Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753045AbcD1PqF (ORCPT ); Thu, 28 Apr 2016 11:46:05 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:51512 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752367AbcD1PqB (ORCPT ); Thu, 28 Apr 2016 11:46:01 -0400 Message-ID: <1461858347.1169.41.camel@decadent.org.uk> Subject: Re: [PATCH 3.2 071/115] usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done() From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: akpm@linux-foundation.org, Felipe Balbi , Yoshihiro Shimoda Date: Thu, 28 Apr 2016 17:45:47 +0200 In-Reply-To: References: Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-GXHdizyKc+Gboc8ts8uo" X-Mailer: Evolution 3.18.5.1-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 195.245.225.248 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3405 Lines: 91 --=-GXHdizyKc+Gboc8ts8uo Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2016-04-27 at 01:02 +0200, Ben Hutchings wrote: > 3.2.80-rc1 review patch.=C2=A0=C2=A0If anyone has any objections, please = let me know. I'm dropping this as it depends on other changes to renesas_usbhs. Ben. > ------------------ >=20 > From: Yoshihiro Shimoda >=20 > commit 4fccb0767fdbdb781a9c5b5c15ee7b219443c89d upstream. >=20 > This patch fixes an issue that usbhsg_queue_done() may cause kernel > panic when dma callback is running and usb_ep_disable() is called > by interrupt handler. (Especially, we can reproduce this issue using > g_audio with usb-dmac driver.) >=20 > For example of a flow: > =C2=A0usbhsf_dma_complete (on tasklet) > =C2=A0 --> usbhsf_pkt_handler (on tasklet) > =C2=A0=C2=A0=C2=A0--> usbhsg_queue_done (on tasklet) > =C2=A0=C2=A0=C2=A0=C2=A0*** interrupt happened and usb_ep_disable() is ca= lled *** > =C2=A0=C2=A0=C2=A0=C2=A0--> usbhsg_queue_pop (on tasklet) > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Then, oops happened. >=20 > Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support") > Signed-off-by: Yoshihiro Shimoda > Signed-off-by: Felipe Balbi > Signed-off-by: Ben Hutchings > --- > =C2=A0drivers/usb/renesas_usbhs/mod_gadget.c | 6 +++++- > =C2=A01 file changed, 5 insertions(+), 1 deletion(-) >=20 > --- a/drivers/usb/renesas_usbhs/mod_gadget.c > +++ b/drivers/usb/renesas_usbhs/mod_gadget.c > @@ -146,10 +146,14 @@ static void usbhsg_queue_done(struct usb > =C2=A0 struct usbhs_pipe *pipe =3D pkt->pipe; > =C2=A0 struct usbhsg_uep *uep =3D usbhsg_pipe_to_uep(pipe); > =C2=A0 struct usbhsg_request *ureq =3D usbhsg_pkt_to_ureq(pkt); > + unsigned long flags; > =C2=A0 > =C2=A0 ureq->req.actual =3D pkt->actual; > =C2=A0 > - usbhsg_queue_pop(uep, ureq, 0); > + usbhs_lock(priv, flags); > + if (uep) > + __usbhsg_queue_pop(uep, ureq, 0); > + usbhs_unlock(priv, flags); > =C2=A0} > =C2=A0 > =C2=A0static void usbhsg_queue_push(struct usbhsg_uep *uep, >=20 > -- > To unsubscribe from this list: send the line "unsubscribe stable" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at=C2=A0=C2=A0http://vger.kernel.org/majordomo-info.h= tml --=20 Ben Hutchings All extremists should be taken out and shot. --=-GXHdizyKc+Gboc8ts8uo Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCgAGBQJXIjArAAoJEOe/yOyVhhEJ5hUP/icyeQq04zUgdpYK/mkHCbIW jfzVEAHYEQW78Arn8gFfMqhjsRFCPOTw5XihPCiBabOj5LZtgTsMOw1BrNP2DDjV mAD0+XhPGRtwz/8OVI8jhwrWWStVMopU26ixr6ncWiQxZoud0Y7gjgk3BZ+Hap8t NLNxcGAz8FYtvwL9E0BbAPXKWOr3Wra8MMVLc4mdSHb2X78QHLQKdYH46Dew5lmr I1g0qvX+P1RJlO3ZIDmSyUdMtL9jvVgKZkx7E4Yv0QKlYjjSc2cRsOPkpVz4xzNZ zP/rb+vMNUAE389AV//zMVAT8hVAvs76Fl0Ezprj+mS9TI398E+yDlmYO/kbeIay SGlhewvClslr7rVUxXqZD+XSAw+rXWiiqCQuMTpZ3fPFVllT635lruHhGejHt9FX U2f57PomTDwxzyUVS4awpZ1IyKxnOkdWqRjRS8YH6J6yowQ35+Igo6PsOihhnKQQ dVyTFCqfD3YLvuBlShihPLP3jAxxGBqHE+iMeOaMCi5ClN4mNllS+Jqg3PZLc+oG 9WiphZj9xCwjPgcN0b+wHliPfdR9dlgHD7UeqtEMnPqWWzq59wVeTR5otSIOvHIO Jh6eoVrDYbPQ6wW+1XphzP0/8rIKPl8mvG/FBiRLvEDchVVl3/FZrFhUJ67nBEjG kr1uJxSd0mCo4bNMUlmL =QExg -----END PGP SIGNATURE----- --=-GXHdizyKc+Gboc8ts8uo--