The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit
58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").

Under PREEMPT_RT the deadlock can be readily triggered by heavy network
traffic, for example using "iperf --bidir" over NCM ethernet link.

The deadlock occurs because the threaded interrupt handler gets
preempted by a softirq, but both are protected by the same spinlock.
Prevent deadlock by disabling softirq during threaded irq handler.

cc: stable@vger.kernel.org
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
---
v2 changes:
- move the fix up the call stack, as per discussion at
https://lore.kernel.org/linux-rt-devel/20250226082931.-XRIDa6D@linutronix.de/
---
 drivers/usb/cdns3/cdns3-gadget.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
index fd1beb10bba72..19101ff1cf1bd 100644
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -1963,6 +1963,7 @@ static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data)
 	unsigned int bit;
 	unsigned long reg;
 
+	local_bh_disable();
 	spin_lock_irqsave(&priv_dev->lock, flags);
 
 	reg = readl(&priv_dev->regs->usb_ists);
@@ -2004,6 +2005,7 @@ static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data)
 irqend:
 	writel(~0, &priv_dev->regs->ep_ien);
 	spin_unlock_irqrestore(&priv_dev->lock, flags);
+	local_bh_enable();
 
 	return ret;
 }

---
base-commit: 4701f33a10702d5fc577c32434eb62adde0a1ae1
change-id: 20250312-rfs-cdns3-deadlock-697df5cad3ce

Best regards,
-- 
Ralph Siemsen <ralph.siemsen@linaro.org>

On 2025-03-18 11:09:32 [-0400], Ralph Siemsen wrote:
> The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit
> 58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").
> 
> Under PREEMPT_RT the deadlock can be readily triggered by heavy network
> traffic, for example using "iperf --bidir" over NCM ethernet link.
> 
> The deadlock occurs because the threaded interrupt handler gets
> preempted by a softirq, but both are protected by the same spinlock.
> Prevent deadlock by disabling softirq during threaded irq handler.
> 
> cc: stable@vger.kernel.org
> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
> Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>

Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>

Sebastian

On 25-03-18 11:09:32, Ralph Siemsen wrote:
> The cdns3 driver has the same NCM deadlock as fixed in cdnsp by commit
> 58f2fcb3a845 ("usb: cdnsp: Fix deadlock issue during using NCM gadget").
> 
> Under PREEMPT_RT the deadlock can be readily triggered by heavy network
> traffic, for example using "iperf --bidir" over NCM ethernet link.
> 
> The deadlock occurs because the threaded interrupt handler gets
> preempted by a softirq, but both are protected by the same spinlock.
> Prevent deadlock by disabling softirq during threaded irq handler.
> 
> cc: stable@vger.kernel.org
> Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
> Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>

Acked-by: Peter Chen <peter.chen@kernel.org>

> ---
> v2 changes:
> - move the fix up the call stack, as per discussion at
> https://lore.kernel.org/linux-rt-devel/20250226082931.-XRIDa6D@linutronix.de/
> ---
>  drivers/usb/cdns3/cdns3-gadget.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c
> index fd1beb10bba72..19101ff1cf1bd 100644
> --- a/drivers/usb/cdns3/cdns3-gadget.c
> +++ b/drivers/usb/cdns3/cdns3-gadget.c
> @@ -1963,6 +1963,7 @@ static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data)
>  	unsigned int bit;
>  	unsigned long reg;
>  
> +	local_bh_disable();
>  	spin_lock_irqsave(&priv_dev->lock, flags);
>  
>  	reg = readl(&priv_dev->regs->usb_ists);
> @@ -2004,6 +2005,7 @@ static irqreturn_t cdns3_device_thread_irq_handler(int irq, void *data)
>  irqend:
>  	writel(~0, &priv_dev->regs->ep_ien);
>  	spin_unlock_irqrestore(&priv_dev->lock, flags);
> +	local_bh_enable();
>  
>  	return ret;
>  }
> 
> ---
> base-commit: 4701f33a10702d5fc577c32434eb62adde0a1ae1
> change-id: 20250312-rfs-cdns3-deadlock-697df5cad3ce
> 
> Best regards,
> -- 
> Ralph Siemsen <ralph.siemsen@linaro.org>
> 

-- 

Best regards,
Peter