| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAG2Kcto8GZmSkWMmdWkZaQLrt-HS8e5XQ2LWKVxv08PyQDjpjQ@mail.gmail.com>
Date: Sat, 31 Jan 2026 12:14:16 -0800
From: Samuel Wu <wusamuel@...gle.com>
To: Prashanth K <prashanth.k@....qualcomm.com>
Cc: Thinh Nguyen <Thinh.Nguyen@...opsys.com>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>, linux-usb@...r.kernel.org,
linux-kernel@...r.kernel.org, stable@...r.kernel.org,
Android Kernel Team <kernel-team@...roid.com>
Subject: Re: [PATCH] usb: dwc3: gadget: Move vbus draw to workqueue context
On Thu, Jan 29, 2026 at 3:14 AM Prashanth K
<prashanth.k@....qualcomm.com> wrote:
>
> Currently dwc3_gadget_vbus_draw() can be called from atomic
> context, which in turn invokes power-supply-core APIs. And
> some these PMIC APIs have operations that may sleep, leading
> to kernel panic.
>
> Fix this by moving the vbus_draw into a workqueue context.
>
> Fixes: 66e0ea341a2a ("usb: dwc3: core: Defer the probe until USB power supply ready")
> Cc: stable@...r.kernel.org
> Signed-off-by: Prashanth K <prashanth.k@....qualcomm.com>
> ---
> drivers/usb/dwc3/core.c | 19 ++++++++++++++++++-
> drivers/usb/dwc3/core.h | 4 ++++
> drivers/usb/dwc3/gadget.c | 8 +++-----
> 3 files changed, 25 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c
> index f32b67bf73a4..c9af126b9695 100644
> --- a/drivers/usb/dwc3/core.c
> +++ b/drivers/usb/dwc3/core.c
> @@ -2155,6 +2155,20 @@ static int dwc3_get_num_ports(struct dwc3 *dwc)
> return 0;
> }
>
> +static void dwc3_vbus_draw_work(struct work_struct *work)
> +{
> + struct dwc3 *dwc = container_of(work, struct dwc3, vbus_draw_work);
> + union power_supply_propval val = {0};
> + int ret;
> +
> + val.intval = 1000 * (dwc->vbus_draw_current);
> + ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> +
> + if (ret < 0)
> + dev_dbg(dwc->dev, "Error (%d) setting vbus draw (%d mA)\n",
> + ret, dwc->vbus_draw_current);
> +}
> +
> static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> {
> struct power_supply *usb_psy;
> @@ -2169,6 +2183,7 @@ static struct power_supply *dwc3_get_usb_power_supply(struct dwc3 *dwc)
> if (!usb_psy)
> return ERR_PTR(-EPROBE_DEFER);
>
> + INIT_WORK(&dwc->vbus_draw_work, dwc3_vbus_draw_work);
> return usb_psy;
> }
>
> @@ -2395,8 +2410,10 @@ void dwc3_core_remove(struct dwc3 *dwc)
>
> dwc3_free_event_buffers(dwc);
>
> - if (dwc->usb_psy)
> + if (dwc->usb_psy) {
> + cancel_work_sync(&dwc->vbus_draw_work);
> power_supply_put(dwc->usb_psy);
> + }
> }
> EXPORT_SYMBOL_GPL(dwc3_core_remove);
>
> diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
> index 08cc6f2b5c23..052fb18c6b5c 100644
> --- a/drivers/usb/dwc3/core.h
> +++ b/drivers/usb/dwc3/core.h
> @@ -1178,6 +1178,8 @@ struct dwc3_glue_ops {
> * @wakeup_pending_funcs: Indicates whether any interface has requested for
> * function wakeup in bitmap format where bit position
> * represents interface_id.
> + * @vbus_draw_work: Workqueue used for scheduling vbus draw work
> + * @vbus_draw_current: How much current to draw from vbus, in milliAmperes.
> */
> struct dwc3 {
> struct work_struct drd_work;
> @@ -1413,6 +1415,8 @@ struct dwc3 {
> struct dentry *debug_root;
> u32 gsbuscfg0_reqinfo;
> u32 wakeup_pending_funcs;
> + struct work_struct vbus_draw_work;
> + unsigned int vbus_draw_current;
> };
>
> #define INCRX_BURST_MODE 0
> diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
> index 9355c952c140..03d8a3a151e0 100644
> --- a/drivers/usb/dwc3/gadget.c
> +++ b/drivers/usb/dwc3/gadget.c
> @@ -3124,8 +3124,6 @@ static void dwc3_gadget_set_ssp_rate(struct usb_gadget *g,
> static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> {
> struct dwc3 *dwc = gadget_to_dwc(g);
> - union power_supply_propval val = {0};
> - int ret;
>
> if (dwc->usb2_phy)
> return usb_phy_set_power(dwc->usb2_phy, mA);
> @@ -3133,10 +3131,10 @@ static int dwc3_gadget_vbus_draw(struct usb_gadget *g, unsigned int mA)
> if (!dwc->usb_psy)
> return -EOPNOTSUPP;
>
> - val.intval = 1000 * mA;
> - ret = power_supply_set_property(dwc->usb_psy, POWER_SUPPLY_PROP_INPUT_CURRENT_LIMIT, &val);
> + dwc->vbus_draw_current = mA;
> + schedule_work(&dwc->vbus_draw_work);
>
> - return ret;
> + return 0;
> }
>
> /**
> --
> 2.34.1
>
On Pixel 6 with this patch applied on 6.19-rc7, I am no longer seeing
the following lockdep:
[ BUG: Invalid wait context ]
6.19.0-rc7-mainline-maybe-dirty-4k #1 Tainted: G W O
-----------------------------
irq/360-dwc3/1244 is trying to lock:
ffffff8018110eb8 (&psy->extensions_sem){.+.+}-{3:3}, at:
__power_supply_set_property+0x40/0x180
other info that might help us debug this:
context-{4:4}
1 lock held by irq/360-dwc3/1244:
#0: ffffff80368d78f8 (&gi->spinlock){....}-{2:2}, at:
configfs_composite_suspend+0x28/0x68
stack backtrace:
goodixfp: Succeed to open device. irq = 417
CPU: 0 UID: 0 PID: 1244 Comm: irq/360-dwc3 Tainted: G W O
6.19.0-rc7-mainline-maybe-dirty-4k #1 PREEMPT
Tainted: [W]=WARN, [O]=OOT_MODULE
Hardware name: Oriole EVT 1.0 (DT)
Call trace:
show_stack+0x18/0x28 (C)
__dump_stack+0x28/0x3c
dump_stack_lvl+0xac/0xf0
dump_stack+0x18/0x3c
__lock_acquire+0x794/0x2b08
lock_acquire+0x138/0x2c4
down_read+0x3c/0x17c
__power_supply_set_property+0x40/0x180
power_supply_set_property+0x14/0x20
dwc3_gadget_vbus_draw+0x8c/0xcc
usb_gadget_vbus_draw+0x48/0x128
composite_suspend+0xcc/0xe4
configfs_composite_suspend+0x44/0x68
dwc3_thread_interrupt+0x7b4/0xc7c
irq_thread_fn+0x48/0xa8
irq_thread+0x16c/0x338
kthread+0x150/0x280
ret_from_fork+0x10/0x20
Tested-by: Samuel Wu <wusamuel@...gle.com>
Powered by blists - more mailing lists