[PATCH] usb: gadget: dummy_hcd: fix IRQs-disabled violation in dummy_timer()

[Jiangong . Han]

dummy_timer() acquires dum->lock using spin_lock_irqsave(), which disables
local IRQs. Before invoking URB/request completion callbacks it drops the
lock with plain spin_unlock(), which releases the spinlock but leaves IRQs
disabled. The completion handlers (and any code they call) then execute
with IRQs disabled.

This is illegal for any completion handler that uses spin_unlock_bh() or
any other operation that requires IRQs to be enabled.  In this case the
call chain is:

  dummy_timer      [spin_lock_irqsave]
    spin_unlock           <- IRQs still disabled
    usb_hcd_giveback_urb
      carl9170_usb_rx_irq_complete
        carl9170_tx_process_status
          carl9170_get_queued_skb
            spin_unlock_bh
              __local_bh_enable_ip
                lockdep_assert_irqs_enabled  <- WARN

Fix this by replacing spin_unlock() with spin_unlock_irqrestore()
before usb_hcd_giveback_urb(), so that IRQs are properly re-enabled
before invoking callbacks and re-disabled after they return.

Function usb_gadget_giveback_request() calls fifo_complete() which
does nothing, so just focus on this issue.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+381102a7292a374fe8a7@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=381102a7292a374fe8a7
Signed-off-by: Jiangong.Han <jiangong.han@xxxxxxxxxxxxx>
---
 drivers/usb/gadget/udc/dummy_hcd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
index f47903461ed5..d11306202a5a 100644
--- a/drivers/usb/gadget/udc/dummy_hcd.c
+++ b/drivers/usb/gadget/udc/dummy_hcd.c
@@ -2001,9 +2001,9 @@ static enum hrtimer_restart dummy_timer(struct hrtimer *t)
 			ep->already_seen = ep->setup_stage = 0;
 
 		usb_hcd_unlink_urb_from_ep(dummy_hcd_to_hcd(dum_hcd), urb);
-		spin_unlock(&dum->lock);
+		spin_unlock_irqrestore(&dum->lock, flags);
 		usb_hcd_giveback_urb(dummy_hcd_to_hcd(dum_hcd), urb, status);
-		spin_lock(&dum->lock);
+		spin_lock_irqsave(&dum->lock, flags);
 
 		goto restart;
 	}
-- 
2.37.3