From patchwork Thu Apr 24 08:44:28 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrei Kuchynski X-Patchwork-Id: 884286 Received: from mail-ej1-f46.google.com (mail-ej1-f46.google.com [209.85.218.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 44E92214A7D for ; Thu, 24 Apr 2025 08:44:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.46 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745484284; cv=none; b=E/aZ5jgM214PMZyRlF8rDpQiUavPoeMsiJ/gz7oDDUO0oHZ0SW2B506cY1TZFTbmIsZa+HgogBksCrWTDLDpjYjl8HF9W6mZisd/y3MGondoPB2yHv7gwvecrq2NpwcKANgVfLhfDcJN3Yaa3R8KrgYaUB/zyKbL89xRmDl9B3c= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745484284; c=relaxed/simple; bh=BCkwPiQJglWzF5ly3aXp13rahJGuza6cE4lQQ1R0SWQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AGCvLpSTVXMd8e9A+pEIHqaotWpw2KUdmXgDxWt3SidYG2T6EjNIWEu+slAB+XSFCPNsjsBH/+m70IAad8IRctGNq859mNrnXYYCxLqyd8J5gJTc7wWiG2/Cu7c5zytWQy9D+aHmoLNDXiB/Q740LtGt/vRpkOA7QOWrPzdyK4k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=Le1+fHVl; arc=none smtp.client-ip=209.85.218.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="Le1+fHVl" Received: by mail-ej1-f46.google.com with SMTP id a640c23a62f3a-acbb85ce788so155044666b.3 for ; Thu, 24 Apr 2025 01:44:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1745484279; x=1746089079; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=W64t7hrZYe3BMLaCDCRTPaqOT9dK6NO9YovOiyyQLrs=; b=Le1+fHVlsNMdfwVoqdVWZPX10WhnLIy86XezKhBqO2kPiqBfW+l8boU9YA5e0RQY4c X2sUCG9nkhP9ASGpeIA9NGYVTiY68jL3XY3aiAHXID3QiywH0dOdw+jzmRetrf6rUUXT x6MNO/12vzfZ7gz0hchoAAtA4gLf+zPUiFq3Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1745484279; x=1746089079; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=W64t7hrZYe3BMLaCDCRTPaqOT9dK6NO9YovOiyyQLrs=; b=sCDWTRYkqtbgmPQ8ZcAvHlJMSihDBF3sJm8ePah1y19RRq+EH+74bnk7iFVzDmADQt XLcIOKZZKM2OSdvfQoQrwJkMBcvRgqsvxwRAJSLmwLCLG1eRKOQ+SVYWbalF2EU2YoXH n0r4uHGt6WJ5I5j9j4KwhBwKPZIn7WVAxgMhBtNLKB4mwS9rq0RclVT0x6vBY2gXtmBj IW5EZKpI5TYhYNYg2b/xlXIv3LG2rxtoWCBmI0U7g+We4wyEFAWY7m7wfZiZs/uLtich Ivv/0GPoNfxpOLCQGjSR2onWPJTx1XtTRkZIKn+DJKgc6A6cDH8nHxEhKgyBJNVH0odl Flqw== X-Gm-Message-State: AOJu0YxIW90DDQJ6HEinQfxS1qUVTYkxyQ6vvznI5W9y9kTbZwTM/4AW 3g4Uhv4EuM97TKG5qoBMK3BosM9xQxAWFRvQ7sJ257qV/cpAUQnCzl7eCFBrew== X-Gm-Gg: ASbGncuiyEZSPPJxcAv20c+Qb372hvH99OmP5on4PSXB3g+pAKbbPrDOZLf1V3lJTpC +JFpa4MqIIt2OJHqaw119trNj9cvbMOTGah0uu1T3ZSGKvqUurLeVadZEqiDqzU3sgJmBvWz/P+ KLYYB+wub8F4U5VwcsOklUyiyVihnlRJkNLxsfOgAEzolBGJWjVfoOmkyGLRzb7LDvAokQ0lEqO bqxfn6b1Fls3gG2Ur/c3uYPMWYB46FZPwqNwvjGWWXy87gDKx+5Tt7hsFwVlgWPY+A/8xLRoslM rY5ebTav5TEQyBg17naCaE7NlwYkxj3iymgQtg06RaCQ6+lB8jvKetQPw+VzW9CKrqrwBUpGXqH Dtb7j+C8Kpb5FKFoSu8uRSTVnpSsJo3r/CQ== X-Google-Smtp-Source: AGHT+IEXMMgniGW5dLlSgHFd4dZHP6L/l4pXs8kelOlAcfgxGUbBIWszmIZSLQOD8ZDAW/YII0aPQA== X-Received: by 2002:a17:907:a48:b0:ac6:e327:8de7 with SMTP id a640c23a62f3a-ace573a6ee9mr143333766b.42.1745484279399; Thu, 24 Apr 2025 01:44:39 -0700 (PDT) Received: from akuchynski.c.googlers.com.com (100.246.90.34.bc.googleusercontent.com. [34.90.246.100]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ace59c5eaf0sm69377466b.181.2025.04.24.01.44.