[PATCH v2] usb: gadget: lpc32xx_udc: drain pullup work before teardown

[PATCH v2] usb: gadget: lpc32xx_udc: drain pullup work before teardown

[Hongyan Xu]

The pullup worker accesses the transceiver I2C client and UDC
state. IRQs can leave it pending when remove or a late probe
failure releases those resources. Cancelling the final pullup
work would also discard the requested disconnect.

After the gadget core has stopped its callbacks, explicitly free
and synchronize the registered UDC IRQs. Request pullup-off and
flush its worker while the transceiver client is still retained.
The worker needs no UDC IRQ to finish its I2C transaction.

Track successful IRQ registrations during probe so late failure
also stops all acquired producers and drains pullup work before
destroying DMA resources and dropping the I2C client.

Found by the author's in-house static analysis tool.

Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx")
Cc: stable@vger.kernel.org
Suggested-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
Link: https://lore.kernel.org/all/20260928134158.117-1-getshell@seu.edu.cn/
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
Signed-off-by: Zehao Gao <gaozehao@iie.ac.cn>
---

Discovery: found by the author's in-house static analysis tool.

 drivers/usb/gadget/udc/lpc32xx_udc.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
index 94355d3..d627a2a 100644
--- a/drivers/usb/gadget/udc/lpc32xx_udc.c
+++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
@@ -2978,10 +2978,17 @@ static struct lpc32xx_usbd_cfg lpc32xx_usbddata = {
 
 static u64 lpc32xx_usbd_dmamask = ~(u32) 0x7F;
 
+static void lpc32xx_udc_free_irqs(struct lpc32xx_udc *udc, unsigned int count)
+{
+	while (count--)
+		devm_free_irq(udc->dev, udc->udp_irq[count], udc);
+}
+
 static int lpc32xx_udc_probe(struct platform_device *pdev)
 {
 	struct device *dev = &pdev->dev;
 	struct lpc32xx_udc *udc;
+	int irq_count = 0;
 	int retval, i;
 	dma_addr_t dma_handle;
 	struct device_node *isp1301_node;
@@ -3112,6 +3119,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
 			udc->udp_irq[IRQ_USB_LP]);
 		goto err_destroy_pool;
 	}
+	irq_count++;
 	retval = devm_request_irq(dev, udc->udp_irq[IRQ_USB_HP],
 				  lpc32xx_usb_hp_irq, 0, "udc_hp", udc);
 	if (retval < 0) {
@@ -3120,6 +3128,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
 		goto err_destroy_pool;
 	}
 
+	irq_count++;
 	retval = devm_request_irq(dev, udc->udp_irq[IRQ_USB_DEVDMA],
 				  lpc32xx_usb_devdma_irq, 0, "udc_dma", udc);
 	if (retval < 0) {
@@ -3128,6 +3137,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
 		goto err_destroy_pool;
 	}
 
+	irq_count++;
 	/* The transceiver interrupt is used for VBUS detection and will
 	   kick off the VBUS handler function */
 	retval = devm_request_threaded_irq(dev, udc->udp_irq[IRQ_USB_ATX], NULL,
@@ -3139,6 +3149,7 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
 		goto err_destroy_pool;
 	}
 
+	irq_count++;
 	/* Initialize wait queue */
 	init_waitqueue_head(&udc->ep_disable_wait_queue);
 	atomic_set(&udc->enabled_ep_cnt, 0);
@@ -3158,6 +3169,8 @@ static int lpc32xx_udc_probe(struct platform_device *pdev)
 	return 0;
 
 err_destroy_pool:
+	lpc32xx_udc_free_irqs(udc, irq_count);
+	flush_work(&udc->pullup_job);
 	dma_pool_destroy(udc->dd_cache);
 err_free_dma:
 	dma_free_coherent(&pdev->dev, UDCA_BUFF_SIZE,
@@ -3183,9 +3196,12 @@ static void lpc32xx_udc_remove(struct platform_device *pdev)
 		return;
 	}
 
+	lpc32xx_udc_free_irqs(udc, ARRAY_SIZE(udc->udp_irq));
+
 	udc_clk_set(udc, 1);
 	udc_disable(udc);
 	pullup(udc, 0);
+	flush_work(&udc->pullup_job);
 
 	device_init_wakeup(&pdev->dev, 0);
 	remove_debug_file(udc);
-- 
2.50.1.windows.1

Re: [PATCH v2] usb: gadget: lpc32xx_udc: drain pullup work before teardown

[sashiko-bot]

> The pullup worker accesses the transceiver I2C client and UDC
> state. IRQs can leave it pending when remove or a late probe
> failure releases those resources. Cancelling the final pullup
> work would also discard the requested disconnect.
> 
> After the gadget core has stopped its callbacks, explicitly free
> and synchronize the registered UDC IRQs. Request pullup-off and
> flush its worker while the transceiver client is still retained.
> The worker needs no UDC IRQ to finish its I2C transaction.
> 
> Track successful IRQ registrations during probe so late failure
> also stops all acquired producers and drains pullup work before
> destroying DMA resources and dropping the I2C client.
> 
> Found by the author's in-house static analysis tool.
> 
> Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx")
> Cc: stable@vger.kernel.org
> Suggested-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>
> Link: https://lore.kernel.org/all/20260928134158.117-1-getshell@seu.edu.cn/
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> Signed-off-by: Zehao Gao <gaozehao@iie.ac.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/179474326988.103840.10326852247134349070@seu.edu.cn?part=1