usb: gadget: f_fs: Fix possible deadlock

This is to fix a possible deadlock while running "stop adbd" in debug console.
To fix the issue we release ffs_lock before we invoke unregister_gadget_item.

[  143.043467] adbd/170 is trying to acquire lock:
[  143.047988]  (udc_lock){+.+.+.}, at: [<ffffffc00077ef40>] usb_gadget_unregis0
[  143.056802]
[  143.056802] but task is already holding lock:
[  143.062625]  (ffs_lock){+.+.+.}, at: [<ffffffc000788374>] ffs_data_clear+0x34
[  143.070220]
[  143.070220] which lock already depends on the new lock.
[  143.070220]
[  143.078386]
[  143.078386] the existing dependency chain (in reverse order) is:
[  143.085857]
-> #1 (ffs_lock){+.+.+.}:
[  143.089716]        [<ffffffc00025ab14>] __lock_acquire+0x15bc/0x191c
[  143.096071]        [<ffffffc00025b5f8>] lock_acquire+0xec/0x128
[  143.101989]        [<ffffffc000a7ecec>] mutex_lock_nested+0x58/0x354
[  143.108345]        [<ffffffc000788748>] ffs_func_bind+0x3c/0x5c8
[  143.114349]        [<ffffffc00077a85c>] usb_add_function+0x54/0xe4
[  143.120529]        [<ffffffc00077d1a4>] configfs_composite_bind+0x278/0x30c
[  143.127488]        [<ffffffc00077e6cc>] udc_bind_to_driver+0x34/0xe0
[  143.133840]        [<ffffffc00077ee40>] udc_attach_driver+0x80/0xa8
[  143.140107]        [<ffffffc00077dbb8>] gadget_dev_desc_UDC_store+0x9c/0xe4
[  143.147066]        [<ffffffc00077b8c8>] gadget_info_attr_store+0x1c/0x30
[  143.153765]        [<ffffffc00036f934>] configfs_write_file+0xe4/0x128
[  143.160293]        [<ffffffc00030c6f0>] vfs_write+0xb8/0x194
[  143.165951]        [<ffffffc00030c894>] SyS_write+0x44/0x84
[  143.171523]        [<ffffffc0002033ec>] el0_svc_naked+0x20/0x28
[  143.177443]
-> #0 (udc_lock){+.+.+.}:
[  143.181303]        [<ffffffc000256c10>] print_circular_bug+0x64/0x2d8
[  143.187743]        [<ffffffc00025a7fc>] __lock_acquire+0x12a4/0x191c
[  143.194094]        [<ffffffc00025b5f8>] lock_acquire+0xec/0x128
[  143.200011]        [<ffffffc000a7ecec>] mutex_lock_nested+0x58/0x354
[  143.206364]        [<ffffffc00077ef3c>] usb_gadget_unregister_driver+0x34/0x0
[  143.213583]        [<ffffffc00077daf4>] unregister_gadget+0x20/0x48
[  143.219849]        [<ffffffc00077e1cc>] unregister_gadget_item+0x8/0x14
[  143.226461]        [<ffffffc0007883b4>] ffs_data_clear+0x78/0xf4
[  143.232464]        [<ffffffc000788640>] ffs_data_closed+0x34/0x8c
[  143.238557]        [<ffffffc0007886c4>] ffs_epfile_release+0x10/0x20
[  143.244907]        [<ffffffc00030d730>] __fput+0xf0/0x1a8
[  143.250305]        [<ffffffc00030d83c>] ____fput+0x8/0x14
[  143.255701]        [<ffffffc000236ba4>] task_work_run+0xa8/0xcc
[  143.261621]        [<ffffffc00021f4f4>] do_exit+0x3f8/0x8d0
[  143.267195]        [<ffffffc00021fa6c>] do_group_exit+0x70/0xd4
[  143.273114]        [<ffffffc00022a7cc>] get_signal+0x540/0x578
[  143.278946]        [<ffffffc00020685c>] do_signal+0x98/0x4a8
[  143.284605]        [<ffffffc000206e44>] do_notify_resume+0x14/0x5c
[  143.290784]        [<ffffffc000203308>] work_pending+0x18/0x20
[  143.296616]
[  143.296616] other info that might help us debug this:
[  143.296616]
[  143.304609]  Possible unsafe locking scenario:
[  143.304609]
[  143.310519]        CPU0                    CPU1
[  143.315039]        ----                    ----
[  143.319558]   lock(ffs_lock);
[  143.322533]                                lock(udc_lock);
[  143.328022]                                lock(ffs_lock);
[  143.333514]   lock(udc_lock);
[  143.336488]
[  143.336488]  *** DEADLOCK ***

Bug 200133533
Bug 200153616

Change-Id: Ifdb97edce079e423301972c28320379888590bc1
Signed-off-by: Jim Lin <jilin@nvidia.com>
Reviewed-on: http://git-master/r/842784
Reviewed-on: http://git-master/r/1165724
GVS: Gerrit_Virtual_Submit
Reviewed-by: Mark Kuo <mkuo@nvidia.com>
Tested-by: Mark Kuo <mkuo@nvidia.com>
Reviewed-by: ChihMin Cheng <ccheng@nvidia.com>
Reviewed-by: Ashutosh Jha <ajha@nvidia.com>

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 2a2f52524dfe6453b521493b8810f7ca944bbfce..44329d39beaba601aa774be72cca4a18e5d82551 100644 (file)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3445,6 +3445,7 @@ static void ffs_closed(struct ffs_data *ffs)
 {
        struct ffs_dev *ffs_obj;
        struct f_fs_opts *opts;
+       struct config_item *ci_parent;
 
        ENTER();
        ffs_dev_lock();
@@ -3468,8 +3469,12 @@ static void ffs_closed(struct ffs_data *ffs)
            || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount))
                goto done;
 
-       unregister_gadget_item(ffs_obj->opts->
-                              func_inst.group.cg_item.ci_parent->ci_parent);
+       ci_parent = ffs_obj->opts->func_inst.group.cg_item.ci_parent->ci_parent;
+       ffs_dev_unlock();
+
+       unregister_gadget_item(ci_parent);
+       return;
+
 done:
        ffs_dev_unlock();
 }