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Apr 2025 01:44:38 -0700 (PDT) From: Andrei Kuchynski To: Heikki Krogerus , Greg Kroah-Hartman , Jameson Thies , Abhishek Pandit-Subedi , Benson Leung , Dmitry Baryshkov , Diogo Ivo , Pooja Katiyar , Madhu M Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Andrei Kuchynski , stable@vger.kernel.org Subject: [PATCH v2 1/2] usb: typec: ucsi: displayport: Fix deadlock Date: Thu, 24 Apr 2025 08:44:28 +0000 Message-ID: <20250424084429.3220757-2-akuchynski@chromium.org> X-Mailer: git-send-email 2.49.0.901.g37484f566f-goog In-Reply-To: <20250424084429.3220757-1-akuchynski@chromium.org> References: <20250424084429.3220757-1-akuchynski@chromium.org> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 This patch introduces the ucsi_con_mutex_lock / ucsi_con_mutex_unlock functions to the UCSI driver. ucsi_con_mutex_lock ensures the connector mutex is only locked if a connection is established and the partner pointer is valid. This resolves a deadlock scenario where ucsi_displayport_remove_partner holds con->mutex waiting for dp_altmode_work to complete while dp_altmode_work attempts to acquire it. Cc: stable@vger.kernel.org Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus --- drivers/usb/typec/ucsi/displayport.c | 19 +++++++++------- drivers/usb/typec/ucsi/ucsi.c | 34 ++++++++++++++++++++++++++++ drivers/usb/typec/ucsi/ucsi.h | 2 ++ 3 files changed, 47 insertions(+), 8 deletions(-) diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c index 420af5139c70..acd053d4e38c 100644 --- a/drivers/usb/typec/ucsi/displayport.c +++ b/drivers/usb/typec/ucsi/displayport.c @@ -54,7 +54,8 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo) u8 cur = 0; int ret; - mutex_lock(&dp->con->lock); + if (!ucsi_con_mutex_lock(dp->con)) + return -ENOTCONN; if (!dp->override && dp->initialized) { const struct typec_altmode *p = typec_altmode_get_partner(alt); @@ -100,7 +101,7 @@ static int ucsi_displayport_enter(struct typec_altmode *alt, u32 *vdo) schedule_work(&dp->work); ret = 0; err_unlock: - mutex_unlock(&dp->con->lock); + ucsi_con_mutex_unlock(dp->con); return ret; } @@ -112,7 +113,8 @@ static int ucsi_displayport_exit(struct typec_altmode *alt) u64 command; int ret = 0; - mutex_lock(&dp->con->lock); + if (!ucsi_con_mutex_lock(dp->con)) + return -ENOTCONN; if (!dp->override) { const struct typec_altmode *p = typec_altmode_get_partner(alt); @@ -144,7 +146,7 @@ static int ucsi_displayport_exit(struct typec_altmode *alt) schedule_work(&dp->work); out_unlock: - mutex_unlock(&dp->con->lock); + ucsi_con_mutex_unlock(dp->con); return ret; } @@ -202,20 +204,21 @@ static int ucsi_displayport_vdm(struct typec_altmode *alt, int cmd = PD_VDO_CMD(header); int svdm_version; - mutex_lock(&dp->con->lock); + if (!ucsi_con_mutex_lock(dp->con)) + return -ENOTCONN; if (!dp->override && dp->initialized) { const struct typec_altmode *p = typec_altmode_get_partner(alt); dev_warn(&p->dev, "firmware doesn't support alternate mode overriding\n"); - mutex_unlock(&dp->con->lock); + ucsi_con_mutex_unlock(dp->con); return -EOPNOTSUPP; } svdm_version = typec_altmode_get_svdm_version(alt); if (svdm_version < 0) { - mutex_unlock(&dp->con->lock); + ucsi_con_mutex_unlock(dp->con); return svdm_version; } @@ -259,7 +262,7 @@ static int ucsi_displayport_vdm(struct