Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932328AbcCIMyJ (ORCPT ); Wed, 9 Mar 2016 07:54:09 -0500 Received: from mailout2.w1.samsung.com ([210.118.77.12]:47969 "EHLO mailout2.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752099AbcCIMyC (ORCPT ); Wed, 9 Mar 2016 07:54:02 -0500 X-AuditID: cbfec7f4-f79026d00000418a-58-56e01ce611a1 From: Andrzej Pietrasiewicz Subject: Re: [patch -target tree] usb: gadget: f_tcm: use after free To: "Nicholas A. Bellinger" , Felipe Balbi References: <20160302100848.GC5533@mwanda> <87k2ll856m.fsf@ti.com> <1457162818.19657.282.camel@haakon3.risingtidesystems.com> Cc: Dan Carpenter , Christoph Hellwig , Greg Kroah-Hartman , Sebastian Andrzej Siewior , Bart Van Assche , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, target-devel@vger.kernel.org Message-id: <56E01CE4.5060501@samsung.com> Date: Wed, 09 Mar 2016 13:53:56 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.6.0 MIME-version: 1.0 In-reply-to: <1457162818.19657.282.camel@haakon3.risingtidesystems.com> Content-type: text/plain; charset=utf-8; format=flowed Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFvrNLMWRmVeSWpSXmKPExsVy+t/xK7rPZB6EGVxdxWNxrO0Ju8XBn22M FtMuTmK2eP1vOotF8+L1bBYrVx9lsri8aw6bxaJlrcwWbavPMFq0Ln3L5MDlsWlVJ5vHu3Pn 2D3ubz/C5LF/7hp2j903G9g8Pj69xeIxbc15Jo/Pm+QCOKK4bFJSczLLUov07RK4Mh69P81Y sCq0Yvfh06wNjO3uXYycHBICJhLvn65khbDFJC7cW8/WxcjFISSwlFHi++XrzBDOC0aJQ0tu MoFUsQkYS+w92MEIYgsLuEjM2nibBcQWEQiRaH75jBnEFhKol3iyfQULSDOzwF4miTfXW9lA ErwCWhLvp+1nB7FZBFQlTs1bDdYgKhAh8WTuSUaIGkGJH5PvgQ3lFHCXePvlJVgNs4CZxJeX h1khbHmJzWveMk9gFJiFpGUWkrJZSMoWMDKvYhRNLU0uKE5KzzXUK07MLS7NS9dLzs/dxAiJ ki87GBcfszrEKMDBqMTDG+FyP0yINbGsuDL3EKMEB7OSCO8z6QdhQrwpiZVVqUX58UWlOanF hxilOViUxHnn7nofIiSQnliSmp2aWpBaBJNl4uCUamCsaSjo5M5knXyo88LU7hrHdT7vHI93 3Yl/pdWoL8NePTtkx5fr+ZF+rBvY826kxuZ6l9/f2xNeuFt937VNz175qhw9tDgr3pSJk3VL oPAdB63fb/8531vV7Pu5oaO7soZn4uQvH/Mv5IXwry7IXrCsPD+OqbTwrZEj8w1F5eu2+ksM F14UrFNiKc5INNRiLipOBADuJbQAjgIAAA== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 10731 Lines: 191 Hi Nicholas, W dniu 05.03.2016 o 08:26, Nicholas A. Bellinger pisze: > Hi Felipe + usb-gadget folks, > > On Wed, 2016-03-02 at 13:55 +0200, Felipe Balbi wrote: > > usb-gadget/tcm: Conversion to percpu_ida tag pre-allocation > http://www.spinics.net/lists/target-devel/msg11777.html > > usb-gadget/tcm: Convert to TARGET_SCF_ACK_KREF I/O krefs > http://www.spinics.net/lists/target-devel/msg11782.html > > Felipe, Sebastian, & Andrezj, would you be so kind to review and test > usb-gadget using target-pending/for-next code..? > > Actually I have noticed a problem at 8b00965 "target: Convert demo-mode only drivers to target_alloc_session" I get: [ 1698.406304] configfs-gadget gadget: high-speed config #1: c [ 1698.410547] Using the BOT protocol [ 1698.414163] Missing nexus, ignoring command [ 1698.417944] bot_cmd_complete(309): -22 I think the third message is from f_tcm. It is because tpg->tpg_nexus is not set anymore, because the line