[PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Badhri Jagan Sridharan]

usb_udc_connect_control does not check to see if the udc
has already been started. This causes gadget->ops->pullup
to be called through usb_gadget_connect when invoked
from usb_udc_vbus_handler even before usb_gadget_udc_start
is called. Guard this by checking for udc->started in
usb_udc_connect_control before invoking usb_gadget_connect.

Guarding udc_connect_control, udc->started and udc->vbus
with its own mutex as usb_udc_connect_control_locked
can be simulataneously invoked from different code paths.

Cc: stable@vger.kernel.org

Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
---
 drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 3dcbba739db6..890f92cb6344 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -56,6 +56,8 @@ static LIST_HEAD(udc_list);
 /* Protects udc_list, udc->driver, driver->is_bound, and related calls */
 static DEFINE_MUTEX(udc_lock);
 
+/* Protects udc->vbus, udc-started and udc_connect_control_locked */
+static DEFINE_MUTEX(udc_connect_control_lock);
 /* ------------------------------------------------------------------------- */
 
 /**
@@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
 /* ------------------------------------------------------------------------- */
 
-static void usb_udc_connect_control(struct usb_udc *udc)
+/* Acquire udc_connect_control_lock before calling this function. */
+static void usb_udc_connect_control_locked(struct usb_udc *udc)
 {
-	if (udc->vbus)
+	if (udc->vbus && udc->started)
 		usb_gadget_connect(udc->gadget);
 	else
 		usb_gadget_disconnect(udc->gadget);
@@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
 {
 	struct usb_udc *udc = gadget->udc;
 
+	mutex_lock(&udc_connect_control_lock);
 	if (udc) {
 		udc->vbus = status;
-		usb_udc_connect_control(udc);
+		usb_udc_connect_control_locked(udc);
 	}
+	mutex_unlock(&udc_connect_control_lock);
 }
 EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
 
@@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
 {
 	int ret;
 
+	mutex_lock(&udc_connect_control_lock);
 	if (udc->started) {
 		dev_err(&udc->dev, "UDC had already started\n");
+		mutex_unlock(&udc_connect_control_lock);
 		return -EBUSY;
 	}
 
 	ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
 	if (!ret)
 		udc->started = true;
+	usb_udc_connect_control_locked(udc);
+	mutex_unlock(&udc_connect_control_lock);
 
 	return ret;
 }
@@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
  */
 static inline void usb_gadget_udc_stop(struct usb_udc *udc)
 {
+	mutex_lock(&udc_connect_control_lock);
 	if (!udc->started) {
 		dev_err(&udc->dev, "UDC had already stopped\n");
+		mutex_unlock(&udc_connect_control_lock);
 		return;
 	}
 
 	udc->gadget->ops->udc_stop(udc->gadget);
 	udc->started = false;
+	usb_udc_connect_control_locked(udc);
+	mutex_unlock(&udc_connect_control_lock);
 }
 
 /**
@@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
 	if (ret)
 		goto err_start;
 	usb_gadget_enable_async_callbacks(udc);
-	usb_udc_connect_control(udc);
 
 	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
 	return 0;

base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
-- 
2.40.0.348.gf938b09366-goog

[PATCH v1 2/2] usb: gadget: udc: core: Prevent redundant calls to pullup

[Badhri Jagan Sridharan]

usb_gadget_connect calls gadget->ops->pullup without
checking whether gadget->connected was previously set.
Make this symmetric to usb_gadget_disconnect by returning
early if gadget->connected is already set.

