linux/drivers/usb/musb
Bin Liu 1dc3a068cc usb: musb: fix possible spinlock deadlock
commit bc1e215454 upstream.

The DSPS glue calls del_timer_sync() in its musb_platform_disable()
implementation, which requires the caller to not hold a lock. But
musb_remove() calls musb_platform_disable() will musb->lock held. This
could causes spinlock deadlock.

So change musb_remove() to call musb_platform_disable() without holds
musb->lock. This doesn't impact the musb_platform_disable implementation
in other glue drivers.

root@am335x-evm:~# modprobe -r musb-dsps
[  126.134879] musb-hdrc musb-hdrc.1: remove, state 1
[  126.140465] usb usb2: USB disconnect, device number 1
[  126.146178] usb 2-1: USB disconnect, device number 2
[  126.416985] musb-hdrc musb-hdrc.1: USB bus 2 deregistered
[  126.423943]
[  126.425525] ======================================================
[  126.431997] [ INFO: possible circular locking dependency detected ]
[  126.438564] 4.11.0-rc1-00003-g1557f13bca04-dirty #77 Not tainted
[  126.444852] -------------------------------------------------------
[  126.451414] modprobe/778 is trying to acquire lock:
[  126.456523]  (((&glue->timer))){+.-...}, at: [<c01b8788>] del_timer_sync+0x0/0xd0
[  126.464403]
[  126.464403] but task is already holding lock:
[  126.470511]  (&(&musb->lock)->rlock){-.-...}, at: [<bf30b7f8>] musb_remove+0x50/0x1
30 [musb_hdrc]
[  126.479965]
[  126.479965] which lock already depends on the new lock.
[  126.479965]
[  126.488531]
[  126.488531] the existing dependency chain (in reverse order) is:
[  126.496368]
[  126.496368] -> #1 (&(&musb->lock)->rlock){-.-...}:
[  126.502968]        otg_timer+0x80/0xec [musb_dsps]
[  126.507990]        call_timer_fn+0xb4/0x390
[  126.512372]        expire_timers+0xf0/0x1fc
[  126.516754]        run_timer_softirq+0x80/0x178
[  126.521511]        __do_softirq+0xc4/0x554
[  126.525802]        irq_exit+0xe8/0x158
[  126.529735]        __handle_domain_irq+0x58/0xb8
[  126.534583]        __irq_usr+0x54/0x80
[  126.538507]
[  126.538507] -> #0 (((&glue->timer))){+.-...}:
[  126.544636]        del_timer_sync+0x40/0xd0
[  126.549066]        musb_remove+0x6c/0x130 [musb_hdrc]
[  126.554370]        platform_drv_remove+0x24/0x3c
[  126.559206]        device_release_driver_internal+0x14c/0x1e0
[  126.565225]        bus_remove_device+0xd8/0x108
[  126.569970]        device_del+0x1e4/0x308
[  126.574170]        platform_device_del+0x24/0x8c
[  126.579006]        platform_device_unregister+0xc/0x20
[  126.584394]        dsps_remove+0x14/0x30 [musb_dsps]
[  126.589595]        platform_drv_remove+0x24/0x3c
[  126.594432]        device_release_driver_internal+0x14c/0x1e0
[  126.600450]        driver_detach+0x38/0x6c
[  126.604740]        bus_remove_driver+0x4c/0xa0
[  126.609407]        SyS_delete_module+0x11c/0x1e4
[  126.614252]        __sys_trace_return+0x0/0x10

