greybus: operation/esx: fix message-cancellation lifetime bugs

The current host-controller message-cancellation implementation suffer
from a lifetime bug as dynamically allocated URBs would complete and be
deallocated while being unlinked as part of cancellation.

The current locking is also insufficient to prevent the related race
where the URB is deallocated before being unlinked.

Fix this by pushing the cancellation implementation from greybus core
down to the host-controller drivers, and replace the "cookie" pointer
with a hcpriv field that those drivers can use to maintain their state
with the required locking and reference counting in place.

Specifically the drivers need to acquire a reference to the URB under a
lock before calling usb_kill_urb as part of cancellation.

Note that this also removes the insufficient gb_message_mutex, which
also effectively prevented us from implementing support for submissions
from atomic context.

Instead the host-controller drivers must now explicitly make sure that
the pre-allocated URBs are not reused while cancellation is in progress.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

1 files changed, 5 insertions, 4 deletions

diff --git a/drivers/staging/greybus/operation.h b/drivers/staging/greybus/operation.h
index 0199976..ad4574b 100644
--- a/drivers/staging/greybus/operation.h
+++ b/drivers/staging/greybus/operation.h
@@ -73,19 +73,20 @@ struct gb_operation_msg_hdr {
 #define GB_OPERATION_MESSAGE_SIZE_MAX	U16_MAX
 
 /*
- * Protocol code should only examine the payload and payload_size
- * fields.  All other fields are intended to be private to the
- * operations core code.
+ * Protocol code should only examine the payload and payload_size fields, and
+ * host-controller drivers may use the hcpriv field. All other fields are
+ * intended to be private to the operations core code.
  */
 struct gb_message {
 	struct gb_operation		*operation;
-	void				*cookie;
 	struct gb_operation_msg_hdr	*header;
 
 	void				*payload;
 	size_t				payload_size;
 
 	void				*buffer;
+
+	void				*hcpriv;
 };
 
 /*