From: Peter Chen <peter.chen@kernel.org>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Felipe Balbi <balbi@kernel.org>,
USB mailing list <linux-usb@vger.kernel.org>
Subject: Re: Disconnect race in Gadget core
Date: Wed, 12 May 2021 17:37:48 +0800 [thread overview]
Message-ID: <20210512093748.GA17479@nchen> (raw)
In-Reply-To: <20210511191538.GC908414@rowland.harvard.edu>
On 21-05-11 15:15:38, Alan Stern wrote:
> On Tue, May 11, 2021 at 10:53:22AM +0800, Peter Chen wrote:
> > Hi Alan,
> >
> > I fixed a similar issue for configfs, see 1a1c851bbd70
> > ("usb: gadget: configfs: fix concurrent issue between composite APIs")
>
> Yes, I see. That is indeed the very same problem.
>
> > It doesn't prevent disconnect callback, the disconnect callback will check
> > if unbind has called. The same for .setup and .suspend. Did you see
> > issues using configfs or legacy gadget? For legacy gadget, just like you said
> > it is the second disconnect callback is called during the removal process,
> > the first is called at usb_gadget_disconnect. It is not easy to prevent disconnect
> > occurring, we could add some logic at composite_disconnect, and let it quit if it is
> > called the second time.
>
> I haven't seen the race occur in operation. It was only theoretical; I
> noticed it while thinking about one of the commits that was just merged
> into the -stable kernels.
>
> > It is hard to avoid usb_gadget_driver callback until usb_gadget_udc_stop has called,
> > no matter bad hardware or threaded interrupts, my former solution is avoid
> > dereferenced pointer issue, most of callbacks handling are useless if the gadget has already
> > unbind, the only meaningful callback is disconnect, and we have already called it
> > at usb_gadget_disconnect
>
> Agreed.
>
> I suppose we could do something similar for the composite driver, for
> gadgets that don't use configfs.
Originally, I intended to do at composite.c to cover all gadget drivers, but
I can't find a good way to use usb_composite_dev existing spinlock to do that.
Since most of users already used configfs, I chose to fix it at configfs directly.
If we want to fix it for legacy gadget drivers (drivers at drivers/usb/gadget/legacy/).
For .setup & .suspend, we could delay 10ms after usb_gadget_disconnect, ensure
hardware has triggered related interrupt, and we need to let all UDC drivers to
add udc->gadget->irq, in that case, the pending threaded interrupt will be handled
at synchronize_irq at usb_gadget_remove_driver.
For .disconnect, we could use cdev->config to judge if the first .disconnect
has run.
> But what about legacy gadgets? Are
> there any still around that don't use either configfs or the composite
> framework?
I only find raw_gadget.c that doesn't use composite framework, and it doesn't implement
many usb_gadget_driver callbacks, eg, .disconnect and .suspend. For .setup, we could
use above solutions for legacy composite driver.
--
Thanks,
Peter Chen
next prev parent reply other threads:[~2021-05-12 9:37 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-10 15:24 Disconnect race in Gadget core Alan Stern
2021-05-10 16:43 ` Felipe Balbi
2021-05-10 19:38 ` Alan Stern
2021-05-11 2:53 ` Peter Chen
2021-05-11 19:15 ` Alan Stern
2021-05-12 9:37 ` Peter Chen [this message]
2021-05-12 9:41 ` Felipe Balbi
2021-05-12 19:33 ` Alan Stern
2021-05-11 8:22 ` Felipe Balbi
2021-05-11 21:26 ` Alan Stern
2021-05-12 7:00 ` Felipe Balbi
2021-05-12 15:33 ` Alan Stern
2021-05-14 7:35 ` Felipe Balbi
2021-05-14 16:58 ` Alan Stern
2021-05-15 6:41 ` Felipe Balbi
2021-05-15 15:31 ` Alan Stern
2021-05-16 9:43 ` Felipe Balbi
2021-05-16 14:51 ` Alan Stern
2021-05-17 2:00 ` Peter Chen
2021-05-17 5:33 ` Felipe Balbi
2021-05-17 5:35 ` Felipe Balbi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210512093748.GA17479@nchen \
--to=peter.chen@kernel.org \
--cc=balbi@kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).