linux-kernel - Re: [PATCH] usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC unbind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <474148e5-37e2-ea0c-7d78-9e71155314d9@codeaurora.org>
Date:   Thu, 16 Sep 2021 23:28:09 -0700
From:   Wesley Cheng <wcheng@...eaurora.org>
To:     Felipe Balbi <balbi@...nel.org>
Cc:     gregkh@...uxfoundation.org, linux-usb@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] usb: dwc3: gadget: Avoid starting DWC3 gadget during UDC
 unbind

Hi,

On 9/16/2021 10:17 PM, Felipe Balbi wrote:
> 
> Hi,
> 
> Wesley Cheng <wcheng@...eaurora.org> writes:
> 
>> There is a race present where the DWC3 runtime resume runs in parallel
>> to the UDC unbind sequence.  This will eventually lead to a possible
>> scenario where we are enabling the run/stop bit, without a valid
>> composition defined.
>>
>> Thread#1 (handling UDC unbind):
>> usb_gadget_remove_driver()
>> -->usb_gadget_disconnect()
>>   -->dwc3_gadget_pullup(0)
>> --> continue UDC unbind sequence
>> -->Thread#2 is running in parallel here
>>
>> Thread#2 (handing next cable connect)
>> __dwc3_set_mode()
>>   -->pm_runtime_get_sync()
>>     -->dwc3_gadget_resume()
>>       -->dwc->gadget_driver is NOT NULL yet
>>       -->dwc3_gadget_run_stop(1)
>>       --> _dwc3gadget_start()
>> ...
>>
>> Fix this by tracking the pullup disable routine, and avoiding resuming
>> of the DWC3 gadget.  Once the UDC is re-binded, that will trigger the
>> pullup enable routine, which would handle enabling the DWC3 gadget.
>>
>> Signed-off-by: Wesley Cheng <wcheng@...eaurora.org>

Thanks, Felipe!

> 
> This looks okay to me, but needs to be tested by a few folks ;-)
> 
> Acked-by: Felipe Balbi <balbi@...nel.org>
> 
Yes, would be good to get some functions using
usb_gadget_activate/deactivate().  It should be OK for those situations
as well, but just to make sure :)

Thanks
Wesley Cheng
-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project