Cc: stable@vger.kernel.org

Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected")
---
 drivers/usb/gadget/udc/core.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 890f92cb6344..7eeaf7dbb350 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -708,6 +708,9 @@ int usb_gadget_connect(struct usb_gadget *gadget)
 		goto out;
 	}
 
+	if (gadget->connected)
+		goto out;
+
 	if (gadget->deactivated) {
 		/*
 		 * If gadget is deactivated we only save new state.
-- 
2.40.0.348.gf938b09366-goog

Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Greg KH]

On Wed, Apr 05, 2023 at 09:31:32AM +0000, Badhri Jagan Sridharan wrote:
> usb_udc_connect_control does not check to see if the udc
> has already been started. This causes gadget->ops->pullup
> to be called through usb_gadget_connect when invoked
> from usb_udc_vbus_handler even before usb_gadget_udc_start
> is called. Guard this by checking for udc->started in
> usb_udc_connect_control before invoking usb_gadget_connect.
> 
> Guarding udc_connect_control, udc->started and udc->vbus
> with its own mutex as usb_udc_connect_control_locked
> can be simulataneously invoked from different code paths.

You have a full 72 columns, please use them all :)

> 
> Cc: stable@vger.kernel.org
> 
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")

No blank line after cc: stable, and put the fixes above your
signed-off-by line please.

> ---
>  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
> index 3dcbba739db6..890f92cb6344 100644
> --- a/drivers/usb/gadget/udc/core.c
> +++ b/drivers/usb/gadget/udc/core.c
> @@ -56,6 +56,8 @@ static LIST_HEAD(udc_list);
>  /* Protects udc_list, udc->driver, driver->is_bound, and related calls */
>  static DEFINE_MUTEX(udc_lock);
>  
> +/* Protects udc->vbus, udc-started and udc_connect_control_locked */
> +static DEFINE_MUTEX(udc_connect_control_lock);

Why a global lock?  Shouldn't this be a per-device lock?


>  /* ------------------------------------------------------------------------- */
>  
>  /**
> @@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
>  
>  /* ------------------------------------------------------------------------- */
>  
> -static void usb_udc_connect_control(struct usb_udc *udc)
> +/* Acquire udc_connect_control_lock before calling this function. */
> +static void usb_udc_connect_control_locked(struct usb_udc *udc)
>  {
> -	if (udc->vbus)
> +	if (udc->vbus && udc->started)
>  		usb_gadget_connect(udc->gadget);
>  	else
>  		usb_gadget_disconnect(udc->gadget);
> @@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
>  {
>  	struct usb_udc *udc = gadget->udc;
>  
> +	mutex_lock(&udc_connect_control_lock);
>  	if (udc) {
>  		udc->vbus = status;
> -		usb_udc_connect_control(udc);
> +		usb_udc_connect_control_locked(udc);
>  	}
> +	mutex_unlock(&udc_connect_control_lock);
>  }
>  EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
>  
> @@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>  {
>  	int ret;
>  
> +	mutex_lock(&udc_connect_control_lock);
>  	if (udc->started) {
>  		dev_err(&udc->dev, "UDC had already started\n");
> +		mutex_unlock(&udc_connect_control_lock);
>  		return -EBUSY;
>  	}
>  
>  	ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
>  	if (!ret)
>  		udc->started = true;
> +	usb_udc_connect_control_locked(udc);
> +	mutex_unlock(&udc_connect_control_lock);
>  
>  	return ret;
>  }
> @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>   */
>  static inline void usb_gadget_udc_stop(struct usb_udc *udc)
>  {
> +	mutex_lock(&udc_connect_control_lock);
>  	if (!udc->started) {
>  		dev_err(&udc->dev, "UDC had already stopped\n");
> +		mutex_unlock(&udc_connect_control_lock);
>  		return;
>  	}
>  
>  	udc->gadget->ops->udc_stop(udc->gadget);
>  	udc->started = false;
> +	usb_udc_connect_control_locked(udc);
> +	mutex_unlock(&udc_connect_control_lock);
>  }
>  
>  /**
> @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
>  	if (ret)
>  		goto err_start;
>  	usb_gadget_enable_async_callbacks(udc);
> -	usb_udc_connect_control(udc);

Why drop this call here?

thanks,

greg k-h

Re: [PATCH v1 2/2] usb: gadget: udc: core: Prevent redundant calls to pullup

[Greg KH]

On Wed, Apr 05, 2023 at 09:31:33AM +0000, Badhri Jagan Sridharan wrote:
> usb_gadget_connect calls gadget->ops->pullup without
> checking whether gadget->connected was previously set.
> Make this symmetric to usb_gadget_disconnect by returning
> early if gadget->connected is already set.
> 
> Cc: stable@vger.kernel.org
> 
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected")

Same changelog comment as before.

