Skip to content

Commit

Permalink
usb: usbip: Fix possible deadlocks reported by lockdep
Browse files Browse the repository at this point in the history 
Change spin_lock calls to spin_lock_irqsave to prevent
attmpted recursive lock taking in interrupt context.

This patch fixes Bug 109351
  https://bugzilla.kernel.org/show_bug.cgi?id=109351

Signed-off-by: Andrew Goodbody <andrew.goodbody@cambrionix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
@gregkh
Andrew Goodbody authored and gregkh committed Feb 3, 2016
1 parent 46e3caf commit 2161979
Show file tree
Hide file tree
Showing 5 changed files with 91 additions and 65 deletions.
5 changes: 3 additions & 2 deletions drivers/usb/usbip/usbip_event.c
View file
Expand Up @@ -117,11 +117,12 @@ EXPORT_SYMBOL_GPL(usbip_event_add);
int usbip_event_happened(struct usbip_device *ud)
{
int happened = 0;
unsigned long flags;

spin_lock(&ud->lock);
spin_lock_irqsave(&ud->lock, flags);
if (ud->event != 0)
happened = 1;
spin_unlock(&ud->lock);
spin_unlock_irqrestore(&ud->lock, flags);

return happened;
}
Expand Down
88 changes: 52 additions & 36 deletions drivers/usb/usbip/vhci_hcd.c
View file
Expand Up @@ -121,9 +121,11 @@ static void dump_port_status_diff(u32 prev_status, u32 new_status)

void rh_port_connect(int rhport, enum usb_device_speed speed)
{
unsigned long flags;

usbip_dbg_vhci_rh("rh_port_connect %d\n", rhport);

spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);

the_controller->port_status[rhport] |= USB_PORT_STAT_CONNECTION
| (1 << USB_PORT_FEAT_C_CONNECTION);
Expand All @@ -139,22 +141,24 @@ void rh_port_connect(int rhport, enum usb_device_speed speed)
break;
}

spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);

usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
}

static void rh_port_disconnect(int rhport)
{
unsigned long flags;

usbip_dbg_vhci_rh("rh_port_disconnect %d\n", rhport);

spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);

the_controller->port_status[rhport] &= ~USB_PORT_STAT_CONNECTION;
the_controller->port_status[rhport] |=
(1 << USB_PORT_FEAT_C_CONNECTION);

spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
usb_hcd_poll_rh_status(vhci_to_hcd(the_controller));
}

Expand Down Expand Up @@ -182,13 +186,14 @@ static int vhci_hub_status(struct usb_hcd *hcd, char *buf)
int retval;
int rhport;
int changed = 0;
unsigned long flags;

retval = DIV_ROUND_UP(VHCI_NPORTS + 1, 8);
memset(buf, 0, retval);

vhci = hcd_to_vhci(hcd);

spin_lock(&vhci->lock);
spin_lock_irqsave(&vhci->lock, flags);
if (!HCD_HW_ACCESSIBLE(hcd)) {
usbip_dbg_vhci_rh("hw accessible flag not on?\n");
goto done;
Expand All @@ -209,7 +214,7 @@ static int vhci_hub_status(struct usb_hcd *hcd, char *buf)
usb_hcd_resume_root_hub(hcd);

done:
spin_unlock(&vhci->lock);
spin_unlock_irqrestore(&vhci->lock, flags);
return changed ? retval : 0;
}

Expand All @@ -231,6 +236,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
struct vhci_hcd *dum;
int retval = 0;
int rhport;
unsigned long flags;

u32 prev_port_status[VHCI_NPORTS];

Expand All @@ -249,7 +255,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,

dum = hcd_to_vhci(hcd);

spin_lock(&dum->lock);
spin_lock_irqsave(&dum->lock, flags);

/* store old status and compare now and old later */
if (usbip_dbg_flag_vhci_rh) {
Expand Down Expand Up @@ -403,7 +409,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
}
usbip_dbg_vhci_rh(" bye\n");

spin_unlock(&dum->lock);
spin_unlock_irqrestore(&dum->lock, flags);

return retval;
}
Expand All @@ -426,6 +432,7 @@ static void vhci_tx_urb(struct urb *urb)
{
struct vhci_device *vdev = get_vdev(urb->dev);
struct vhci_priv *priv;
unsigned long flags;

if (!vdev) {
pr_err("could not get virtual device");
Expand All @@ -438,7 +445,7 @@ static void vhci_tx_urb(struct urb *urb)
return;
}

spin_lock(&vdev->priv_lock);
spin_lock_irqsave(&vdev->priv_lock, flags);

priv->seqnum = atomic_inc_return(&the_controller->seqnum);
if (priv->seqnum == 0xffff)
Expand All @@ -452,7 +459,7 @@ static void vhci_tx_urb(struct urb *urb)
list_add_tail(&priv->list, &vdev->priv_tx);

wake_up(&vdev->waitq_tx);
spin_unlock(&vdev->priv_lock);
spin_unlock_irqrestore(&vdev->priv_lock, flags);
}

static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
Expand All @@ -461,18 +468,19 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
struct device *dev = &urb->dev->dev;
int ret = 0;
struct vhci_device *vdev;
unsigned long flags;

usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n",
hcd, urb, mem_flags);

/* patch to usb_sg_init() is in 2.5.60 */
BUG_ON(!urb->transfer_buffer && urb->transfer_buffer_length);

spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);

if (urb->status != -EINPROGRESS) {
dev_err(dev, "URB already unlinked!, status %d\n", urb->status);
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
return urb->status;
}