tpg->tpg_nexus = tv_nexus; is removed by the commit mentioned above. Restoring this line fixes the problem. Then percpu_ida commit produces the below result (it does not happen immediately, but a while after running the script). I did not bisect, though; I only checked the commits which alter drivers/usb/gadget/function/f_tcm.c. The last one which (almost) works is: 8b00965 "target: Convert demo-mode only drivers to target_alloc_session" AP I used the following script: 8<---------------------------- #!/bin/bash mount -t configfs none /sys/kernel/config modprobe libcomposite cd /sys/kernel/config/usb_gadget mkdir tcm cd tcm mkdir functions/tcm.0 cd /sys/kernel/config/target/ mkdir usb_gadget cd usb_gadget mkdir naa.0123456789abcdef cd naa.0123456789abcdef mkdir tpgt_1 cd tpgt_1 echo naa.01234567890abcdef > nexus echo 1 > enable cd /sys/kernel/config/usb_gadget/tcm mkdir configs/c.1 ln -s functions/tcm.0 configs/c.1 echo 0x0525 > idVendor echo 0x1234 > idProduct echo 12400000.dwc3 > UDC 8<---------------------------- # [ 45.510513] ERR bot_status_complete(73) [ 45.671921] configfs-gadget gadget: high-speed config #1: c [ 45.676158] Using the BOT protocol [ 45.679860] ------------[ cut here ]------------ [ 45.683981] kernel BUG at drivers/target/target_core_transport.c:1476! [ 45.690480] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARM [ 45.696285] Modules linked in: usb_f_tcm libcomposite [ 45.701316] CPU: 2 PID: 1221 Comm: kworker/2:1 Not tainted 4.5.0-rc5+ #171 [ 45.708156] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 45.714258] Workqueue: tcm_usb_gadget bot_cmd_work [usb_f_tcm] [ 45.720030] task: edc1f6c0 ti: ee2d6000 task.ti: ee2d6000 [ 45.725410] PC is at target_submit_cmd_map_sgls+0x1fc/0x20c [ 45.730947] LR is at 0xeea71400 [ 45.734070] pc : [] lr : [] psr: a0000013 [ 45.734070] sp : ee2d7e50 ip : 00000000 fp : c07f8100 [ 45.745505] r10: 00000000 r9 : eefa25c0 r8 : ed593988 [ 45.750705] r7 : ed593b8c r6 : ee00d830 r5 : 00000000 r4 : ed5939e0 [ 45.757204] r3 : bf0144d8 r2 : ed593988 r1 : eea71400 r0 : ed5939e0 [ 45.763705] Flags: NzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 45.770809] Control: 10c5387d Table: 6d44806a DAC: 00000051 [ 45.776528] Process kworker/2:1 (pid: 1221, stack limit = 0xee2d6210) [ 45.782940] Stack: (0xee2d7e50 to 0xee2d8000) [ 45.787276] 7e40: 002293a6 00000000 00000000 00000000 [ 45.795423] 7e60: 00000000 00000000 00000003 00000020 00000000 c0326a60 00000000 00000000 [ 45.803568] 7e80: 00000000 00000020 00000003 00000000 00000000 00000000 00000000 00000000 [ 45.811714] 7ea0: 00000000 00000000 ed5939cc 00000020 ed5939e0 edf6b580 00000000 bf012358 [ 45.819860] 7ec0: 00000000 00000000 00000000 00000020 00000003 00000000 eefa2ac0 ee30da00 [ 45.828006] 7ee0: ed5939cc eefa25c0 eefaaa00 c00369bc edc1f6c0 ee30da00 00000001 ee30da00 [ 45.836151] 7f00: eefa25e4 00000001 eefa25c0 ee30da18 eefa25c0 00000008 c07f8100 c0036c24 [ 45.844297] 7f20: edc1f6c0 eeafefc0 00000000 eeafefc0 00000000 