Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753128AbcD1PqX (ORCPT ); Thu, 28 Apr 2016 11:46:23 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:51517 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753077AbcD1PqU (ORCPT ); Thu, 28 Apr 2016 11:46:20 -0400 Message-ID: <1461858373.1169.42.camel@decadent.org.uk> Subject: Re: [PATCH 3.16 167/217] usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done() From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: akpm@linux-foundation.org, Yoshihiro Shimoda , Felipe Balbi Date: Thu, 28 Apr 2016 17:46:13 +0200 In-Reply-To: References: Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-6jJE81p41DlGiQr/3vqE" X-Mailer: Evolution 3.18.5.1-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 195.245.225.248 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3378 Lines: 91 --=-6jJE81p41DlGiQr/3vqE Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2016-04-27 at 01:02 +0200, Ben Hutchings wrote: > 3.16.35-rc1 review patch.=C2=A0=C2=A0If anyone has any objections, please= let me know. Also dropping this from 3.16-longterm. Ben. > ------------------ >=20 > From: Yoshihiro Shimoda >=20 > commit 4fccb0767fdbdb781a9c5b5c15ee7b219443c89d upstream. >=20 > This patch fixes an issue that usbhsg_queue_done() may cause kernel > panic when dma callback is running and usb_ep_disable() is called > by interrupt handler. (Especially, we can reproduce this issue using > g_audio with usb-dmac driver.) >=20 > For example of a flow: > =C2=A0usbhsf_dma_complete (on tasklet) > =C2=A0 --> usbhsf_pkt_handler (on tasklet) > =C2=A0=C2=A0=C2=A0--> usbhsg_queue_done (on tasklet) > =C2=A0=C2=A0=C2=A0=C2=A0*** interrupt happened and usb_ep_disable() is ca= lled *** > =C2=A0=C2=A0=C2=A0=C2=A0--> usbhsg_queue_pop (on tasklet) > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0Then, oops happened. >=20 > Fixes: e73a989 ("usb: renesas_usbhs: add DMAEngine support") > Signed-off-by: Yoshihiro Shimoda > Signed-off-by: Felipe Balbi > Signed-off-by: Ben Hutchings > --- > =C2=A0drivers/usb/renesas_usbhs/mod_gadget.c | 6 +++++- > =C2=A01 file changed, 5 insertions(+), 1 deletion(-) >=20 > --- a/drivers/usb/renesas_usbhs/mod_gadget.c > +++ b/drivers/usb/renesas_usbhs/mod_gadget.c > @@ -137,10 +137,14 @@ static void usbhsg_queue_done(struct usb > =C2=A0 struct usbhs_pipe *pipe =3D pkt->pipe; > =C2=A0 struct usbhsg_uep *uep =3D usbhsg_pipe_to_uep(pipe); > =C2=A0 struct usbhsg_request *ureq =3D usbhsg_pkt_to_ureq(pkt); > + unsigned long flags; > =C2=A0 > =C2=A0 ureq->req.actual =3D pkt->actual; > =C2=A0 > - usbhsg_queue_pop(uep, ureq, 0); > + usbhs_lock(priv, flags); > + if (uep) > + __usbhsg_queue_pop(uep, ureq, 0); > + usbhs_unlock(priv, flags); > =C2=A0} > =C2=A0 > =C2=A0static void usbhsg_queue_push(struct usbhsg_uep *uep, >=20 > -- > To unsubscribe from this list: send the line "unsubscribe stable" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at=C2=A0=C2=A0http://vger.kernel.org/majordomo-info.h= tml --=20 Ben Hutchings All extremists should be taken out and shot. --=-6jJE81p41DlGiQr/3vqE Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAABCgAGBQJXIjBFAAoJEOe/yOyVhhEJ4ZkP/jKGGDJf3bPTxPDOYoa2/b3H hQcrRwMnhp5xvfZYkbEMuANV696v4Z9osZRaqpDYzgQdHr4j+tLG19E+a6bNEPVg FntUv2nsacAk14u4+7bX7ZxAQOnosLYdiMj+KeY9FGFkbJ2LzABq+pwbzv00DmCZ Vl/TrUSAlTTdJeGH4fuAPKsdiwhubwVwWmFLEtidKeFfDE9Aq2o/JcAkDfvp7a45 lgTTEWfUx1op+opwuaXwDgyCQj+k14c0zLjVszS0zLEVV7kgeh2mMBqN+ApOvkPL mYea3M1G+FzQuhThhW1YAwVvx5YXpetQCJHkhqY09ytgG4w/C9mmNE6tlmbwu78H RICGCoj6Qid8Dd3bMrq0alQlYstTPIgdpalfdU8OFhcIJxZn2an2GDfCy2Bq6X+f 78BidBfcOEfTJAYGc0Z1nm3z9XebfCCsBPFCQuDTgzv06mvtYqVI+rWEl1wP1Zwp WwTSR8YPhsZBYEbZ/BjhR5626uMObPBbUXgo731rAVrttXmh4p7pnb2sbQEE1xes FOEUTCriuj8W1zE74tuKXLRM3RPe24at4VgcZUBdEMXToFw+17Ay/QkdhLszO9zr XWVRObvDk9nfZipu4FZbb6n714qVhlAmX3tqaq19iMX1maWXBcRMBGoRa/WM07tb J0/FzL7DJmoWA86s/iM3 =YYti -----END PGP SIGNATURE----- --=-6jJE81p41DlGiQr/3vqE--