usb: dwc3: qcom: fix peripheral and OTG suspend

A recent commit implementing wakeup support in host mode instead broke
suspend for peripheral and OTG mode.

The hack that was added in the suspend path to determine the speed of
any device connected to the USB2 bus not only accesses internal driver
data for a child device, but also dereferences a NULL pointer or
accesses freed data when the controller is not acting as host.

There's no quick fix to the layering violation, but since reverting
would leave us with broken suspend in host mode with wakeup triggering
immediately, let's keep the hack for now.

Fix the immediate issues by only checking the host bus speed and
enabling wakeup interrupts when acting as host.

Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend")
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20220804151001.23612-7-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c
index 05b4666fde146e2cf05129c65cd2451e170703bf..6ae0b7fc4e2cdfe537bbc57bb5e669acf45539c7 100644 (file)
--- a/drivers/usb/dwc3/dwc3-qcom.c
+++ b/drivers/usb/dwc3/dwc3-qcom.c
@@ -309,8 +309,13 @@ static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)
 static enum usb_device_speed dwc3_qcom_read_usb2_speed(struct dwc3_qcom *qcom)
 {
        struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3);
-       struct usb_hcd *hcd = platform_get_drvdata(dwc->xhci);
        struct usb_device *udev;
+       struct usb_hcd *hcd;
+
+       /*
+        * FIXME: Fix this layering violation.
+        */
+       hcd = platform_get_drvdata(dwc->xhci);
 
        /*
         * It is possible to query the speed of all children of
@@ -416,7 +421,11 @@ static int dwc3_qcom_suspend(struct dwc3_qcom *qcom, bool wakeup)
        if (ret)
                dev_warn(qcom->dev, "failed to disable interconnect: %d\n", ret);
 
-       if (wakeup) {
+       /*
+        * The role is stable during suspend as role switching is done from a
+        * freezable workqueue.
+        */
+       if (dwc3_qcom_is_host(qcom) && wakeup) {
                qcom->usb2_speed = dwc3_qcom_read_usb2_speed(qcom);
                dwc3_qcom_enable_interrupts(qcom);
        }
@@ -434,7 +443,7 @@ static int dwc3_qcom_resume(struct dwc3_qcom *qcom, bool wakeup)
        if (!qcom->is_suspended)
                return 0;
 
-       if (wakeup)
+       if (dwc3_qcom_is_host(qcom) && wakeup)
                dwc3_qcom_disable_interrupts(qcom);
 
        for (i = 0; i < qcom->num_clocks; i++) {