> ---
>  drivers/usb/gadget/udc/core.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
> index 890f92cb6344..7eeaf7dbb350 100644
> --- a/drivers/usb/gadget/udc/core.c
> +++ b/drivers/usb/gadget/udc/core.c
> @@ -708,6 +708,9 @@ int usb_gadget_connect(struct usb_gadget *gadget)
>  		goto out;
>  	}
>  
> +	if (gadget->connected)
> +		goto out;
> +

What prevents this connected value from changing right after you check
this?

thanks,

greg k-h

Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Alan Stern]

On Wed, Apr 05, 2023 at 09:31:32AM +0000, Badhri Jagan Sridharan wrote:
> usb_udc_connect_control does not check to see if the udc
> has already been started. This causes gadget->ops->pullup
> to be called through usb_gadget_connect when invoked
> from usb_udc_vbus_handler even before usb_gadget_udc_start
> is called. Guard this by checking for udc->started in
> usb_udc_connect_control before invoking usb_gadget_connect.
> 
> Guarding udc_connect_control, udc->started and udc->vbus
> with its own mutex as usb_udc_connect_control_locked
> can be simulataneously invoked from different code paths.
> 
> Cc: stable@vger.kernel.org
> 
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")

There's a problem with this patch.

> ---
>  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
> index 3dcbba739db6..890f92cb6344 100644
> --- a/drivers/usb/gadget/udc/core.c
> +++ b/drivers/usb/gadget/udc/core.c

> @@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>  {
>  	int ret;
>  
> +	mutex_lock(&udc_connect_control_lock);
>  	if (udc->started) {
>  		dev_err(&udc->dev, "UDC had already started\n");
> +		mutex_unlock(&udc_connect_control_lock);
>  		return -EBUSY;
>  	}
>  
>  	ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
>  	if (!ret)
>  		udc->started = true;
> +	usb_udc_connect_control_locked(udc);
> +	mutex_unlock(&udc_connect_control_lock);

You moved the connect_control call up here, into usb_gadget_udc_start().

>  	return ret;
>  }
> @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>   */
>  static inline void usb_gadget_udc_stop(struct usb_udc *udc)
>  {
> +	mutex_lock(&udc_connect_control_lock);
>  	if (!udc->started) {
>  		dev_err(&udc->dev, "UDC had already stopped\n");
> +		mutex_unlock(&udc_connect_control_lock);
>  		return;
>  	}
>  
>  	udc->gadget->ops->udc_stop(udc->gadget);
>  	udc->started = false;
> +	usb_udc_connect_control_locked(udc);
> +	mutex_unlock(&udc_connect_control_lock);
>  }
>  
>  /**
> @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
>  	if (ret)
>  		goto err_start;
>  	usb_gadget_enable_async_callbacks(udc);
> -	usb_udc_connect_control(udc);

This is where it used to be.

The problem is that in the gadget_bind_driver pathway, 
usb_gadget_enable_async_callbacks() has to run _before_ the gadget 
connects.  Maybe you can fix this by leaving the function call in its 
original location and protecting it with the new mutex?

There may be a similar problem with disconnecting and the 
gadget_unbind_driver pathway (usb_gadget_disable_async_callbacks() has to 
run _after_ the disconnect occurs).  I haven't tried to follow the patch 
in enough detail to see whether that's an issue.

