Re: [PATCH] usb: gadget: dummy_hcd: fix IRQs-disabled violation in dummy_timer()

[Alan Stern]

On Thu, Jul 16, 2026 at 10:07:13AM +0800, Jiangong.Han wrote:
> dummy_timer() acquires dum->lock using spin_lock_irqsave(), which disables
> local IRQs. Before invoking URB/request completion callbacks it drops the
> lock with plain spin_unlock(), which releases the spinlock but leaves IRQs
> disabled. The completion handlers (and any code they call) then execute
> with IRQs disabled.
> 
> This is illegal for any completion handler that uses spin_unlock_bh() or
> any other operation that requires IRQs to be enabled.  In this case the
> call chain is:
> 
>   dummy_timer      [spin_lock_irqsave]
>     spin_unlock           <- IRQs still disabled
>     usb_hcd_giveback_urb
>       carl9170_usb_rx_irq_complete
>         carl9170_tx_process_status
>           carl9170_get_queued_skb
>             spin_unlock_bh
>               __local_bh_enable_ip
>                 lockdep_assert_irqs_enabled  <- WARN
> 
> Fix this by replacing spin_unlock() with spin_unlock_irqrestore()
> before usb_hcd_giveback_urb(), so that IRQs are properly re-enabled
> before invoking callbacks and re-disabled after they return.
> 
> Function usb_gadget_giveback_request() calls fifo_complete() which
> does nothing, so just focus on this issue.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+381102a7292a374fe8a7@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=381102a7292a374fe8a7
> Signed-off-by: Jiangong.Han <jiangong.han@xxxxxxxxxxxxx>
> ---

This is not the right way to solve the problem observed in carl9170.  It 
is documented that usb_hcd_giveback_urb() runs in atomic context, and 
drivers' completion handlers should not expect to be called with 
interrupts enabled.  The problem lies in carl9170_get_queued_skb(); 
that's where it needs to be fixed.

Alan Stern