Fixes: ea2f35c01d ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2017-03-31 10:31:46 +02:00
..
am35x.c usb: musb: am35x: fix error return code in am35x_probe() 2016-09-13 17:20:02 +02:00
blackfin.c usb: musb: blackfin: add bfin_fifo_offset in bfin_ops 2017-01-12 11:39:18 +01:00
blackfin.h usb: musb: drop a gigantic amount of ifdeferry 2011-07-01 14:31:10 -07:00
cppi_dma.c usb: musb: cleanup cppi_dma header 2016-07-17 08:23:57 +09:00
cppi_dma.h usb: musb: cppi41: move struct cppi41_dma_channel to header 2016-07-17 08:23:57 +09:00
da8xx.c usb: musb: da8xx: Remove CPPI 3.0 quirk and methods 2017-03-12 06:41:48 +01:00
davinci.c usb: musb: Set up function pointers for DMA 2015-05-07 13:35:51 -05:00
davinci.h usb: musb: davinci: Fix build breakage 2012-06-04 18:29:42 +03:00
jz4740.c usb: musb: jz4740: fix error check of usb_get_phy() 2016-04-26 14:50:02 -07:00
Kconfig Merge 4.8-rc7 into usb-next 2016-09-19 09:12:41 +02:00
Makefile usb: musb: add tracepoints support for debugging 2016-07-17 08:23:57 +09:00
musb_am335x.c usb: musb: Fix panic upon musb_am335x module removal 2014-06-27 10:53:06 -05:00
musb_core.c usb: musb: fix possible spinlock deadlock 2017-03-31 10:31:46 +02:00
musb_core.h usb: musb: Fix host mode error -71 regression 2017-02-09 08:08:30 +01:00
musb_cppi41.c usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer 2017-03-30 09:41:24 +02:00
musb_debug.h usb: musb: add tracepoints support for debugging 2016-07-17 08:23:57 +09:00
musb_debugfs.c usb: musb: fix runtime PM in debugfs 2017-01-19 20:18:01 +01:00
musb_dma.h usb: musb: Set up function pointers for DMA 2015-05-07 13:35:51 -05:00
musb_dsps.c usb: musb: dsps: implement clear_ep_rxintr() callback 2017-01-12 11:39:09 +01:00
musb_gadget.c usb: musb: Fix PM for hub disconnect 2016-11-17 16:25:39 +01:00
musb_gadget.h usb: musb: add Kconfig options for HOST, GAGDET or DUAL_ROLE modes 2013-05-28 19:22:23 +03:00
musb_gadget_ep0.c usb: musb: switch dev_dbg to tracepoints 2016-07-17 08:23:57 +09:00
musb_host.c usb: musb: core: add clear_ep_rxintr() to musb_platform_ops 2017-01-12 11:39:09 +01:00
musb_host.h usb: musb: fix prototype for musb_port_reset 2013-12-20 15:05:43 -06:00
musb_io.h usb: musb: Make busctl_offset an io-op rather then a define 2015-05-26 10:46:54 -05:00
musb_regs.h usb: musb: Make busctl_offset an io-op rather then a define 2015-05-26 10:46:54 -05:00
musb_trace.c usb: musb: add tracepoints support for debugging 2016-07-17 08:23:57 +09:00
musb_trace.h usb: musb: cppi41: add dma channel tracepoints 2016-07-17 08:23:57 +09:00
musb_virthub.c musb: Export musb_root_disconnect for use in modules 2016-09-22 12:00:21 +02:00
musbhsdma.c usb: musb: switch dev_dbg to tracepoints 2016-07-17 08:23:57 +09:00
musbhsdma.h usb: musb: Fix trying to free already-free IRQ 4 2017-01-12 11:39:18 +01:00
omap2430.c usb: musb: Add missing pm_runtime_disable and drop 2430 PM timeout 2016-11-17 16:25:39 +01:00
omap2430.h usb: start using the control module driver 2013-01-25 12:27:24 +02:00
sunxi.c musb: sunxi: Add support for platform_set_mode 2016-09-13 17:20:02 +02:00
tusb6010.c usb: musb: Fix PM for hub disconnect 2016-11-17 16:25:39 +01:00
tusb6010.h usb: musb: Fix up DMA related macros 2015-05-07 13:35:46 -05:00
tusb6010_omap.c usb: musb: use %pad format string from dma_addr_t 2016-03-04 15:14:30 +02:00
ux500.c usb: musb: ux500: Fix NULL pointer dereference at system PM 2016-02-03 20:03:40 +02:00
ux500_dma.c usb: musb/ux500: remove duplicate check for dma_is_compatible 2016-03-04 15:14:30 +02:00