From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2CDBAC433F5 for ; Thu, 17 Mar 2022 10:49:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232738AbiCQKvK (ORCPT ); Thu, 17 Mar 2022 06:51:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232739AbiCQKvJ (ORCPT ); Thu, 17 Mar 2022 06:51:09 -0400 Received: from metis.ext.pengutronix.de (metis.ext.pengutronix.de [IPv6:2001:67c:670:201:290:27ff:fe1d:cc33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22398171EEC for ; Thu, 17 Mar 2022 03:49:53 -0700 (PDT) Received: from drehscheibe.grey.stw.pengutronix.de ([2a0a:edc0:0:c01:1d::a2]) by metis.ext.pengutronix.de with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1nUnhW-0007sC-RB; Thu, 17 Mar 2022 11:49:50 +0100 Received: from [2a0a:edc0:0:900:1d::77] (helo=ptz.office.stw.pengutronix.de) by drehscheibe.grey.stw.pengutronix.de with esmtp (Exim 4.94.2) (envelope-from ) id 1nUnhX-001EW6-8l; Thu, 17 Mar 2022 11:49:49 +0100 Received: from ukl by ptz.office.stw.pengutronix.de with local (Exim 4.94.2) (envelope-from ) id 1nUnhV-009kLa-4d; Thu, 17 Mar 2022 11:49:49 +0100 Date: Thu, 17 Mar 2022 11:49:49 +0100 From: Uwe =?utf-8?Q?Kleine-K=C3=B6nig?= To: Greg Kroah-Hartman Cc: Felipe Balbi , linux-usb@vger.kernel.org, kernel@pengutronix.de Subject: Re: refcount underflow on stm32mp1 Message-ID: <20220317104949.ln75wh2a22vekwj2@pengutronix.de> References: <20220316164724.uic3azim4mhp6jvl@pengutronix.de> <20220316214437.iawmafmard7sed5w@pengutronix.de> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="b57payncrjjc627a" Content-Disposition: inline In-Reply-To: <20220316214437.iawmafmard7sed5w@pengutronix.de> X-SA-Exim-Connect-IP: 2a0a:edc0:0:c01:1d::a2 X-SA-Exim-Mail-From: ukl@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-usb@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org --b57payncrjjc627a Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Wed, Mar 16, 2022 at 10:44:37PM +0100, Uwe Kleine-K=F6nig wrote: > Hello Greg, >=20 > On Wed, Mar 16, 2022 at 06:09:13PM +0100, Greg Kroah-Hartman wrote: > > On Wed, Mar 16, 2022 at 05:47:24PM +0100, Uwe Kleine-K=F6nig wrote: > > > on an stm32mp157a based machine I encounter the following problem dur= ing > > > boot: > > >=20 > > > [ 2.031752] using random self ethernet address > > > [ 2.034869] using random host ethernet address > > > [ 2.039329] using random self ethernet address > > > [ 2.043986] using random host ethernet address > > > [ 2.049186] usb0: HOST MAC 6a:74:a8:25:a5:f9 > > > [ 2.052482] usb0: MAC f6:83:b5:19:02:4f > > > [ 2.056631] Mass Storage Function, version: 2009/09/11 > > > [ 2.061408] LUN: removable file: (no medium) > > > [ 2.065652] no file given for LUN0 > > > [ 2.111423] g_multi 49000000.usb-otg: failed to start g_multi: -22 > > > [ 2.116359] ------------[ cut here ]------------ > > > [ 2.120762] WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 dwc2_hsotg= _remove+0x1c/0x2c > > > [ 2.128541] refcount_t: underflow; use-after-free. > > > [ 2.133214] Modules linked in: > > > [ 2.136229] CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.17.0-rc= 8-dirty #10 > > > [ 2.143351] Hardware name: STM32 (Device Tree Support) > > > [ 2.148482] Workqueue: events_unbound deferred_probe_work_func > > > [ 2.154314] unwind_backtrace from show_stack+0x18/0x1c > > > [ 2.159515] show_stack from dump_stack_lvl+0x40/0x4c > > > [ 2.164555] dump_stack_lvl from __warn+0xd8/0x17c > > > [ 2.169334] __warn from warn_slowpath_fmt+0x98/0xc8 > > > [ 2.174287] warn_slowpath_fmt from dwc2_hsotg_remove+0x1c/0x2c > > > [ 2.180196] dwc2_hsotg_remove from dwc2_driver_probe+0x59c/0x790 > > > [ 2.186278] dwc2_driver_probe from platform_probe+0x64/0xc0 > > > [ 2.191926] platform_probe from really_probe+0x1ac/0x470 > > > [ 2.197312] really_probe from __driver_probe_device+0xa8/0x20c > > > [ 2.203220] __driver_probe_device from driver_probe_device+0x3c/0= xcc > > > [ 2.209650] driver_probe_device from __device_attach_driver+0xac/= 0x124 > > > [ 2.216254] __device_attach_driver from bus_for_each_drv+0x84/0xc8 > > > [ 2.222511] bus_for_each_drv from __device_attach+0xcc/0x1d4 > > > [ 2.228245] __device_attach from bus_probe_device+0x8c/0x94 > > > [ 2.233894] bus_probe_device from deferred_probe_work_func+0x9c/0= xdc > > > [ 2.240324] deferred_probe_work_func from process_one_work+0x210/= 0x584 > > > [ 2.246929] process_one_work from worker_thread+0x214/0x544 > > > [ 2.252576] worker_thread from kthread+0xf0/0x120 > > > [ 2.257356] kthread from ret_from_fork+0x14/0x2c > > > [ 2.262047] Exception stack(0xc190ffb0 to 0xc190fff8) > > > [ 2.267089] ffa0: 00000000 000= 00000 00000000 00000000 > > > [ 2.275260] ffc0: 00000000 00000000 00000000 00000000 00000000 000= 00000 00000000 00000000 > > > [ 2.283426] ffe0: 00000000 00000000 00000000 00000000 00000013 000= 00000 > > > [ 2.290196] ---[ end trace 0000000000000000 ]--- > > >=20 > > > This happens on v5.15 and on v5.17-rc8. > > >=20 > > > I didn't try to debug this further, just wanted to let you know ... > >=20 > > So it's always been an issue? > >=20 > > git bisect? >=20 > I don't believe this is the easiest approach to tackle that problem. > Support for stm32mp157a was added around v5.5, but I failed to get this > version up on my machine. v5.15 is the oldest kernel I had running on > that machine. >=20 > The problem is that after usb_add_gadget_udc() failed in > dwc2_driver_probe(), dwc2_hsotg_remove() -> usb_del_gadget_udc() -> > usb_put_gadget() -> put_device() results in that underflow. >=20 > With that information I'd expect that someone understanding how > reference counting works with usb gadgets should be able to come up with > a fix. The problem is that usb_add_gadget_udc() failing already calls usb_put_gadget() and so dwc2_hsotg_remove() must not call it again when called from dwc2_driver_probe. I don't understand that udc stuff enough to be confident that a patch I create for that will do the right thing. Best regards Uwe --=20 Pengutronix e.K. | Uwe Kleine-K=F6nig | Industrial Linux Solutions | https://www.pengutronix.de/ | --b57payncrjjc627a Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEfnIqFpAYrP8+dKQLwfwUeK3K7AkFAmIzEkoACgkQwfwUeK3K 7AltWAf/d2oybMnJAtV1sm4LLGd/poOW+zZjDu0cZlpHLTuybI50ZV/KZtaXifYz XFrstUBSVH4+KE72lmasjLLAGKQZPAoKUoRmNJSgRknVoO94TZsrN11im7vhxJBc KXndH5Nomi8JwAC8DUEvma59N0r+H5LvKBeFuOaLyZRxCyo8tcQwErepUG7umfjJ mVGRJNVAZKaX/Dc6aDM7xjsHVHT8Bl9U2NfNYUFwQDj0oDf4HJ6LIOne1CzZzgJ3 S9KYOHoGuuHGjbFs9oQA084ixZGiv3vPpAjgVDR8KoSLvK7VIxauo4BYIAkD3RDL RRnVJXwinBPQJvRY6Eptxwb0OSpovQ== =8tkL -----END PGP SIGNATURE----- --b57payncrjjc627a--