lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 582/717] USB: serial: keyspan_pda: fix write deadlock
    Date
    From: Johan Hovold <johan@kernel.org>

    commit 7353cad7ee4deaefc16e94727e69285563e219f6 upstream.

    The write() callback can be called in interrupt context (e.g. when used
    as a console) so interrupts must be disabled while holding the port lock
    to prevent a possible deadlock.

    Fixes: e81ee637e4ae ("usb-serial: possible irq lock inversion (PPP vs. usb/serial)")
    Fixes: 507ca9bc0476 ("[PATCH] USB: add ability for usb-serial drivers to determine if their write urb is currently being used.")
    Cc: stable <stable@vger.kernel.org> # 2.6.19
    Acked-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
    Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/serial/keyspan_pda.c | 7 ++++---
    1 file changed, 4 insertions(+), 3 deletions(-)

    --- a/drivers/usb/serial/keyspan_pda.c
    +++ b/drivers/usb/serial/keyspan_pda.c
    @@ -443,6 +443,7 @@ static int keyspan_pda_write(struct tty_
    int request_unthrottle = 0;
    int rc = 0;
    struct keyspan_pda_private *priv;
    + unsigned long flags;

    priv = usb_get_serial_port_data(port);
    /* guess how much room is left in the device's ring buffer, and if we
    @@ -462,13 +463,13 @@ static int keyspan_pda_write(struct tty_
    the TX urb is in-flight (wait until it completes)
    the device is full (wait until it says there is room)
    */
    - spin_lock_bh(&port->lock);
    + spin_lock_irqsave(&port->lock, flags);
    if (!test_bit(0, &port->write_urbs_free) || priv->tx_throttled) {
    - spin_unlock_bh(&port->lock);
    + spin_unlock_irqrestore(&port->lock, flags);
    return 0;
    }
    clear_bit(0, &port->write_urbs_free);
    - spin_unlock_bh(&port->lock);
    + spin_unlock_irqrestore(&port->lock, flags);

    /* At this point the URB is in our control, nobody else can submit it
    again (the only sudden transition was the one from EINPROGRESS to

    \
     
     \ /
      Last update: 2020-12-28 16:09    [W:4.115 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site