5a1..7acd1635850d 100644 --- a/drivers/usb/musb/musbhsdma.c +++ b/drivers/usb/musb/musbhsdma.c @@ -321,8 +321,6 @@ irqreturn_t dma_controller_irq(int irq, void *private_data) musb_channel->channel.status = MUSB_DMA_STATUS_BUS_ABORT; } else { - u8 devctl; - addr = musb_read_hsdma_addr(mbase, bchannel); channel->actual_len = addr @@ -336,8 +334,6 @@ irqreturn_t dma_controller_irq(int irq, void *private_data) < musb_channel->len) ? "=> reconfig 0" : "=> complete"); - devctl = musb_readb(mbase, MUSB_DEVCTL); - channel->status = MUSB_DMA_STATUS_FREE; /* completed */ From patchwork Tue Oct 27 16:42:00 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paul Cercueil X-Patchwork-Id: 11860871 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5037D921 for ; Tue, 27 Oct 2020 16:43:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3BC58218AC for ; Tue, 27 Oct 2020 16:43:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1811862AbgJ0Qm5 (ORCPT ); Tue, 27 Oct 2020 12:42:57 -0400 Received: from aposti.net ([89.234.176.197]:47556 "EHLO aposti.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1811848AbgJ0Qmy (ORCPT ); Tue, 27 Oct 2020 12:42:54 -0400 From: Paul Cercueil To: Bin Liu Cc: Greg Kroah-Hartman , Tony Lindgren , od@zcrc.me, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Paul Cercueil Subject: [RESEND PATCH 4/4] musb: jz4740: Add missing CR to error strings Date: Tue, 27 Oct 2020 16:42:00 +0000 Message-Id: <20201027164200.18602-5-paul@crapouillou.net> In-Reply-To: <20201027164200.18602-1-paul@crapouillou.net> References: <20201027164200.18602-1-paul@crapouillou.net> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org If you pass a string that is not terminated with a carriage return to dev_err(), it will eventually be printed with a carriage return, but not right away, since the kernel will wait for a pr_cont(). Signed-off-by: Paul Cercueil --- drivers/usb/musb/jz4740.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/usb/musb/jz4740.c b/drivers/usb/musb/jz4740.c index c4fe1f4cd17a..50afc3b94a37 100644 --- a/drivers/usb/musb/jz4740.c +++ b/drivers/usb/musb/jz4740.c @@ -205,26 +205,26 @@ static int jz4740_probe(struct platform_device *pdev) pdata = of_device_get_match_data(dev); if (!pdata) { - dev_err(dev, "missing platform data"); + dev_err(dev, "missing platform data\n"); return -EINVAL; } musb = platform_device_alloc("musb-hdrc", PLATFORM_DEVID_AUTO); if (!musb) { - dev_err(dev, "failed to allocate musb device"); + dev_err(dev, "failed to allocate musb device\n"); return -ENOMEM; } clk = devm_clk_get(dev, "udc"); if (IS_ERR(clk)) { - dev_err(dev, "failed to get clock"); + dev_err(dev, "failed to get clock\n"); ret = PTR_ERR(clk); goto err_platform_device_put; } ret = clk_prepare_enable(clk); if (ret) { - dev_err(dev, "failed to enable clock"); + dev_err(dev, "failed to enable clock\n"); goto err_platform_device_put; } @@ -240,19 +240,19 @@ static int jz4740_probe(struct platform_device *pdev) ret = platform_device_add_resources(musb, pdev->resource, pdev->num_resources); if (ret) { - dev_err(dev, "failed to add resources"); + dev_err(dev, "failed to add resources\n"); goto err_clk_disable; } ret = platform_device_add_data(musb, pdata, sizeof(*pdata)); if (ret) { - dev_err(dev, "failed to add platform_data"); + dev_err(dev, "failed to add platform_data\n"); goto err_clk_disable; } ret = platform_device_add(musb); if (ret) { - dev_err(dev, "failed to register musb device"); + dev_err(dev, "failed to register musb device\n"); goto err_clk_disable; }