3 files changed, 86 insertions, 90 deletions

diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index e538b72c4e3a..f14e7929ba22 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -97,18 +97,12 @@ static void wusbhc_devconnect_acked_work(struct work_struct *work);
 
 static void wusb_dev_free(struct wusb_dev *wusb_dev)
 {
-        if (wusb_dev) {
-                kfree(wusb_dev->set_gtk_req);
-                usb_free_urb(wusb_dev->set_gtk_urb);
-                kfree(wusb_dev);
-        }
+        kfree(wusb_dev);
 }
 
 static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 {
         struct wusb_dev *wusb_dev;
-        struct urb *urb;
-        struct usb_ctrlrequest *req;
 
         wusb_dev = kzalloc(sizeof(*wusb_dev), GFP_KERNEL);
         if (wusb_dev == NULL)
@@ -118,22 +112,6 @@ static struct wusb_dev *wusb_dev_alloc(struct wusbhc *wusbhc)
 
         INIT_WORK(&wusb_dev->devconnect_acked_work, wusbhc_devconnect_acked_work);
 
-        urb = usb_alloc_urb(0, GFP_KERNEL);
-        if (urb == NULL)
-                goto err;
-        wusb_dev->set_gtk_urb = urb;
-
-        req = kmalloc(sizeof(*req), GFP_KERNEL);
-        if (req == NULL)
-                goto err;
-        wusb_dev->set_gtk_req = req;
-
-        req->bRequestType = USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE;
-        req->bRequest = USB_REQ_SET_DESCRIPTOR;
-        req->wValue = cpu_to_le16(USB_DT_KEY << 8 | wusbhc->gtk_index);
-        req->wIndex = 0;
-        req->wLength = cpu_to_le16(wusbhc->gtk.descr.bLength);
-
         return wusb_dev;
 err:
         wusb_dev_free(wusb_dev);
@@ -411,9 +389,6 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
 /*
  * Refresh the list of keep alives to emit in the MMC
  *
- * Some devices don't respond to keep alives unless they've been
- * authenticated, so skip unauthenticated devices.
- *
  * We only publish the first four devices that have a coming timeout
  * condition. Then when we are done processing those, we go for the
  * next ones. We ignore the ones that have timed out already (they'll
@@ -448,7 +423,7 @@ static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
 
                 if (wusb_dev == NULL)
                         continue;
-                if (wusb_dev->usb_dev == NULL || !wusb_dev->usb_dev->authenticated)
+                if (wusb_dev->usb_dev == NULL)
                         continue;
 
                 if (time_after(jiffies, wusb_dev->entry_ts + tt)) {
@@ -524,11 +499,19 @@ static struct wusb_dev *wusbhc_find_dev_by_addr(struct wusbhc *wusbhc, u8 addr)
  *
  * @wusbhc shall be referenced and unlocked
  */
-static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_alive(struct wusbhc *wusbhc, u8 srcaddr)
 {
+        struct wusb_dev *wusb_dev;
+
         mutex_lock(&wusbhc->mutex);
-        wusb_dev->entry_ts = jiffies;
-        __wusbhc_keep_alive(wusbhc);
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
+        if (wusb_dev == NULL) {
+                dev_dbg(wusbhc->dev, "ignoring DN_Alive from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                wusb_dev->entry_ts = jiffies;
+                __wusbhc_keep_alive(wusbhc);
+        }
         mutex_unlock(&wusbhc->mutex);
 }
 
@@ -582,14 +565,22 @@ static void wusbhc_handle_dn_connect(struct wusbhc *wusbhc,
  *
  * @wusbhc shall be referenced and unlocked
  */
-static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
+static void wusbhc_handle_dn_disconnect(struct wusbhc *wusbhc, u8 srcaddr)
 {
         struct device *dev = wusbhc->dev;
-
-        dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n", wusb_dev->addr);
+        struct wusb_dev *wusb_dev;
 
         mutex_lock(&wusbhc->mutex);
-        __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc, wusb_dev->port_idx));
+        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
+        if (wusb_dev == NULL) {
+                dev_dbg(dev, "ignoring DN DISCONNECT from unconnected device %02x\n",
+                        srcaddr);
+        } else {
+                dev_info(dev, "DN DISCONNECT: device 0x%02x going down\n",
+                        wusb_dev->addr);
+                __wusbhc_dev_disconnect(wusbhc, wusb_port_by_idx(wusbhc,
+                        wusb_dev->port_idx));
+        }
         mutex_unlock(&wusbhc->mutex);
 }
 
