[PATCH 1/4] usb: gadget: pch_udc: release IRQ handlers before DMA cleanup

[Myeonghun Pak]

Cleanup frees endpoint descriptors and DMA pools while the managed
PCI handler is still registered. Drain the VBUS works and release
the GPIO and PCI handlers before freeing DMA resources on removal
and probe failure. Initialize both works before GPIO registration
so every shared cleanup path can disable and drain them.

Mask the controller before releasing the PCI IRQ, then mask it again
after the handler has finished: an already running enumeration
handler can otherwise re-enable interrupt sources during teardown.
Record the PCI IRQ only after a successful request.

This issue was identified as part of our ongoing research while
reviewing kernel code.

Fixes: f646cf94520e ("USB device driver of Topcliff PCH")
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Ijae Kim <ae878000@xxxxxxxxx>
Signed-off-by: Myeonghun Pak <mhun512@xxxxxxxxx>
---
Compile-tested only.

 drivers/usb/gadget/udc/pch_udc.c | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c
index f5ac2b8056d2..3b5c5c41c38c 100644
--- a/drivers/usb/gadget/udc/pch_udc.c
+++ b/drivers/usb/gadget/udc/pch_udc.c
@@ -1372,8 +1372,6 @@ static int pch_vbus_gpio_init(struct pch_udc_dev *dev)
 
 	dev->vbus_gpio.port = NULL;
 	dev->vbus_gpio.intr = 0;
-	INIT_WORK(&dev->vbus_gpio.irq_work_fall, pch_vbus_gpio_work_fall);
-	INIT_WORK(&dev->vbus_gpio.irq_work_rise, pch_vbus_gpio_work_rise);
 
 	/* Retrieve the GPIO line from the USB gadget device */
 	gpiod = devm_gpiod_get_optional(d, NULL, GPIOD_IN);
@@ -2833,6 +2831,9 @@ static int pch_udc_pcd_init(struct pch_udc_dev *dev)
 	pch_udc_init(dev);
 	pch_udc_pcd_reinit(dev);
 
+	INIT_WORK(&dev->vbus_gpio.irq_work_fall, pch_vbus_gpio_work_fall);
+	INIT_WORK(&dev->vbus_gpio.irq_work_rise, pch_vbus_gpio_work_rise);
+
 	ret = pch_vbus_gpio_init(dev);
 	if (ret)
 		pch_udc_exit(dev);
@@ -2979,6 +2980,15 @@ static void pch_udc_shutdown(struct pci_dev *pdev)
 
 static void pch_udc_cleanup(struct pch_udc_dev *dev)
 {
+	pch_vbus_gpio_free(dev);
+	pch_udc_exit(dev);
+	if (dev->gadget.irq) {
+		devm_free_irq(&dev->pdev->dev, dev->gadget.irq, dev);
+		/* The handler may have re-enabled interrupt sources. */
+		pch_udc_exit(dev);
+		dev->gadget.irq = 0;
+	}
+
 	/* dma pool cleanup */
 	dma_pool_destroy(dev->data_requests);
 
@@ -3000,10 +3010,6 @@ static void pch_udc_cleanup(struct pch_udc_dev *dev)
 	if (dev->dma_addr)
 		dma_unmap_single(&dev->pdev->dev, dev->dma_addr,
 				 UDC_EP0OUT_BUFF_SIZE * 4, DMA_FROM_DEVICE);
-
-	pch_vbus_gpio_free(dev);
-
-	pch_udc_exit(dev);
 }
 
 static void pch_udc_remove(struct pci_dev *pdev)
@@ -3091,6 +3097,8 @@ static int pch_udc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 		goto finished;
 	}
 
+	dev->gadget.irq = pdev->irq;
+
 	pci_set_master(pdev);
 	pci_try_set_mwi(pdev);
 
@@ -3113,6 +3121,8 @@ static int pch_udc_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	return 0;
 
 finished:
+	disable_work_sync(&dev->vbus_gpio.irq_work_fall);
+	disable_work_sync(&dev->vbus_gpio.irq_work_rise);
 	pch_udc_cleanup(dev);
 	return retval;
 }