Alan Stern

>  
>  	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
>  	return 0;
> 
> base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
> -- 
> 2.40.0.348.gf938b09366-goog
> 

[PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Badhri Jagan Sridharan]

usb_udc_connect_control does not check to see if the udc
has already been started. This causes gadget->ops->pullup
to be called through usb_gadget_connect when invoked
from usb_udc_vbus_handler even before usb_gadget_udc_start
is called. Guard this by checking for udc->started in
usb_udc_connect_control before invoking usb_gadget_connect.

Guarding udc_connect_control, udc->started and udc->vbus
with its own mutex as usb_udc_connect_control_locked
can be simulataneously invoked from different code paths.

Cc: stable@vger.kernel.org

Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
---
 drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index 3dcbba739db6..890f92cb6344 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -56,6 +56,8 @@ static LIST_HEAD(udc_list);
 /* Protects udc_list, udc->driver, driver->is_bound, and related calls */
 static DEFINE_MUTEX(udc_lock);
 
+/* Protects udc->vbus, udc-started and udc_connect_control_locked */
+static DEFINE_MUTEX(udc_connect_control_lock);
 /* ------------------------------------------------------------------------- */
 
 /**
@@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
 
 /* ------------------------------------------------------------------------- */
 
-static void usb_udc_connect_control(struct usb_udc *udc)
+/* Acquire udc_connect_control_lock before calling this function. */
+static void usb_udc_connect_control_locked(struct usb_udc *udc)
 {
-	if (udc->vbus)
+	if (udc->vbus && udc->started)
 		usb_gadget_connect(udc->gadget);
 	else
 		usb_gadget_disconnect(udc->gadget);
@@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
 {
 	struct usb_udc *udc = gadget->udc;
 
+	mutex_lock(&udc_connect_control_lock);
 	if (udc) {
 		udc->vbus = status;
-		usb_udc_connect_control(udc);
+		usb_udc_connect_control_locked(udc);
 	}
+	mutex_unlock(&udc_connect_control_lock);
 }
 EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
 
@@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
 {
 	int ret;
 
+	mutex_lock(&udc_connect_control_lock);
 	if (udc->started) {
 		dev_err(&udc->dev, "UDC had already started\n");
+		mutex_unlock(&udc_connect_control_lock);
 		return -EBUSY;
 	}
 
 	ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
 	if (!ret)
 		udc->started = true;
+	usb_udc_connect_control_locked(udc);
+	mutex_unlock(&udc_connect_control_lock);
 
 	return ret;
 }
@@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
  */
 static inline void usb_gadget_udc_stop(struct usb_udc *udc)
 {
+	mutex_lock(&udc_connect_control_lock);
 	if (!udc->started) {
 		dev_err(&udc->dev, "UDC had already stopped\n");
+		mutex_unlock(&udc_connect_control_lock);
 		return;
 	}
 
 	udc->gadget->ops->udc_stop(udc->gadget);
 	udc->started = false;
+	usb_udc_connect_control_locked(udc);
+	mutex_unlock(&udc_connect_control_lock);
 }
 
 /**
@@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
 	if (ret)
 		goto err_start;
 	usb_gadget_enable_async_callbacks(udc);
-	usb_udc_connect_control(udc);
 
 	kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
 	return 0;

base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
-- 
2.40.0.348.gf938b09366-goog

Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Badhri Jagan Sridharan]

Apologies resent V1 again instead of V2. Have sent V2 for real.