@@ -611,30 +602,21 @@ void wusbhc_handle_dn(struct wusbhc *wusbhc, u8 srcaddr,
                       struct wusb_dn_hdr *dn_hdr, size_t size)
 {
         struct device *dev = wusbhc->dev;
-        struct wusb_dev *wusb_dev;
 
         if (size < sizeof(struct wusb_dn_hdr)) {
                 dev_err(dev, "DN data shorter than DN header (%d < %d)\n",
                         (int)size, (int)sizeof(struct wusb_dn_hdr));
                 return;
         }
-
-        wusb_dev = wusbhc_find_dev_by_addr(wusbhc, srcaddr);
-        if (wusb_dev == NULL && dn_hdr->bType != WUSB_DN_CONNECT) {
-                dev_dbg(dev, "ignoring DN %d from unconnected device %02x\n",
-                        dn_hdr->bType, srcaddr);
-                return;
-        }
-
         switch (dn_hdr->bType) {
         case WUSB_DN_CONNECT:
                 wusbhc_handle_dn_connect(wusbhc, dn_hdr, size);
                 break;
         case WUSB_DN_ALIVE:
-                wusbhc_handle_dn_alive(wusbhc, wusb_dev);
+                wusbhc_handle_dn_alive(wusbhc, srcaddr);
                 break;
         case WUSB_DN_DISCONNECT:
-                wusbhc_handle_dn_disconnect(wusbhc, wusb_dev);
+                wusbhc_handle_dn_disconnect(wusbhc, srcaddr);
                 break;
         case WUSB_DN_MASAVAILCHANGED:
         case WUSB_DN_RWAKE:
diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
index 66655e8f2308..790c0b5c354c 100644
--- a/drivers/usb/wusbcore/security.c
+++ b/drivers/usb/wusbcore/security.c
@@ -29,19 +29,16 @@
 #include <linux/export.h>
 #include "wusbhc.h"
 
-static void wusbhc_set_gtk_callback(struct urb *urb);
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work);
+static void wusbhc_gtk_rekey_work(struct work_struct *work);
 
 int wusbhc_sec_create(struct wusbhc *wusbhc)
 {
         wusbhc->gtk.descr.bLength = sizeof(wusbhc->gtk.descr) + sizeof(wusbhc->gtk.data);
         wusbhc->gtk.descr.bDescriptorType = USB_DT_KEY;
         wusbhc->gtk.descr.bReserved = 0;
+        wusbhc->gtk_index = 0;
 
-        wusbhc->gtk_index = wusb_key_index(0, WUSB_KEY_INDEX_TYPE_GTK,
-                                           WUSB_KEY_INDEX_ORIGINATOR_HOST);
-
-        INIT_WORK(&wusbhc->gtk_rekey_done_work, wusbhc_gtk_rekey_done_work);
+        INIT_WORK(&wusbhc->gtk_rekey_work, wusbhc_gtk_rekey_work);
 
         return 0;
 }
@@ -113,7 +110,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
         wusbhc_generate_gtk(wusbhc);
 
         result = wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
-                                 &wusbhc->gtk.descr.bKeyData, key_size);
+                                &wusbhc->gtk.descr.bKeyData, key_size);
         if (result < 0)
                 dev_err(wusbhc->dev, "cannot set GTK for the host: %d\n",
                         result);
@@ -129,7 +126,7 @@ int wusbhc_sec_start(struct wusbhc *wusbhc)
  */
 void wusbhc_sec_stop(struct wusbhc *wusbhc)
 {
-        cancel_work_sync(&wusbhc->gtk_rekey_done_work);
+        cancel_work_sync(&wusbhc->gtk_rekey_work);
 }
 
 
@@ -185,12 +182,14 @@ static int wusb_dev_set_encryption(struct usb_device *usb_dev, int value)
 static int wusb_dev_set_gtk(struct wusbhc *wusbhc, struct wusb_dev *wusb_dev)
 {
         struct usb_device *usb_dev = wusb_dev->usb_dev;
+        u8 key_index = wusb_key_index(wusbhc->gtk_index,
+                WUSB_KEY_INDEX_TYPE_GTK, WUSB_KEY_INDEX_ORIGINATOR_HOST);
 
         return usb_control_msg(
                 usb_dev, usb_sndctrlpipe(usb_dev, 0),
                 USB_REQ_SET_DESCRIPTOR,
                 USB_DIR_OUT | USB_TYPE_STANDARD | USB_RECIP_DEVICE,
-                USB_DT_KEY << 8 | wusbhc->gtk_index, 0,
+                USB_DT_KEY << 8 | key_index, 0,
                 &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
                 USB_CTRL_SET_TIMEOUT);
 }
@@ -522,24 +521,55 @@ error_kzalloc:
  * Once all connected and authenticated devices have received the new
  * GTK, switch the host to using it.
  */
-static void wusbhc_gtk_rekey_done_work(struct work_struct *work)
+static void wusbhc_gtk_rekey_work(struct work_struct *work)
 {
-        struct wusbhc *wusbhc = container_of(work, struct wusbhc, gtk_rekey_done_work);
+        struct wusbhc *wusbhc = container_of(work,
+                                        struct wusbhc, gtk_rekey_work);
         size_t key_size = sizeof(wusbhc->gtk.data);
+        int port_idx;
+        struct wusb_dev *wusb_dev, *wusb_dev_next;
+        LIST_HEAD(rekey_list);
 
         mutex_lock(&wusbhc->mutex);
+        /* generate the new key */
+        wusbhc_generate_gtk(wusbhc);
+        /* roll the gtk index. */
+        wusbhc->gtk_index = (wusbhc->gtk_index + 1) % (WUSB_KEY_INDEX_MAX + 1);
+        /*
+         * Save all connected devices on a list while holding wusbhc->mutex and
+         * take a reference to each one.  Then submit the set key request to
+         * them after releasing the lock in order to avoid a deadlock.
+         */
+        for (port_idx = 0; port_idx < wusbhc->ports_max; port_idx++) {
+                wusb_dev = wusbhc->port[port_idx].wusb_dev;
+                if (!wusb_dev || !wusb_dev->usb_dev
+                        || !wusb_dev->usb_dev->authenticated)
+                        continue;
 