ee30da00 c0036bf8 00000000 [ 45.852442] 7f40: 00000000 00000000 00000000 c003bdf8 fffffffe 00000000 ee2d7f70 ee30da00 [ 45.860587] 7f60: 00000000 00000000 dead4ead ffffffff ffffffff ee2d7f74 ee2d7f74 00000000 [ 45.868733] 7f80: 00000000 dead4ead ffffffff ffffffff ee2d7f90 ee2d7f90 ee2d7fac eeafefc0 [ 45.876878] 7fa0: c003bd20 00000000 00000000 c000f8b8 00000000 00000000 00000000 00000000 [ 45.885023] 7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 45.893169] 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 ffffffff ffffffff [ 45.901324] [] (target_submit_cmd_map_sgls) from [] (target_submit_cmd+0x50/0x58) [ 45.910514] [] (target_submit_cmd) from [] (bot_cmd_work+0x74/0x100 [usb_f_tcm]) [ 45.919623] [] (bot_cmd_work [usb_f_tcm]) from [] (process_one_work+0x120/0x324) [ 45.928703] [] (process_one_work) from [] (worker_thread+0x2c/0x4b4) [ 45.936760] [] (worker_thread) from [] (kthread+0xd8/0xf4) [ 45.943955] [] (kthread) from [] (ret_from_fork+0x14/0x3c) [ 45.951142] Code: ebf3d01a eaffffd0 ebfbc490 eafffff8 (e7f001f2) [ 45.957206] ---[ end trace 21ce9edfaf719456 ]--- [ 45.962132] Unable to handle kernel paging request at virtual address ffffffe0 [ 45.968986] pgd = c0004000 [ 45.971672] [ffffffe0] *pgd=6fffd861, *pte=00000000, *ppte=00000000 [ 45.977913] Internal error: Oops: 37 [#2] PREEMPT SMP ARM [ 45.983282] Modules linked in: usb_f_tcm libcomposite [ 45.988313] CPU: 2 PID: 1221 Comm: kworker/2:1 Tainted: G D 4.5.0-rc5+ #171 [ 45.996367] Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [ 46.002441] task: edc1f6c0 ti: ee2d6000 task.ti: ee2d6000 [ 46.007810] PC is at kthread_data+0x4/0xc [ 46.011797] LR is at wq_worker_sleeping+0xc/0xd8 [ 46.016389] pc : [] lr : [] psr: 00000093 [ 46.016389] sp : ee2d7cc8 ip : 00000000 fp : ee2d7cf4 [ 46.027824] r10: c07f4ac0 r9 : 00000000 r8 : 00000002 [ 46.033024] r7 : c07f85b8 r6 : edc1fa0c r5 : edc1f6c0 r4 : 00000002 [ 46.039523] r3 : 00000000 r2 : 00000000 r1 : 00000002 r0 : edc1f6c0 [ 46.046023] Flags: nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none [ 46.053214] Control: 10c5387d Table: 6d44806a DAC: 00000051 [ 46.058933] Process kworker/2:1 (pid: 1221, stack limit = 0xee2d6210) [ 46.065345] Stack: (0xee2d7cc8 to 0xee2d8000) [ 46.069683] 7cc0: eefa2ac0 c054f544 00000002 ee2d7a2c ee888000 edc1f978 [ 46.077829] 7ce0: ee2d7d00 00000000 edc1f6c0 00000001 ee2d7cfc c054f92c edc1f6c0 c0025404 [ 46.085975] 7d00: ee2d7d00 ee2d7d00 00000001 c07fc4b4 c0834404 0000000b c06a1620 00000000 [ 46.094120] 7d20: edc1f6c0 60000093 c07f8100 c00125d8 ee2d6210 0000000b 07f001f2 c07fc4c8 [ 46.102266] 7d40: e7f001f2 ee2d7e00 c0326a00 c0012f20 00000000 c00090bc 00000006 ffff0a10 [ 46.110411] 7d60: 00000004 00000000 00030001 c0326a00 00000600 ffff0a10 00000000 c083db90 [ 46.118557] 7d80: c08366ac 00000000 c08366ac 00000001 c083dba0 c083db90 00000016 c0222ae8 [ 46.126702] 7da0: ffff3a11 ee2d7db0 c00600d0 c06a862c 0000002d 000a513e 00000002 20000093 [ 46.134848] 7dc0: c07ffe1c 0000015e 