[PATCH 04/19] usb: host: oxu210hp-hcd: fix oxu_qh_alloc() deadlock

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

oxu_qh_alloc() calls ehci_qtd_alloc() with mem_lock held, and that
function takes the same spinlock.

Allocate the dummy qtd before taking the lock, and give it back, without
the lock, if there is no free queue head.

Fixes: b92a78e582b1 ("usb host: Oxford OXU210HP HCD driver.")
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/host/oxu210hp-hcd.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index ca96067e6d6d..3fff2d2a4f3f 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -1034,6 +1034,14 @@ static struct ehci_qh *oxu_qh_alloc(struct oxu_hcd *oxu)
 {
 	int i;
 	struct ehci_qh *qh = NULL;
+	struct ehci_qtd *dummy;
+
+	/* dummy td enables safe urb queuing; this takes mem_lock */
+	dummy = ehci_qtd_alloc(oxu);
+	if (!dummy) {
+		oxu_dbg(oxu, "no dummy td\n");
+		return NULL;
+	}
 
 	spin_lock(&oxu->mem_lock);
 
@@ -1049,21 +1057,16 @@ static struct ehci_qh *oxu_qh_alloc(struct oxu_hcd *oxu)
 		qh->oxu = oxu;
 		qh->qh_dma = virt_to_phys(qh);
 		INIT_LIST_HEAD(&qh->qtd_list);
-
-		/* dummy td enables safe urb queuing */
-		qh->dummy = ehci_qtd_alloc(oxu);
-		if (qh->dummy == NULL) {
-			oxu_dbg(oxu, "no dummy td\n");
-			oxu->qh_used[i] = 0;
-			qh = NULL;
-			goto unlock;
-		}
+		qh->dummy = dummy;
 
 		oxu->qh_used[i] = 1;
 	}
-unlock:
+
 	spin_unlock(&oxu->mem_lock);
 
+	if (!qh)
+		oxu_qtd_free(oxu, dummy);
+
 	return qh;
 }
 

-- 
2.56.0