typec_altmode *alt, break; } - mutex_unlock(&dp->con->lock); + ucsi_con_mutex_unlock(dp->con); return 0; } diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c index e8c7e9dc4930..01ce858a1a2b 100644 --- a/drivers/usb/typec/ucsi/ucsi.c +++ b/drivers/usb/typec/ucsi/ucsi.c @@ -1922,6 +1922,40 @@ void ucsi_set_drvdata(struct ucsi *ucsi, void *data) } EXPORT_SYMBOL_GPL(ucsi_set_drvdata); +/** + * ucsi_con_mutex_lock - Acquire the connector mutex + * @con: The connector interface to lock + * + * Returns true on success, false if the connector is disconnected + */ +bool ucsi_con_mutex_lock(struct ucsi_connector *con) +{ + bool mutex_locked = false; + bool connected = true; + + while (connected && !mutex_locked) { + mutex_locked = mutex_trylock(&con->lock) != 0; + connected = UCSI_CONSTAT(con, CONNECTED); + if (connected && !mutex_locked) + msleep(20); + } + + connected = connected && con->partner; + if (!connected && mutex_locked) + mutex_unlock(&con->lock); + + return connected; +} + +/** + * ucsi_con_mutex_unlock - Release the connector mutex + * @con: The connector interface to unlock + */ +void ucsi_con_mutex_unlock(struct ucsi_connector *con) +{ + mutex_unlock(&con->lock); +} + /** * ucsi_create - Allocate UCSI instance * @dev: Device interface to the PPM (Platform Policy Manager) diff --git a/drivers/usb/typec/ucsi/ucsi.h b/drivers/usb/typec/ucsi/ucsi.h index 3a2c1762bec1..9c5278a0c5d4 100644 --- a/drivers/usb/typec/ucsi/ucsi.h +++ b/drivers/usb/typec/ucsi/ucsi.h @@ -94,6 +94,8 @@ int ucsi_register(struct ucsi *ucsi); void ucsi_unregister(struct ucsi *ucsi); void *ucsi_get_drvdata(struct ucsi *ucsi); void ucsi_set_drvdata(struct ucsi *ucsi, void *data); +bool ucsi_con_mutex_lock(struct ucsi_connector *con); +void ucsi_con_mutex_unlock(struct ucsi_connector *con); void ucsi_connector_change(struct ucsi *ucsi, u8 num); From patchwork Thu Apr 24 08:44:29 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrei Kuchynski X-Patchwork-Id: 884746 Received: from mail-ej1-f41.google.com (mail-ej1-f41.google.com [209.85.218.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A38F9228CA5 for ; Thu, 24 Apr 2025 08:44:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745484285; cv=none; b=YrXM2o7l8Mh3dTFT0tbfcbt8L4MHF9zfu1tpjhc2lMy/ZsyvajzLzKw3hut3xLDO9KZyCaHAvTmlOdJVqLiGN8OmqduMABKeSC7Acs0+8qTi8n3Pdk8MDkN43G6OJJKT/6AJJuWi7pFfCrcqs9vmZcTkKdEyMswZS3o4jvEZr20= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745484285; c=relaxed/simple; bh=CGJ4lb9gLXqwy9cpqFnBRdCu4buMezQ/KMwBM556iLI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VInRzD03swGJT1UACJiAR2y4N4IQNR3tuEzLE6ncAMqDBDSzwabgDHjrF3N5XZkDO1z7LLs54VYead0zk0Ks8QpDEAmIWUWsiO9AQ3+kND/vgFR6EhzX5GpIi9cUyocyPPPuw5HqtOwZwhqbmTm5JQHWuazI0M5MpyRcSHW2sKY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=fiXBQ5fJ; arc=none smtp.client-ip=209.85.218.