1. 21 5月, 2018 39 次提交
  2. 26 3月, 2018 1 次提交
    • F
      usb: dwc3: gadget: never call ->complete() from ->ep_queue() · c91815b5
      Felipe Balbi 提交于
      This is a requirement which has always existed but, somehow, wasn't
      reflected in the documentation and problems weren't found until now
      when Tuba Yavuz found a possible deadlock happening between dwc3 and
      f_hid. She described the situation as follows:
      
      spin_lock_irqsave(&hidg->write_spinlock, flags); // first acquire
      /* we our function has been disabled by host */
      if (!hidg->req) {
      	free_ep_req(hidg->in_ep, hidg->req);
      	goto try_again;
      }
      
      [...]
      
      status = usb_ep_queue(hidg->in_ep, hidg->req, GFP_ATOMIC);
      =>
      	[...]
      	=> usb_gadget_giveback_request
      		=>
      		f_hidg_req_complete
      			=>
      			spin_lock_irqsave(&hidg->write_spinlock, flags); // second acquire
      
      Note that this happens because dwc3 would call ->complete() on a
      failed usb_ep_queue() due to failed Start Transfer command. This is,
      anyway, a theoretical situation because dwc3 currently uses "No
      Response Update Transfer" command for Bulk and Interrupt endpoints.
      
      It's still good to make this case impossible to happen even if the "No
      Reponse Update Transfer" command is changed.
      Reported-by: NTuba Yavuz <tuba@ece.ufl.edu>
      Signed-off-by: NFelipe Balbi <felipe.balbi@linux.intel.com>
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      c91815b5