From: Hardik Gajjar <hgajjar@de.adit-jv.com>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: Hardik Gajjar <hgajjar@de.adit-jv.com>,
<quic_kriskura@quicinc.com>, <maze@google.com>,
<quic_linyyuan@quicinc.com>, <linux-usb@vger.kernel.org>,
<linux-kernel@vger.kernel.org>, <guofeng.li@gm.com>,
<hardik.gajjar@bosch.com>, <eugeniu.rosca@bosch.com>
Subject: Re: [PATCH] usb: gadget: f_ncm: Fix Kernel Panic due to access of invalid gadget ptr
Date: Thu, 7 Mar 2024 18:33:27 +0100 [thread overview]
Message-ID: <20240307173327.GA14716@vmlxhi-118.adit-jv.com> (raw)
In-Reply-To: <2024030736-racism-cornflake-63e9@gregkh>
On Thu, Mar 07, 2024 at 04:45:13PM +0000, Greg KH wrote:
> On Thu, Mar 07, 2024 at 05:18:49PM +0100, Hardik Gajjar wrote:
> > In the scenario where the system enters suspend to RAM mode (STR) triggers
> > the disconnection of Dual Role USB Hub, and the UDC platform driver calls
> > usb_del_gadget_udc() to cleanup and delete the associated gadget.
> >
> > However, at this point, the usb0 interface is not yet deleted, leading to
> > a race condition with the TCP/IP stack attempting to access the network
> > device parent (gadget pointer), through operations like the GETLINK net
> > message.
> >
> > This patch addresses the issue by clearing the netdevice's parent device
> > pointer when the ncm unbinds, effectively preventing the race condition
> > during this critical phase.
> >
> > Followinfg is the backtrace of such race condition
> > [ 3566.105792] Call trace:
> > [ 3566.105984] if_nlmsg_size+0x48/0x3b0
> > [ 3566.107497] rtnetlink_rcv_msg+0x1cc/0x408
> > [ 3566.107905] netlink_rcv_skb+0x12c/0x164
> > [ 3566.108264] rtnetlink_rcv+0x18/0x24
> > [ 3566.108851] netlink_unicast_kernel+0xc4/0x14c
> > [ 3566.109192] netlink_unicast+0x210/0x2b0
> > [ 3566.109606] netlink_sendmsg+0x2ec/0x360
> > [ 3566.110046] __sys_sendto+0x1b8/0x25c
> > [ 3566.111594] __arm64_sys_sendto+0x28/0x38
> > [ 3566.112599] el0_svc_common+0xb4/0x19c
> > [ 3566.112978] el0_svc_handler+0x74/0x98
> > [ 3566.113269] el0_svc+0x8/0xc
> >
> > - code: if_nlmsg_size call the following function
> >
> > static inline int rtnl_vfinfo_size(const struct net_device *dev,
> > u32 ext_filter_mask)
> > {
> > // dev->dev.parent is not NULL
> > if (dev->dev.parent && (ext_filter_mask & RTEXT_FILTER_VF)) {
> > // dev_num_vf use the dev->dev.parent->bus lead to kernel panic.
> > int num_vfs = dev_num_vf(dev->dev.parent);
> > size_t size = nla_total_size(0);
> > size += num_vfs *
> > (nla_total_size(0) +
> > nla_total_size(sizeof(struct ifla_vf_mac)) +
> > nla_total_size(sizeof(struct ifla_vf_vlan)) +
> > nla_total_size(0) + /* nest IFLA_VF_VLAN_LIST *
> >
> > Signed-off-by: Hardik Gajjar <hgajjar@de.adit-jv.com>
> > ---
> > drivers/usb/gadget/function/f_ncm.c | 7 +++++++
> > 1 file changed, 7 insertions(+)
>
> What commit id does this fix?
>
> thanks,
>
> greg k-h
Hi Greg,
The network device parent is not being properly cleaned up during unbind since the initial commit of the driver.
In that case, should I mention the First commit ID of the driver as broken commit or
would you advice to say, For example "Clean up netdev parent in unbind".
Thanks,
Hardik
next prev parent reply other threads:[~2024-03-07 17:33 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-07 16:18 [PATCH] usb: gadget: f_ncm: Fix Kernel Panic due to access of invalid gadget ptr Hardik Gajjar
2024-03-07 16:45 ` Greg KH
2024-03-07 17:33 ` Hardik Gajjar [this message]
2024-03-07 17:42 ` Krishna Kurapati PSSNV
2024-03-08 11:55 ` Hardik Gajjar
2024-03-08 12:17 ` Krishna Kurapati PSSNV
2024-03-11 12:04 ` Hardik Gajjar
2024-04-19 13:35 ` Hardik Gajjar
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240307173327.GA14716@vmlxhi-118.adit-jv.com \
--to=hgajjar@de.adit-jv.com \
--cc=eugeniu.rosca@bosch.com \
--cc=gregkh@linuxfoundation.org \
--cc=guofeng.li@gm.com \
--cc=hardik.gajjar@bosch.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=maze@google.com \
--cc=quic_kriskura@quicinc.com \
--cc=quic_linyyuan@quicinc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).