-        if (--wusbhc->pending_set_gtks == 0)
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
-
+                wusb_dev_get(wusb_dev);
+                list_add_tail(&wusb_dev->rekey_node, &rekey_list);
+        }
         mutex_unlock(&wusbhc->mutex);
-}
 
-static void wusbhc_set_gtk_callback(struct urb *urb)
-{
-        struct wusbhc *wusbhc = urb->context;
+        /* Submit the rekey requests without holding wusbhc->mutex. */
+        list_for_each_entry_safe(wusb_dev, wusb_dev_next, &rekey_list,
+                rekey_node) {
+                list_del_init(&wusb_dev->rekey_node);
+                dev_dbg(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d\n",
+                        __func__, wusb_dev->port_idx);
+
+                if (wusb_dev_set_gtk(wusbhc, wusb_dev) < 0) {
+                        dev_err(&wusb_dev->usb_dev->dev, "%s: rekey device at port %d failed\n",
+                                __func__, wusb_dev->port_idx);
+                }
+                wusb_dev_put(wusb_dev);
+        }
 
-        queue_work(wusbd, &wusbhc->gtk_rekey_done_work);
+        /* Switch the host controller to use the new GTK. */
+        mutex_lock(&wusbhc->mutex);
+        wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid,
+                &wusbhc->gtk.descr.bKeyData, key_size);
+        mutex_unlock(&wusbhc->mutex);
 }
 
 /**
@@ -555,26 +585,12 @@ static void wusbhc_set_gtk_callback(struct urb *urb)
  */
 void wusbhc_gtk_rekey(struct wusbhc *wusbhc)
 {
-        static const size_t key_size = sizeof(wusbhc->gtk.data);
-        int p;
-
-        wusbhc_generate_gtk(wusbhc);
-
-        for (p = 0; p < wusbhc->ports_max; p++) {
-                struct wusb_dev *wusb_dev;
-
-                wusb_dev = wusbhc->port[p].wusb_dev;
-                if (!wusb_dev || !wusb_dev->usb_dev || !wusb_dev->usb_dev->authenticated)
-                        continue;
-
-                usb_fill_control_urb(wusb_dev->set_gtk_urb, wusb_dev->usb_dev,
-                                     usb_sndctrlpipe(wusb_dev->usb_dev, 0),
-                                     (void *)wusb_dev->set_gtk_req,
-                                     &wusbhc->gtk.descr, wusbhc->gtk.descr.bLength,
-                                     wusbhc_set_gtk_callback, wusbhc);
-                if (usb_submit_urb(wusb_dev->set_gtk_urb, GFP_KERNEL) == 0)
-                        wusbhc->pending_set_gtks++;
-        }
-        if (wusbhc->pending_set_gtks == 0)
-                wusbhc->set_gtk(wusbhc, wusbhc->gtk_tkid, &wusbhc->gtk.descr.bKeyData, key_size);
+        /*
+         * We need to submit a URB to the downstream WUSB devices in order to
+         * change the group key.  This can't be done while holding the
+         * wusbhc->mutex since that is also taken in the urb_enqueue routine
+         * and will cause a deadlock.  Instead, queue a work item to do
+         * it when the lock is not held
+         */
+        queue_work(wusbd, &wusbhc->gtk_rekey_work);
 }
diff --git a/drivers/usb/wusbcore/wusbhc.h b/drivers/usb/wusbcore/wusbhc.h
index 711b1952b114..6bd3b819a6b5 100644
--- a/drivers/usb/wusbcore/wusbhc.h
+++ b/drivers/usb/wusbcore/wusbhc.h
@@ -97,6 +97,7 @@ struct wusb_dev {
         struct kref refcnt;
         struct wusbhc *wusbhc;
         struct list_head cack_node;     /* Connect-Ack list */
+        struct list_head rekey_node;    /* GTK rekey list */
         u8 port_idx;
         u8 addr;
         u8 beacon_type:4;
@@ -107,8 +108,6 @@ struct wusb_dev {
         struct usb_wireless_cap_descriptor *wusb_cap_descr;
         struct uwb_mas_bm availability;
         struct work_struct devconnect_acked_work;
-        struct urb *set_gtk_urb;
-        struct usb_ctrlrequest *set_gtk_req;
         struct usb_device *usb_dev;
 };
 
@@ -296,8 +295,7 @@ struct wusbhc {
         } __attribute__((packed)) gtk;
         u8 gtk_index;
         u32 gtk_tkid;
-        struct work_struct gtk_rekey_done_work;
-        int pending_set_gtks;
+        struct work_struct gtk_rekey_work;
 
         struct usb_encryption_descriptor *ccm1_etd;
 };