[PATCH v2 1/4] usb: musb: cancel the delayed works after quiescing the interrupt

[Chengyu Liu <lui2012qwq@gmail.com>]

musb_remove() cancels finish_resume_work and deassert_reset_work up
front, while the interrupt is still enabled and the root hub is still
registered, and cancels irq_work only later.  All three works can be
armed past their cancel:

- musb_handle_intr_resume() schedules finish_resume_work from
  interrupt context (RESUME in OTG_STATE_A_SUSPEND, via
  musb_stage0_irq());
- musb_hub_control() schedules finish_resume_work (ClearPortFeature
  SUSPEND -> musb_port_suspend()) and deassert_reset_work
  (SetPortFeature RESET -> musb_port_reset()) from process context,
  and the root hub is only torn down by musb_host_cleanup();
- musb_stage0_irq() schedules irq_work, which can also re-arm itself
  from the session recheck path (musb_pm_runtime_check_session()).

A work armed after its cancel runs musb_host_finish_resume(),
musb_deassert_reset() or musb_irq_work() after musb_free() has
released the struct.

Tear down the host and gadget sides first so no process-context
producer remains, mask the interrupts and synchronize the IRQ line so
no interrupt handler can be running, and only then cancel all three
works.  This also restores the pre-f730f205cc51 ordering, which had
the cancels behind the interrupt masking.

Found by static analysis.

Suggested-by: Neill Kapron <nkapron@google.com>
Fixes: f730f205cc51 ("usb: musb: Split PM runtime between wrapper IP and musb core")
Cc: stable@vger.kernel.org
Signed-off-by: Chengyu Liu <lui2012qwq@gmail.com>
---
v1 -> v2:
- also move the finish_resume_work and deassert_reset_work cancels
  behind the interrupt quiesce, per Neill Kapron's review:
  finish_resume_work is armed from interrupt context as well
  (musb_handle_intr_resume()), and both it and deassert_reset_work
  can additionally be re-armed via musb_hub_control() until
  musb_host_cleanup() tears the host down.
- correct the Fixes tag to f730f205cc51 (the 2016 PM-runtime split
  moved the cancels ahead of the interrupt masking)
v1: https://lore.kernel.org/linux-usb/20261112160448.41566-2-lui2012qwq@gmail.com/

Build-tested on x86_64: musb_core.o compiles clean
(USB_MUSB_HDRC).  No runtime reproducer: requires MUSB-based OTG
hardware.  Fix written with AI assistance.

 drivers/usb/musb/musb_core.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 9b63b56edc45..25115217e0af 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2630,9 +2630,6 @@ static void musb_remove(struct platform_device *pdev)
 	 */
 	musb_exit_debugfs(musb);
 
-	cancel_delayed_work_sync(&musb->irq_work);
-	cancel_delayed_work_sync(&musb->finish_resume_work);
-	cancel_delayed_work_sync(&musb->deassert_reset_work);
 	pm_runtime_get_sync(musb->controller);
 	musb_host_cleanup(musb);
 	musb_gadget_cleanup(musb);
@@ -2642,6 +2639,18 @@ static void musb_remove(struct platform_device *pdev)
 	musb_disable_interrupts(musb);
 	musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
 	spin_unlock_irqrestore(&musb->lock, flags);
+
+	/*
+	 * musb_stage0_irq() arms irq_work (and finish_resume_work on
+	 * remote wakeup) from interrupt context, so the works can only be
+	 * cancelled for good once interrupts are masked and any in-flight
+	 * handler has completed.
+	 */
+	synchronize_irq(musb->nIrq);
+	cancel_delayed_work_sync(&musb->irq_work);
+	cancel_delayed_work_sync(&musb->finish_resume_work);
+	cancel_delayed_work_sync(&musb->deassert_reset_work);
+
 	musb_platform_exit(musb);
 
 	pm_runtime_dont_use_autosuspend(musb->controller);
-- 
2.25.1