Re: [syzbot] [usb?] INFO: task hung in i2c_tiny_usb_disconnect

[Wei Peng]

#syz test

diff --git a/drivers/i2c/busses/i2c-tiny-usb.c 
b/drivers/i2c/busses/i2c-tiny-usb.c
index 57dfe5f1a7d9..79b7c97514c9 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -12,6 +12,7 @@
 #include <linux/slab.h>
 #include <linux/string_choices.h>
 #include <linux/types.h>
+#include <linux/workqueue.h>

 /* include interfaces to usb layer */
 #include <linux/usb.h>
@@ -172,6 +173,8 @@ struct i2c_tiny_usb {
     struct usb_device *usb_dev; /* the usb device for this device */
     struct usb_interface *interface; /* the interface for this device */
     struct i2c_adapter adapter; /* i2c related things */
+    bool disconnected; /* set to true on disconnect */
+    struct work_struct release_work; /* work struct to release the 
adapter */
 };

 static int usb_read(struct i2c_adapter *adapter, int cmd,
@@ -184,6 +187,11 @@ static int usb_read(struct i2c_adapter *adapter, 
int cmd,
     if (!dmadata)
         return -ENOMEM;

+    if (READ_ONCE(dev->disconnected)) {
+        kfree(dmadata);
+        return -ENODEV;
+    }
+
     /* do control transfer */
     ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0),
                    cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE |
@@ -204,6 +212,11 @@ static int usb_write(struct i2c_adapter *adapter, 
int cmd,
     if (!dmadata)
         return -ENOMEM;

+    if (READ_ONCE(dev->disconnected)) {
+        kfree(dmadata);
+        return -ENODEV;
+    }
+
     /* do control transfer */
     ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0),
                    cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE,
@@ -219,6 +232,15 @@ static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev)
     kfree(dev);
 }

+static void i2c_tiny_usb_release(struct work_struct *work)
+{
+    struct i2c_tiny_usb *dev = container_of(work, struct i2c_tiny_usb,
+                           release_work);
+
+    i2c_del_adapter(&dev->adapter);
+    i2c_tiny_usb_free(dev);
+}
+
 static int i2c_tiny_usb_probe(struct usb_interface *interface,
                   const struct usb_device_id *id)
 {
@@ -268,6 +290,8 @@ static int i2c_tiny_usb_probe(struct usb_interface 
*interface,

     dev->adapter.dev.parent = &dev->interface->dev;

+    INIT_WORK(&dev->release_work, i2c_tiny_usb_release);
+
     /* and finally attach to i2c layer */
     i2c_add_adapter(&dev->adapter);

@@ -287,9 +311,9 @@ static void i2c_tiny_usb_disconnect(struct 
usb_interface *interface)
 {
     struct i2c_tiny_usb *dev = usb_get_intfdata(interface);

-    i2c_del_adapter(&dev->adapter);
     usb_set_intfdata(interface, NULL);
-    i2c_tiny_usb_free(dev);
+    WRITE_ONCE(dev->disconnected, true);
+    queue_work(system_long_wq, &dev->release_work);

     dev_dbg(&interface->dev, "disconnected\n");
 }