On Wed, Apr 5, 2023 at 11:19 PM Badhri Jagan Sridharan
<badhri@google.com> wrote:
>
> usb_udc_connect_control does not check to see if the udc
> has already been started. This causes gadget->ops->pullup
> to be called through usb_gadget_connect when invoked
> from usb_udc_vbus_handler even before usb_gadget_udc_start
> is called. Guard this by checking for udc->started in
> usb_udc_connect_control before invoking usb_gadget_connect.
>
> Guarding udc_connect_control, udc->started and udc->vbus
> with its own mutex as usb_udc_connect_control_locked
> can be simulataneously invoked from different code paths.
>
> Cc: stable@vger.kernel.org
>
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
> ---
>  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
> index 3dcbba739db6..890f92cb6344 100644
> --- a/drivers/usb/gadget/udc/core.c
> +++ b/drivers/usb/gadget/udc/core.c
> @@ -56,6 +56,8 @@ static LIST_HEAD(udc_list);
>  /* Protects udc_list, udc->driver, driver->is_bound, and related calls */
>  static DEFINE_MUTEX(udc_lock);
>
> +/* Protects udc->vbus, udc-started and udc_connect_control_locked */
> +static DEFINE_MUTEX(udc_connect_control_lock);
>  /* ------------------------------------------------------------------------- */
>
>  /**
> @@ -1078,9 +1080,10 @@ EXPORT_SYMBOL_GPL(usb_gadget_set_state);
>
>  /* ------------------------------------------------------------------------- */
>
> -static void usb_udc_connect_control(struct usb_udc *udc)
> +/* Acquire udc_connect_control_lock before calling this function. */
> +static void usb_udc_connect_control_locked(struct usb_udc *udc)
>  {
> -       if (udc->vbus)
> +       if (udc->vbus && udc->started)
>                 usb_gadget_connect(udc->gadget);
>         else
>                 usb_gadget_disconnect(udc->gadget);
> @@ -1099,10 +1102,12 @@ void usb_udc_vbus_handler(struct usb_gadget *gadget, bool status)
>  {
>         struct usb_udc *udc = gadget->udc;
>
> +       mutex_lock(&udc_connect_control_lock);
>         if (udc) {
>                 udc->vbus = status;
> -               usb_udc_connect_control(udc);
> +               usb_udc_connect_control_locked(udc);
>         }
> +       mutex_unlock(&udc_connect_control_lock);
>  }
>  EXPORT_SYMBOL_GPL(usb_udc_vbus_handler);
>
> @@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>  {
>         int ret;
>
> +       mutex_lock(&udc_connect_control_lock);
>         if (udc->started) {
>                 dev_err(&udc->dev, "UDC had already started\n");
> +               mutex_unlock(&udc_connect_control_lock);
>                 return -EBUSY;
>         }
>
>         ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
>         if (!ret)
>                 udc->started = true;
> +       usb_udc_connect_control_locked(udc);
> +       mutex_unlock(&udc_connect_control_lock);
>
>         return ret;
>  }
> @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
>   */
>  static inline void usb_gadget_udc_stop(struct usb_udc *udc)
>  {
> +       mutex_lock(&udc_connect_control_lock);
>         if (!udc->started) {
>                 dev_err(&udc->dev, "UDC had already stopped\n");
> +               mutex_unlock(&udc_connect_control_lock);
>                 return;
>         }
>
>         udc->gadget->ops->udc_stop(udc->gadget);
>         udc->started = false;
> +       usb_udc_connect_control_locked(udc);
> +       mutex_unlock(&udc_connect_control_lock);
>  }
>
>  /**
> @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
>         if (ret)
>                 goto err_start;
>         usb_gadget_enable_async_callbacks(udc);
> -       usb_udc_connect_control(udc);
>
>         kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
>         return 0;
>
> base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
> --
> 2.40.0.348.gf938b09366-goog
>

Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Greg KH]

On Thu, Apr 06, 2023 at 06:19:04AM +0000, Badhri Jagan Sridharan wrote:
> usb_udc_connect_control does not check to see if the udc
> has already been started. This causes gadget->ops->pullup
> to be called through usb_gadget_connect when invoked
> from usb_udc_vbus_handler even before usb_gadget_udc_start
> is called. Guard this by checking for udc->started in
> usb_udc_connect_control before invoking usb_gadget_connect.
> 
> Guarding udc_connect_control, udc->started and udc->vbus
> with its own mutex as usb_udc_connect_control_locked
> can be simulataneously invoked from different code paths.
> 
> Cc: stable@vger.kernel.org
> 
> Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
> ---
>  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)