00000000 c08361a0 00000006 c0553e58 00000002 0000015e [ 46.142993] 7de0: 00000000 c0326a04 00000000 c0013358 00000000 e7100000 ee2d6000 c0012f20 [ 46.151139] 7e00: ed5939e0 eea71400 ed593988 bf0144d8 ed5939e0 00000000 ee00d830 ed593b8c [ 46.159284] 7e20: ed593988 eefa25c0 00000000 c07f8100 00000000 ee2d7e50 eea71400 c0326a00 [ 46.167430] 7e40: a0000013 ffffffff 00000051 c00504a0 002293a6 00000000 00000000 00000000 [ 46.175575] 7e60: 00000000 00000000 00000003 00000020 00000000 c0326a60 00000000 00000000 [ 46.183720] 7e80: 00000000 00000020 00000003 00000000 00000000 00000000 00000000 00000000 [ 46.191866] 7ea0: 00000000 00000000 ed5939cc 00000020 ed5939e0 edf6b580 00000000 bf012358 [ 46.200011] 7ec0: 00000000 00000000 00000000 00000020 00000003 00000000 eefa2ac0 ee30da00 [ 46.208157] 7ee0: ed5939cc eefa25c0 eefaaa00 c00369bc edc1f6c0 ee30da00 00000001 ee30da00 [ 46.216302] 7f00: eefa25e4 00000001 eefa25c0 ee30da18 eefa25c0 00000008 c07f8100 c0036c24 [ 46.224448] 7f20: edc1f6c0 eeafefc0 00000000 eeafefc0 00000000 ee30da00 c0036bf8 00000000 [ 46.232593] 7f40: 00000000 00000000 00000000 c003bdf8 fffffffe 00000000 ee2d7f70 ee30da00 [ 46.240739] 7f60: 00000000 00000000 dead4ead ffffffff ffffffff ee2d7f74 ee2d7f74 00000001 [ 46.248885] 7f80: 00010001 dead4ead ffffffff ffffffff ee2d7f90 ee2d7f90 ee2d7fac eeafefc0 [ 46.257029] 7fa0: c003bd20 00000000 00000000 c000f8b8 00000000 00000000 00000000 00000000 [ 46.265175] 7fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 [ 46.273321] 7fe0: 00000000 00000000 00000000 00000000 00000013 00000000 ffffffff ffffffff [ 46.281472] [] (kthread_data) from [] (wq_worker_sleeping+0xc/0xd8) [ 46.289450] [] (wq_worker_sleeping) from [] (__schedule+0x260/0x450) [ 46.297503] [] (__schedule) from [] (schedule+0x40/0xac) [ 46.304521] [] (schedule) from [] (do_exit+0x620/0x9c4) [ 46.311454] [] (do_exit) from [] (die+0x20c/0x2e0) [ 46.317950] [] (die) from [] (do_undefinstr+0xb8/0x220) [ 46.324881] [] (do_undefinstr) from [] (__und_svc_finish+0x0/0x20) [ 46.332760] Exception stack(0xee2d7e00 to 0xee2d7e48) [ 46.337792] 7e00: ed5939e0 eea71400 ed593988 bf0144d8 ed5939e0 00000000 ee00d830 ed593b8c [ 46.345937] 7e20: ed593988 eefa25c0 00000000 c07f8100 00000000 ee2d7e50 eea71400 c0326a00 [ 46.354077] 7e40: a0000013 ffffffff [ 46.357552] [] (__und_svc_finish) from [] (target_submit_cmd_map_sgls+0x1fc/0x20c) [ 46.366822] [] (target_submit_cmd_map_sgls) from [] (target_submit_cmd+0x50/0x58) [ 46.376023] [] (target_submit_cmd) from [] (bot_cmd_work+0x74/0x100 [usb_f_tcm]) [ 46.385121] [] (bot_cmd_work [usb_f_tcm]) from [] (process_one_work+0x120/0x324) [ 46.394206] [] (process_one_work) from [] (worker_thread+0x2c/0x4b4) [ 46.402264] [] (worker_thread) from [] (kthread+0xd8/0xf4) [ 46.409456] [] (kthread) from [] (ret_from_fork+0x14/0x3c) [ 46.416647] Code: c003ba54 c06a4010 c0835c50 e5903310 (e5130020) [ 46.422710] ---[ end trace 21ce9edfaf719457 ]--- [ 46.427299] Fixing recursive fault but reboot is needed!