linux-kernel - [PATCH] usb: gadget: udc: Fix permanent block caused by 'deactivated' flag

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251114080841.829128-1-hhhuuu@google.com>
Date: Fri, 14 Nov 2025 16:08:41 +0800
From: Jimmy Hu <hhhuuu@...gle.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, linux-usb@...r.kernel.org
Cc: Jimmy Hu <hhhuuu@...gle.com>, Kuen-Han Tsai <khtsai@...gle.com>, 
	Alan Stern <stern@...land.harvard.edu>, Thinh Nguyen <Thinh.Nguyen@...opsys.com>, 
	Roy Luo <royluo@...gle.com>, Robert Baldyga <r.baldyga@...sung.com>, Felipe Balbi <balbi@...com>, 
	linux-kernel@...r.kernel.org, badhri@...gle.com
Subject: [PATCH] usb: gadget: udc: Fix permanent block caused by 'deactivated' flag

When setting a new USB configuration, some functions (e.g., UVC) can
call usb_function_deactivate() to set the `gadget->deactivated` flag
to `true`, intentionally blocking enumeration until a userspace
daemon (e.g., UVC service) is ready.

This `deactivated=true` state becomes a permanent block if this flag
is not cleared by usb_function_activate() (e.g., UVC service failure
or config set while unplugged). This blocked state persists even if
the cable is plugged/unplugged, as the vbus_event_work() handler is
still blocked by the `gadget->deactivated` flag, preventing pullup()
from being called.

This patch fixes this by modifying vbus_event_work() to clear the
`gadget->deactivated` flag *before* usb_udc_connect_control_locked().
This breaks the permanent block, so pullup() can now be called.

Fixes: ccdf138fe3e2 ("usb: gadget: add usb_gadget_activate/deactivate functions")
Signed-off-by: Jimmy Hu <hhhuuu@...gle.com>
---
 drivers/usb/gadget/udc/core.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 8dbe79bdc0f9..0195540d511a 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -1151,8 +1151,17 @@ static int usb_udc_connect_control_locked(struct usb_udc *udc) __must_hold(&udc-
 static void vbus_event_work(struct work_struct *work)
 {
 	struct usb_udc *udc = container_of(work, struct usb_udc, vbus_work);
+	struct usb_gadget *gadget = udc->gadget;

 	mutex_lock(&udc->connect_lock);
+
+	/*
+	 * Clear the 'deactivated' flag on a VBUS event
+	 * to break the blocked state.
+	 */
+	if (gadget->deactivated)
+		gadget->deactivated = false;
+
 	usb_udc_connect_control_locked(udc);
 	mutex_unlock(&udc->connect_lock);
 }
-- 
2.52.0.rc1.455.g30608eb744-goog