Commit 1ee2014e authored Nov 02, 2022 by Thinh Nguyen Committed by Zheng Zengkai Nov 02, 2022

usb: dwc3: gadget: Fix event pending check

stable inclusion
from stable-v5.10.132
commit 0e5668ed7b7aaab4a53126daeef0258c5c573d5d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I5YS3T

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0e5668ed7b7aaab4a53126daeef0258c5c573d5d



--------------------------------

commit 7441b273 upstream.

The DWC3_EVENT_PENDING flag is used to protect against invalid call to
top-half interrupt handler, which can occur when there's a delay in
software detection of the interrupt line deassertion.

However, the clearing of this flag was done prior to unmasking the
interrupt line, creating opportunity where the top-half handler can
come. This breaks the serialization and creates a race between the
top-half and bottom-half handler, resulting in losing synchronization
between the controller and the driver when processing events.

To fix this, make sure the clearing of the DWC3_EVENT_PENDING is done at
the end of the bottom-half handler.

Fixes: d325a1de ("usb: dwc3: gadget: Prevent losing events in event cache")
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/8670aaf1cf52e7d1e6df2a827af2d77263b93b75.1656380429.git.Thinh.Nguyen@synopsys.com


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>
Acked-by: Xie XiuQi <xiexiuqi@huawei.com>

parent 9a435b2d

drivers/usb/dwc3/gadget.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -3781,7 +3781,6 @@ static irqreturn_t dwc3_process_event_buf(struct dwc3_event_buffer *evt)
	}		}

	evt->count = 0;		evt->count = 0;
	evt->flags &= ~DWC3_EVENT_PENDING;
	ret = IRQ_HANDLED;		ret = IRQ_HANDLED;

	/* Unmask interrupt */		/* Unmask interrupt */
	@@ -3794,6 +3793,9 @@ static irqreturn_t dwc3_process_event_buf(struct dwc3_event_buffer *evt)
	dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), dwc->imod_interval);		dwc3_writel(dwc->regs, DWC3_DEV_IMOD(0), dwc->imod_interval);
	}		}

			/* Keep the clearing of DWC3_EVENT_PENDING at the end */
			evt->flags &= ~DWC3_EVENT_PENDING;

	return ret;		return ret;
	}		}