usb: gadget: uvc: Remove nested locking

When handling error status from uvcg_video_usb_req_queue,
uvc_video_complete currently calls uvcg_queue_cancel with
video->req_lock held. uvcg_queue_cancel internally locks
queue->irqlock, which nests queue->irqlock inside
video->req_lock. This isn't a functional bug at the
moment, but does open up possibilities for ABBA
deadlocks in the future.

This patch fixes the accidental nesting by dropping
video->req_lock before calling uvcg_queue_cancel.

Fixes: 6acba0345b68 ("usb:gadget:uvc Do not use worker thread to pump isoc usb requests")
Signed-off-by: Avichal Rakesh <arakesh@google.com>
Link: https://lore.kernel.org/r/20240104215009.2252452-2-arakesh@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/gadget/function/uvc_video.c b/drivers/usb/gadget/function/uvc_video.c
index 7f18dc471be38faf811063622b1a0b4d6a5b2104..dd3241fc6939d6fa0e0a23a36469e5f137164e3a 100644 (file)
--- a/drivers/usb/gadget/function/uvc_video.c
+++ b/drivers/usb/gadget/function/uvc_video.c
@@ -469,13 +469,15 @@ uvc_video_complete(struct usb_ep *ep, struct usb_request *req)
                         * Put request back in req_free for it to be cleaned
                         * up later.
                         */
-                       uvcg_queue_cancel(queue, 0);
                        list_add_tail(&to_queue->list, &video->req_free);
                }
        } else {
                uvc_video_free_request(ureq, ep);
+               ret = 0;
        }
        spin_unlock_irqrestore(&video->req_lock, flags);
+       if (ret < 0)
+               uvcg_queue_cancel(queue, 0);
 }
 
 static int