Why resend v1 when it's been reviewed already?

confused,

greg k-h

Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Badhri Jagan Sridharan]

On Wed, Apr 5, 2023 at 11:29 PM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Thu, Apr 06, 2023 at 06:19:04AM +0000, Badhri Jagan Sridharan wrote:
> > usb_udc_connect_control does not check to see if the udc
> > has already been started. This causes gadget->ops->pullup
> > to be called through usb_gadget_connect when invoked
> > from usb_udc_vbus_handler even before usb_gadget_udc_start
> > is called. Guard this by checking for udc->started in
> > usb_udc_connect_control before invoking usb_gadget_connect.
> >
> > Guarding udc_connect_control, udc->started and udc->vbus
> > with its own mutex as usb_udc_connect_control_locked
> > can be simulataneously invoked from different code paths.
> >
> > Cc: stable@vger.kernel.org
> >
> > Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> > Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
> > ---
> >  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
> >  1 file changed, 16 insertions(+), 4 deletions(-)
>
> Why resend v1 when it's been reviewed already?

I just now sent a note.
Apologies resent V1 again instead of V2. Have sent V2 for real.
Sorry for the confusion.

>
> confused,
>
> greg k-h

Re: [PATCH v1 1/2] usb: gadget: udc: core: Invoke usb_gadget_connect only when started

[Badhri Jagan Sridharan]

> No blank line after cc: stable, and put the fixes above your
signed-off-by line please.

Fixed all commit message related concerns.

> Why a global lock?  Shouldn't this be a per-device lock?

Ack ! Addressed this in V2.

On Wed, Apr 5, 2023 at 6:29 PM Alan Stern <stern@rowland.harvard.edu> wrote:
>
> On Wed, Apr 05, 2023 at 09:31:32AM +0000, Badhri Jagan Sridharan wrote:
> > usb_udc_connect_control does not check to see if the udc
> > has already been started. This causes gadget->ops->pullup
> > to be called through usb_gadget_connect when invoked
> > from usb_udc_vbus_handler even before usb_gadget_udc_start
> > is called. Guard this by checking for udc->started in
> > usb_udc_connect_control before invoking usb_gadget_connect.
> >
> > Guarding udc_connect_control, udc->started and udc->vbus
> > with its own mutex as usb_udc_connect_control_locked
> > can be simulataneously invoked from different code paths.
> >
> > Cc: stable@vger.kernel.org
> >
> > Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> > Fixes: 628ef0d273a6 ("usb: udc: add usb_udc_vbus_handler")
>
> There's a problem with this patch.
>
> > ---
> >  drivers/usb/gadget/udc/core.c | 20 ++++++++++++++++----
> >  1 file changed, 16 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
> > index 3dcbba739db6..890f92cb6344 100644
> > --- a/drivers/usb/gadget/udc/core.c
> > +++ b/drivers/usb/gadget/udc/core.c
>
> > @@ -1140,14 +1145,18 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
> >  {
> >       int ret;
> >
> > +     mutex_lock(&udc_connect_control_lock);
> >       if (udc->started) {
> >               dev_err(&udc->dev, "UDC had already started\n");
> > +             mutex_unlock(&udc_connect_control_lock);
> >               return -EBUSY;
> >       }
> >
> >       ret = udc->gadget->ops->udc_start(udc->gadget, udc->driver);
> >       if (!ret)
> >               udc->started = true;
> > +     usb_udc_connect_control_locked(udc);
> > +     mutex_unlock(&udc_connect_control_lock);
>
> You moved the connect_control call up here, into usb_gadget_udc_start().

Have moved it back into gadget_bind_driver.