Expand All @@ -484,7 +492,7 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,
vdev->ud.status == VDEV_ST_ERROR) {
dev_err(dev, "enqueue for inactive port %d\n", vdev->rhport);
spin_unlock(&vdev->ud.lock);
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
return -ENODEV;
}
spin_unlock(&vdev->ud.lock);
Expand Down Expand Up @@ -557,14 +565,14 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb,

out:
vhci_tx_urb(urb);
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);

return 0;

no_need_xmit:
usb_hcd_unlink_urb_from_ep(hcd, urb);
no_need_unlink:
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
if (!ret)
usb_hcd_giveback_urb(vhci_to_hcd(the_controller),
urb, urb->status);
Expand Down Expand Up @@ -621,16 +629,17 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
{
struct vhci_priv *priv;
struct vhci_device *vdev;
unsigned long flags;

pr_info("dequeue a urb %p\n", urb);

spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);

priv = urb->hcpriv;
if (!priv) {
/* URB was never linked! or will be soon given back by
* vhci_rx. */
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
return -EIDRM;
}

Expand All @@ -639,7 +648,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)

ret = usb_hcd_check_unlink_urb(hcd, urb, status);
if (ret) {
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
return ret;
}
}
Expand Down Expand Up @@ -667,10 +676,10 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)

usb_hcd_unlink_urb_from_ep(hcd, urb);

spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
urb->status);
spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);

} else {
/* tcp connection is alive */
Expand All @@ -682,7 +691,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
unlink = kzalloc(sizeof(struct vhci_unlink), GFP_ATOMIC);
if (!unlink) {
spin_unlock(&vdev->priv_lock);
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
usbip_event_add(&vdev->ud, VDEV_EVENT_ERROR_MALLOC);
return -ENOMEM;
}
Expand All @@ -703,7 +712,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
spin_unlock(&vdev->priv_lock);
}

spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);

usbip_dbg_vhci_hc("leave\n");
return 0;
Expand All @@ -712,8 +721,9 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status)
static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
{
struct vhci_unlink *unlink, *tmp;
unsigned long flags;

spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);
spin_lock(&vdev->priv_lock);

list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) {
Expand Down Expand Up @@ -747,19 +757,19 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev)
list_del(&unlink->list);

spin_unlock(&vdev->priv_lock);
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);

usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb,
urb->status);

spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);
spin_lock(&vdev->priv_lock);

kfree(unlink);
}

spin_unlock(&vdev->priv_lock);
spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);
}

/*
Expand Down Expand Up @@ -826,8 +836,9 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
static void vhci_device_reset(struct usbip_device *ud)
{
struct vhci_device *vdev = container_of(ud, struct vhci_device, ud);
unsigned long flags;

spin_lock(&ud->lock);
spin_lock_irqsave(&ud->lock, flags);

vdev->speed = 0;
vdev->devid = 0;
Expand All @@ -841,14 +852,16 @@ static void vhci_device_reset(struct usbip_device *ud)
}
ud->status = VDEV_ST_NULL;

spin_unlock(&ud->lock);
spin_unlock_irqrestore(&ud->lock, flags);
}

static void vhci_device_unusable(struct usbip_device *ud)
{
spin_lock(&ud->lock);
unsigned long flags;

spin_lock_irqsave(&ud->lock, flags);
ud->status = VDEV_ST_ERROR;
spin_unlock(&ud->lock);
spin_unlock_irqrestore(&ud->lock, flags);
}

static void vhci_device_init(struct vhci_device *vdev)
Expand Down Expand Up @@ -938,12 +951,13 @@ static int vhci_get_frame_number(struct usb_hcd *hcd)
static int vhci_bus_suspend(struct usb_hcd *hcd)
{
struct vhci_hcd *vhci = hcd_to_vhci(hcd);
unsigned long flags;

dev_dbg(&hcd->self.root_hub->dev, "%s\n", __func__);

spin_lock(&vhci->lock);
spin_lock_irqsave(&vhci->lock, flags);
hcd->state = HC_STATE_SUSPENDED;
spin_unlock(&vhci->lock);
spin_unlock_irqrestore(&vhci->lock, flags);

return 0;
}
Expand All @@ -952,15 +966,16 @@ static int vhci_bus_resume(struct usb_hcd *hcd)
{
struct vhci_hcd *vhci = hcd_to_vhci(hcd);
int rc = 0;
unsigned long flags;

dev_dbg(&hcd->self.root_hub->dev, "%s\n", __func__);

spin_lock(&vhci->lock);
spin_lock_irqsave(&vhci->lock, flags);
if (!HCD_HW_ACCESSIBLE(hcd))
rc = -ESHUTDOWN;
else
hcd->state = HC_STATE_RUNNING;
spin_unlock(&vhci->lock);
spin_unlock_irqrestore(&vhci->lock, flags);

return rc;
}
Expand Down Expand Up @@ -1058,17 +1073,18 @@ static int vhci_hcd_suspend(struct platform_device *pdev, pm_message_t state)
int rhport = 0;
int connected = 0;
int ret = 0;
unsigned long flags;

hcd = platform_get_drvdata(pdev);

spin_lock(&the_controller->lock);
spin_lock_irqsave(&the_controller->lock, flags);

for (rhport = 0; rhport < VHCI_NPORTS; rhport++)
if (the_controller->port_status[rhport] &
USB_PORT_STAT_CONNECTION)
connected += 1;

spin_unlock(&the_controller->lock);
spin_unlock_irqrestore(&the_controller->lock, flags);

if (connected > 0) {
dev_info(&pdev->dev,
Expand Down

0 comments on commit 2161979

Please sign in to comment.