From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B6DBCA9EA0 for ; Tue, 22 Oct 2019 06:20:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5E22C20B7C for ; Tue, 22 Oct 2019 06:20:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731033AbfJVGUr (ORCPT ); Tue, 22 Oct 2019 02:20:47 -0400 Received: from mga14.intel.com ([192.55.52.115]:19948 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725788AbfJVGUq (ORCPT ); Tue, 22 Oct 2019 02:20:46 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga001.jf.intel.com ([10.7.209.18]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 21 Oct 2019 23:20:46 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.67,326,1566889200"; d="scan'208";a="281186972" Received: from pipin.fi.intel.com (HELO pipin) ([10.237.72.175]) by orsmga001.jf.intel.com with ESMTP; 21 Oct 2019 23:20:44 -0700 From: Felipe Balbi To: kvaradarajan , linux-usb@vger.kernel.org Cc: prabhat.chand.pandey@intel.com, gregkh@linuxfoundation.org Subject: Re: [PATCH] USB/Gadget: Fix race between gether_disconnect and rx_submit In-Reply-To: <1561020956-17870-1-git-send-email-Kiruthika.Varadarajan@harman.com> References: <1561020956-17870-1-git-send-email-Kiruthika.Varadarajan@harman.com> Date: Tue, 22 Oct 2019 09:20:43 +0300 Message-ID: <87y2xd2tdw.fsf@gmail.com> MIME-Version: 1.0 Content-Type: text/plain Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Hi, kvaradarajan writes: > From: Kiruthika Varadarajan > > During gadget connection/disconnect several times panic observed. > > [ 64.723260] BUG: unable to handle kernel NULL pointer dereference at 0000 > 0000000000f0 > [ 64.732040] IP: [] rx_fill+0x1ed/0x3b0 > [ 64.737984] PGD 6bece067 PUD 0 > [ 64.741503] Oops: 0000 [#1] PREEMPT SMP > [ 64.802125] CPU: 0 PID: 636 Comm: kworker/u8:2 Tainted: G U W O 4.4.71-quilt-2e5dc0ac-g0b463804d692-dirty #45 > [ 64.814092] Workqueue: uether process_rx_w > [ 64.818675] task: ffff8800779c40c0 ti: ffff88007702c000 task.ti: ffff88007702c000 > [ 64.827040] RIP: 0010:[] [] rx_fill+0x1ed/0x3b0 > [ 64.835706] RSP: 0000:ffff88007702fd80 EFLAGS: 00010246 > [ 64.841642] RAX: 0000000000000000 RBX: ffff88006f2768c0 RCX: 0000000000000200 > [ 64.849617] RDX: 00000000000001fd RSI: ffffffff82081f71 RDI: 00000000ffffffff > [ 64.857591] RBP: ffff88007702fdc8 R08: ffffc90000285000 R09: 0000000000000600 > [ 64.865566] R10: ffff88002ab99670 R11: 0000000000000f7a R12: 0000000000000002 > [ 64.873541] R13: ffff88006f2768f0 R14: 0000000000000600 R15: ffff88006bf6f118 > [ 64.881509] FS: 0000000000000000(0000) GS:ffff88007ac00000(0000) knlGS:0000000000000000 > [ 64.890545] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 64.896965] CR2: 00000000000000f0 CR3: 0000000065c99000 CR4: 00000000003406f0 > [ 64.904936] Last Branch Records: > [ 64.908551] to: [] page_fault+0x0/0x80 > [ 64.914787] from: [] rx_fill+0x1ed/0x3b0 > [ 64.921020] to: [] rx_fill+0x1e9/0x3b0 > [ 64.927253] from: [] rx_fill+0x1e3/0x3b0 > [ 64.933480] to: [] rx_fill+0x1b7/0x3b0 > [ 64.939704] from: [] printk+0x4f/0x50 > [ 64.945654] to: [] printk+0x48/0x50 > [ 64.951588] from: [] vprintk_default+0x20/0x30 > [ 64.958403] to: [] vprintk_default+0x1f/0x30 > [ 64.965219] from: [] vprintk_emit+0x16f/0x530 > [ 64.971941] to: [] vprintk_emit+0x161/0x530 > [ 64.978653] from: [] vprintk_emit+0x272/0x530 > [ 64.985383] to: [] vprintk_emit+0x272/0x530 > [ 64.992116] from: [] restore+0xd/0x16 > [ 64.998059] to: [] restore+0x0/0x16 > [ 65.003999] from: [] ___preempt_schedule+0x12/0x14 > [ 65.011205] to: [] ___preempt_schedule+0x12/0x14 > [ 65.018411] from: [] preempt_schedule+0x20/0x30 > [ 65.025324] to: [] preempt_schedule+0x1f/0x30 > [ 65.032228] from: [] preempt_schedule_common+0x33/0x40 > [ 65.039835] to: [] preempt_schedule_common+0x1f/0x40 > [ 65.047427] from: [] __schedule+0x36b/0xb90 > [ 65.053952] to: [] __schedule+0x34c/0xb90 > [ 65.060478] from: [] finish_task_switch+0xb6/0x210 > [ 65.067688] to: [] finish_task_switch+0x8b/0x210 > [ 65.074886] from: [] _raw_spin_unlock_irq+0x2a/0x40 > [ 65.082190] to: [] _raw_spin_unlock_irq+0x1e/0x40 > [ 65.089494] from: [] preempt_count_sub+0x35/0xb0 > [ 65.096508] to: [] preempt_count_sub+0x2b/0xb0 > [ 65.103511] from: [] preempt_count_sub+0x75/0xb0 > [ 65.110517] to: [] preempt_count_sub+0x6c/0xb0 > [ 65.117522] from: [] preempt_count_sub+0x29/0xb0 > [ 65.124530] to: [] preempt_count_sub+0x0/0xb0 > [ 65.131444] from: [] _raw_spin_unlock_irq+0x19/0x40 > [ 65.138748] to: [] _raw_spin_unlock_irq+0x13/0x40 > [ 65.146052] from: [] trace_hardirqs_on+0x9/0xf0 > [ 65.152958] to: [] trace_hardirqs_on+0x0/0xf0 > [ 65.159872] from: [] _raw_spin_unlock_irq+0xe/0x40 > [ 65.167065] to: [] _raw_spin_unlock_irq+0xe/0x40 > [ 65.174257] from: [] do_raw_spin_unlock+0x4b/0xa0 > [ 65.181364] to: [] do_raw_spin_unlock+0x0/0xa0 > [ 65.188372] from: [] _raw_spin_unlock_irq+0x9/0x40 > [ 65.195575] to: [] _raw_spin_unlock_irq+0x0/0x40 > [ 65.202776] from: [] finish_task_switch+0x86/0x210 > [ 65.209980] to: [] finish_task_switch+0x25/0x210 > [ 65.217183] from: [] debug_smp_processor_id+0x18/0x20 > [ 65.224676] to: [] debug_smp_processor_id+0x17/0x20 > [ 65.232171] from: [] check_preemption_disabled+0x26/0xf0 > [ 65.239952] to: [] check_preemption_disabled+0x0/0xf0 > [ 65.247632] from: [] debug_smp_processor_id+0x12/0x20 > [ 65.255124] to: [] debug_smp_processor_id+0x0/0x20 > [ 65.262521] from: [] finish_task_switch+0x20/0x210 > [ 65.269734] to: [] finish_task_switch+0x0/0x210 > [ 65.276831] from: [] __schedule+0x347/0xb90 > [ 65.283353] to: [] __schedule+0x314/0xb90 > [ 65.289871] from: [] __switch_to+0x297/0x5a0 > [ 65.296486] to: [] __switch_to+0x286/0x5a0 > [ 65.303092] from: [] __switch_to+0x274/0x5a0 > [ 65.309728] to: [] __switch_to+0x230/0x5a0 > [ 65.316352] from: [] __switch_to+0x220/0x5a0 > [ 65.322972] to: [] __switch_to+0x1f3/0x5a0 > [ 65.329582] from: [] __switch_to+0x1e3/0x5a0 > [ 65.336203] to: [] __switch_to+0x145/0x5a0 > [ 65.342821] from: [] __switch_to+0xee/0x5a0 > [ 65.349343] Stack: > [ 65.351585] 0000000000000286 ffff88006bd22548 024000c081a4dae8 ffff88006f276918 > [ 65.359856] 0000000000000000 0000000000000000 ffff88006f276938 ffff88006f2768c0 > [ 65.368143] ffff88006f2769a8 ffff88007702fe00 ffffffff81736f5f ffff88006f2769a8 > [ 65.376447] Call Trace: > [ 65.379176] [] process_rx_w+0xcf/0x130 > [ 65.385213] [] process_one_work+0x14a/0x450 > [ 65.391736] [] worker_thread+0x66/0x450 > [ 65.397868] [] ? rescuer_thread+0x2d0/0x2d0 > [ 65.404391] [] ? rescuer_thread+0x2d0/0x2d0 > [ 65.410911] [] kthread+0xfd/0x120 > [ 65.416456] [] ? kthread_create_on_node+0x190/0x190 > [ 65.423755] [] ret_from_fork+0x3f/0x70 > [ 65.429785] [] ? kthread_create_on_node+0x190/0x190 > [ 65.437077] Code: 4c 89 c9 41 83 e9 01 4d 63 c9 4d 01 f1 4c 89 c8 48 f7 f1 8b 83 b0 00 00 00 49 29 d1 4d 89 ce 85 c0 74 04 4c 0f af f0 48 8b 43 18 <80> b8 f0 00 00 00 00 0f 85 78 01 00 00 48 8b 73 20 4c 89 f1 48 > [ 65.458462] RIP [] rx_fill+0x1ed/0x3b0 > [ 65.464493] RSP > [ 65.468388] CR2: 00000000000000f0 > [ 65.472090] ---[ end trace 5a9d1e73247ee2aa ]--- > [ 65.479952] Kernel panic - not syncing: Fatal exception > [ 65.486167] intel_tasks_dumper: intel_task_panic_hndl: Skip tasks dumper. > [ 65.493763] reboot: panic mode set: p,w > [ 65.498045] Kernel Offset: disabled > [ 65.509960] Rebooting in 10 seconds.. > > On spin lock release in rx_submit, gether_disconnect get > a chance to run, it makes port_usb NULL, rx_submit access > NULL port USB, hence the above crash. > > Fixed by releasing the lock in rx_submit after port_usb > is used. > > Signed-off-by: Kiruthika Varadarajan > --- > drivers/usb/gadget/function/u_ether.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c > index 737bd77..76cf1e4 100644 > --- a/drivers/usb/gadget/function/u_ether.c > +++ b/drivers/usb/gadget/function/u_ether.c > @@ -186,11 +186,11 @@ static void defer_kevent(struct eth_dev *dev, int flag) > out = dev->port_usb->out_ep; > else > out = NULL; > - spin_unlock_irqrestore(&dev->lock, flags); > > - if (!out) > + if (!out) { > + spin_unlock_irqrestore(&dev->lock, flags); > return -ENOTCONN; > - > + } > > /* Padding up to RX_EXTRA handles minor disagreements with host. > * Normally we use the USB "terminate on short read" convention; > @@ -215,6 +215,7 @@ static void defer_kevent(struct eth_dev *dev, int flag) > if (dev->port_usb->is_fixed) > size = max_t(size_t, size, dev->port_usb->fixed_out_len); > > + spin_unlock_irqrestore(&dev->lock, flags); > skb = __netdev_alloc_skb(dev->net, size + NET_IP_ALIGN, gfp_flags); > if (skb == NULL) { > DBG(dev, "no rx skb\n"); > -- Doesn't apply. Please rebase and resend. checking file drivers/usb/gadget/function/u_ether.c Hunk #1 FAILED at 186. Hunk #2 succeeded at 217 with fuzz 2 (offset 2 lines). 1 out of 2 hunks FAILED -- balbi