>
> >       return ret;
> >  }
> > @@ -1165,13 +1174,17 @@ static inline int usb_gadget_udc_start(struct usb_udc *udc)
> >   */
> >  static inline void usb_gadget_udc_stop(struct usb_udc *udc)
> >  {
> > +     mutex_lock(&udc_connect_control_lock);
> >       if (!udc->started) {
> >               dev_err(&udc->dev, "UDC had already stopped\n");
> > +             mutex_unlock(&udc_connect_control_lock);
> >               return;
> >       }
> >
> >       udc->gadget->ops->udc_stop(udc->gadget);
> >       udc->started = false;
> > +     usb_udc_connect_control_locked(udc);
> > +     mutex_unlock(&udc_connect_control_lock);
> >  }
> >
> >  /**
> > @@ -1527,7 +1540,6 @@ static int gadget_bind_driver(struct device *dev)
> >       if (ret)
> >               goto err_start;
> >       usb_gadget_enable_async_callbacks(udc);
> > -     usb_udc_connect_control(udc);
>
> This is where it used to be.
>
> The problem is that in the gadget_bind_driver pathway,
> usb_gadget_enable_async_callbacks() has to run _before_ the gadget
> connects.  Maybe you can fix this by leaving the function call in its
> original location and protecting it with the new mutex?
>
> There may be a similar problem with disconnecting and the
> gadget_unbind_driver pathway (usb_gadget_disable_async_callbacks() has to
> run _after_ the disconnect occurs).  I haven't tried to follow the patch
> in enough detail to see whether that's an issue.

Thanks for explaining what's the expectation here. I have incorporated
the feedback in v2.
The new lock now additionally guards  gadget->connect and gadget->deactivate as
well. Guarding all with the new lock as they are related to one another.
I have made sure that the gadget_bind_driver and gadget_unbind_driver
sequence remains unaltered.

>
> Alan Stern
>
> >
> >       kobject_uevent(&udc->dev.kobj, KOBJ_CHANGE);
> >       return 0;
> >
> > base-commit: d629c0e221cd99198b843d8351a0a9bfec6c0423
> > --
> > 2.40.0.348.gf938b09366-goog
> >

Re: [PATCH v1 2/2] usb: gadget: udc: core: Prevent redundant calls to pullup

[Badhri Jagan Sridharan]

On Wed, Apr 5, 2023 at 10:16 AM Greg KH <gregkh@linuxfoundation.org> wrote:
>
> On Wed, Apr 05, 2023 at 09:31:33AM +0000, Badhri Jagan Sridharan wrote:
> > usb_gadget_connect calls gadget->ops->pullup without
> > checking whether gadget->connected was previously set.
> > Make this symmetric to usb_gadget_disconnect by returning
> > early if gadget->connected is already set.
> >
> > Cc: stable@vger.kernel.org
> >
> > Signed-off-by: Badhri Jagan Sridharan <badhri@google.com>
> > Fixes: 5a1da544e572 ("usb: gadget: core: do not try to disconnect gadget if it is not connected")
>
> Same changelog comment as before.
Thanks for the feedback Greg ! Have fixed it in v2.

>
> > ---
> >  drivers/usb/gadget/udc/core.c | 3 +++
> >  1 file changed, 3 insertions(+)
> >
> > diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
> > index 890f92cb6344..7eeaf7dbb350 100644
> > --- a/drivers/usb/gadget/udc/core.c
> > +++ b/drivers/usb/gadget/udc/core.c
> > @@ -708,6 +708,9 @@ int usb_gadget_connect(struct usb_gadget *gadget)
> >               goto out;
> >       }
> >
> > +     if (gadget->connected)
> > +             goto out;
> > +
>
> What prevents this connected value from changing right after you check
> this?

Nothing in V1 :) However, in v2, the newly introduced mutex guards
gadget->connected
as well.

>
> thanks,
>
> greg k-h