• Ioan-Adrian Ratiu's avatar
    HID: usbhid: fix recursive deadlock · d43afc4a
    Ioan-Adrian Ratiu authored
    commit e470127e upstream.
    
    The critical section protected by usbhid->lock in hid_ctrl() is too
    big and because of this it causes a recursive deadlock. "Too big" means
    the case statement and the call to hid_input_report() do not need to be
    protected by the spinlock (no URB operations are done inside them).
    
    The deadlock happens because in certain rare cases drivers try to grab
    the lock while handling the ctrl irq which grabs the lock before them
    as described above. For example newer wacom tablets like 056a:033c try
    to reschedule proximity reads from wacom_intuos_schedule_prox_event()
    calling hid_hw_request() -> usbhid_request() -> usbhid_submit_report()
    which tries to grab the usbhid lock already held by hid_ctrl().
    
    There are two ways to get out of this deadlock:
        1. Make the drivers work "around" the ctrl critical region, in the
        wacom case for ex. by delaying the scheduling of the proximity read
        request itself to a workqueue.
        2. Shrink the critical region so the usbhid lock protects only the
        instructions which modify usbhid state, calling hid_input_report()
        with the spinlock unlocked, allowing the device driver to grab the
        lock first, finish and then grab the lock afterwards in hid_ctrl().
    
    This patch implements the 2nd solution.
    Signed-off-by: default avatarIoan-Adrian Ratiu <adi@adirat.com>
    Signed-off-by: default avatarJiri Kosina <jkosina@suse.cz>
    Signed-off-by: default avatarJason Gerecke <jason.gerecke@wacom.com>
    Signed-off-by: default avatarJiri Slaby <jslaby@suse.cz>
    d43afc4a
hid-core.c 43.8 KB