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="fiXBQ5fJ" Received: by mail-ej1-f41.google.com with SMTP id a640c23a62f3a-ac289147833so137688566b.2 for ; Thu, 24 Apr 2025 01:44:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1745484282; x=1746089082; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=EOV7HKDdI7XaLmmxtuottKdbNPwVla7Cb6o0YW5q+p8=; b=fiXBQ5fJ+bx+VX92/PpxRjo+Zab2gLaqPm8JQ4YVEb/xCbKX05IMX0UDf/H0VOKpPT gGZ52S4WhtDdOzVnLSH/KK7oZnQR2FI0EWG6TACPAWjdIHrwwbv/k3G6zDZfLrAG+QGm shqvvoYEouzfZX67zer2Pa9JM26APdgh/eEI4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1745484282; x=1746089082; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=EOV7HKDdI7XaLmmxtuottKdbNPwVla7Cb6o0YW5q+p8=; b=ikhorMxqgGsTGS1f+DmSM7CgHlhiy5eMuuiQ+6kNepyntnHyL67uNeK9gOWT0mpE/4 RNk76A1gZiDXNZPiGSIi9caEV/SM3HRrAITlqrU2FuX3f6z0D+hLxWUwYKTf68lzZbh5 afoSBILS4ZHA2LLxC/HUToarCBFhBPfQyadkJbJXrYEXhpZNBqmCUQcFJsEaAjRVRaFg WsBYI32l4ZQ7WOIFAC0kOyskTWIi2RHzU57R+vCLCnqKBhBESuj7KNGlf1Ty2UM7n3F4 5wfrdbulNTRtZnG1KD3XJDDybCwOYbOAKKNulPgaCZyxaGGrpQy3riL8bpK4XTX5paIf gBCA== X-Gm-Message-State: AOJu0YxZvUP0hSV14QqLR2wx5DYHh6ZHLRZwIfNimuWYJHd722hkBL0F 7jgMNQrHiOZVtlGgPVjwtjfwUfs+VApRxMFNSNsR3U2pAzM/erMmkgb9iTiTDA== X-Gm-Gg: ASbGncucUXMCUN9+xf1F84pawy3I3QL5CfpZZkR9DKBj6mGJWhy2u9ZyIoj6IS5bb05 RNIaSyKXcWlQGA3tEYAfuR53amd31rrAbaC9f1DA1RIcXjGpkqZ8qJpd+8oXBwTEQ84b2qoJfFG LSQ+13BVa3Yk/E/tqgPUlZWq/5G+rrI0HqKn22pf5I2VRg1+e7leG3ZnL2JFns2pcbvlhVPwr7I J3N2m9tHvJSuzmd1iuaeUPq1HCuVg8Dbd0+rSbUnEHA+1qmnW74/o+HYo7HELBFvfoHYEwZyIOe oc2wYZdtF+uH7AyvElkZ1GSxnE3vOP/WTyiADvVG3pA6R+wc63RaG2wmJ+BCuodkGuIohDN5EVf zYxQIWKOHMfEA7v1l8XSJ0QQj8y7/lxm4ww== X-Google-Smtp-Source: AGHT+IGDweb2ftW6YAhGNzGas4oXbYMlgUSzms8AcDFioP7Y4uwQhnokaPl/3DGk+MA365cjpfU/uw== X-Received: by 2002:a17:906:794e:b0:ace:4fcf:702b with SMTP id a640c23a62f3a-ace5728a3ecmr178033166b.28.1745484281876; Thu, 24 Apr 2025 01:44:41 -0700 (PDT) Received: from akuchynski.c.googlers.com.com (100.246.90.34.bc.googleusercontent.com. [34.90.246.100]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ace59c5eaf0sm69377466b.181.2025.04.24.01.44.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 24 Apr 2025 01:44:41 -0700 (PDT) From: Andrei Kuchynski To: Heikki Krogerus , Greg Kroah-Hartman , Jameson Thies , Abhishek Pandit-Subedi , Benson Leung , Dmitry Baryshkov , Diogo Ivo , Pooja Katiyar , Madhu M Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Andrei Kuchynski , stable@vger.kernel.org Subject: [PATCH v2 2/2] usb: typec: ucsi: displayport: Fix NULL pointer access Date: Thu, 24 Apr 2025 08:44:29 +0000 Message-ID: <20250424084429.3220757-3-akuchynski@chromium.org> X-Mailer: git-send-email 2.49.0.901.g37484f566f-goog In-Reply-To: <20250424084429.3220757-1-akuchynski@chromium.org> References: <20250424084429.3220757-1-akuchynski@chromium.org> Precedence: bulk X-Mailing-List: linux-usb@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before proceeding with the partner removal. Cc: stable@vger.kernel.org Fixes: af8622f6a585 ("usb: typec: ucsi: Support for DisplayPort alt mode") Signed-off-by: Andrei Kuchynski Reviewed-by: Heikki Krogerus --- drivers/usb/typec/ucsi/displayport.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/usb/typec/ucsi/displayport.c b/drivers/usb/typec/ucsi/displayport.c index acd053d4e38c..8aae80b457d7 100644 --- a/drivers/usb/typec/ucsi/displayport.c +++ b/drivers/usb/typec/ucsi/displayport.c @@ -299,6 +299,8 @@ void ucsi_displayport_remove_partner(struct typec_altmode *alt) if (!dp) return; + cancel_work_sync(&dp->work); + dp->data.conf = 0; dp->data.status = 0; dp->initialized = false;