[PATCH 16/19] usb: renesas_usbhs: link URBs with interrupts disabled

[Greg Kroah-Hartman]

From: Josef Bacik <josef@xxxxxxxxxxxxxx>

usb_hcd_link_urb_to_ep() and usb_hcd_unlink_urb_from_ep() are to be
called under the lock of the host controller driver, with interrupts
disabled. They take hcd_urb_list_lock with a plain spin_lock().

usbhsh_urb_enqueue() calls the first one without any lock, with
interrupts enabled if the URB was submitted from process context.
usbhsh_queue_done() calls the second one, mostly from the interrupt
handler of the controller.

The host mode is used on a uniprocessor board, where the spinlock is
nothing. There the interrupt for a finished URB can come in the middle of
the list_add_tail() for the next URB of the same endpoint, and its
list_del_init() leaves the list of the endpoint corrupted. On an SMP
kernel the CPU would wait for itself instead.

usbhsh_queue_done() is also called from usbhsh_urb_dequeue() with
interrupts enabled.

Take the lock of the driver around both calls.

Fixes: 034d7c13a79c ("usb: gadget: renesas_usbhs: add mod_host support")
Cc: stable <stable@xxxxxxxxxx>
Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 drivers/usb/renesas_usbhs/mod_host.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/usb/renesas_usbhs/mod_host.c b/drivers/usb/renesas_usbhs/mod_host.c
index f7ef3a9f82a4..0652525d06fe 100644
--- a/drivers/usb/renesas_usbhs/mod_host.c
+++ b/drivers/usb/renesas_usbhs/mod_host.c
@@ -633,6 +633,7 @@ static void usbhsh_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
 	struct usb_hcd *hcd = usbhsh_hpriv_to_hcd(hpriv);
 	struct urb *urb = ureq->urb;
 	struct device *dev = usbhs_priv_to_dev(priv);
+	unsigned long flags;
 	int status = 0;
 
 	dev_dbg(dev, "%s\n", __func__);
@@ -652,7 +653,10 @@ static void usbhsh_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
 
 	usbhsh_pipe_detach(hpriv, usbhsh_ep_to_uep(urb->ep));
 
+	usbhs_lock(priv, flags);
 	usb_hcd_unlink_urb_from_ep(hcd, urb);
+	usbhs_unlock(priv, flags);
+
 	usb_hcd_giveback_urb(hcd, urb, status);
 }
 
@@ -955,6 +959,7 @@ static int usbhsh_urb_enqueue(struct usb_hcd *hcd,
 	struct usb_host_endpoint *ep = urb->ep;
 	struct usbhsh_device *new_udev = NULL;
 	int is_dir_in = usb_pipein(urb->pipe);
+	unsigned long flags;
 	int ret;
 
 	dev_dbg(dev, "%s (%s)\n", __func__, is_dir_in ? "in" : "out");
@@ -965,7 +970,9 @@ static int usbhsh_urb_enqueue(struct usb_hcd *hcd,
 		goto usbhsh_urb_enqueue_error_not_linked;
 	}
 
+	usbhs_lock(priv, flags);
 	ret = usb_hcd_link_urb_to_ep(hcd, urb);
+	usbhs_unlock(priv, flags);
 	if (ret) {
 		dev_err(dev, "urb link failed\n");
 		goto usbhsh_urb_enqueue_error_not_linked;

-- 
2.56.0