Received: by 2002:a25:ab43:0:0:0:0:0 with SMTP id u61csp330456ybi; Fri, 7 Jun 2019 08:44:46 -0700 (PDT) X-Google-Smtp-Source: APXvYqytnmoYpMoOKmQk/r3OENiQ4h4rdizuu24G+hWx7dcW06CZ9dEn2eHuGYDK8LhQzOYDbGJg X-Received: by 2002:a63:fa4a:: with SMTP id g10mr3326925pgk.147.1559922285859; Fri, 07 Jun 2019 08:44:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1559922285; cv=none; d=google.com; s=arc-20160816; b=z9zJTckEKyM2xGOHV2Taj2JEcSdyaVlKsms5mndUSYtGBPocMaI7nZnpaf1M2lIy6D mpuSHKW/HvLKIxeF7H6tU3wR1bUPcGQLQxO6RkRtGuOYy4ejA1MrRQbINBOCprZD6wV5 ZgpejoZyYGPgeC1/KjRAJR85bSSURsVYwy+KMJde2JK728Br8KSba2k+SNg5WbpCHSAt rHtRQdyp3DJrEdWrhLidirrN4ln/su4j3Yr8q4rcRpQNtbx2hH5rFH8MHvt82mPzjCNa 2eH3g3POL7YQgs0JfewRpq8OOUbqdEbw9hSYLDj2depTwIsbsZsevoKa30Axc/LCi/EN JMtA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=7heCEBHsi+NrbxzC1Fi63zqVFreAEXxRN0B7P4xWrdQ=; b=tq4L40YIrH1z56TeVu6yL4ec/oTjzQ0QavUCcuop7QLr1e2dqljBY7OPmQFF64fBjG WA8I2EIV/T2JgypsfHV9qb57zAqoEs5KGQmuCrUGCh7JUoZDmuf9w6RIs9waKe9RtNcB RXGX6LOyv6QIxZfMg9LjpuUI0ObQCXoCZsB6c0TGVCJtVzwCR5svvXUs5K1tydLGltz4 43BlPHNm+3hht/INiaI0qJdc2VEBvxA8t+4tvUoAG420Es9AmA46FRvrkd+1WLVNpr1A 96naoraekbx59xTn11eitOYJv5p/z9sn+TeQKiH/ZmWXvL/pyfzP23S6GX55JaoupuCc kDzA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=XeY1BeqZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 31si2244567plj.269.2019.06.07.08.44.29; Fri, 07 Jun 2019 08:44:45 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=XeY1BeqZ; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730468AbfFGPmH (ORCPT + 99 others); Fri, 7 Jun 2019 11:42:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:52230 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730435AbfFGPl6 (ORCPT ); Fri, 7 Jun 2019 11:41:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2BCF8212F5; Fri, 7 Jun 2019 15:41:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1559922117; bh=EdqMXB/LkJXXb5W/6cJPXjnwSD3wjlesuDYPuMt2eyI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XeY1BeqZtztJzcceDeRleKwX3PHQHgAg37nrH4JtHqI7iE+Wz3Qmyo3TSYIjw3xjY 5IAFGyNLCgHepXPZ4+qFaNJnI9In/1/0CKpRaUbjN7nr8QVno2BJDCZ3dMeRvTa+cH N/ht0jkOOuE5fiLIN55oNPR9CcD1gn98D2yqPyfc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Jan=20Kl=C3=B6tzke?= , "David S. Miller" Subject: [PATCH 4.14 07/69] usbnet: fix kernel crash after disconnect Date: Fri, 7 Jun 2019 17:38:48 +0200 Message-Id: <20190607153849.161567094@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190607153848.271562617@linuxfoundation.org> References: <20190607153848.271562617@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Kloetzke Jan [ Upstream commit ad70411a978d1e6e97b1e341a7bde9a79af0c93d ] When disconnecting cdc_ncm the kernel sporadically crashes shortly after the disconnect: [ 57.868812] Unable to handle kernel NULL pointer dereference at virtual address 00000000 ... [ 58.006653] PC is at 0x0 [ 58.009202] LR is at call_timer_fn+0xec/0x1b4 [ 58.013567] pc : [<0000000000000000>] lr : [] pstate: 00000145 [ 58.020976] sp : ffffff8008003da0 [ 58.024295] x29: ffffff8008003da0 x28: 0000000000000001 [ 58.029618] x27: 000000000000000a x26: 0000000000000100 [ 58.034941] x25: 0000000000000000 x24: ffffff8008003e68 [ 58.040263] x23: 0000000000000000 x22: 0000000000000000 [ 58.045587] x21: 0000000000000000 x20: ffffffc68fac1808 [ 58.050910] x19: 0000000000000100 x18: 0000000000000000 [ 58.056232] x17: 0000007f885aff8c x16: 0000007f883a9f10 [ 58.061556] x15: 0000000000000001 x14: 000000000000006e [ 58.066878] x13: 0000000000000000 x12: 00000000000000ba [ 58.072201] x11: ffffffc69ff1db30 x10: 0000000000000020 [ 58.077524] x9 : 8000100008001000 x8 : 0000000000000001 [ 58.082847] x7 : 0000000000000800 x6 : ffffff8008003e70 [ 58.088169] x5 : ffffffc69ff17a28 x4 : 00000000ffff138b [ 58.093492] x3 : 0000000000000000 x2 : 0000000000000000 [ 58.098814] x1 : 0000000000000000 x0 : 0000000000000000 ... [ 58.205800] [< (null)>] (null) [ 58.210521] [] expire_timers+0xa0/0x14c [ 58.215937] [] run_timer_softirq+0xe8/0x128 [ 58.221702] [] __do_softirq+0x298/0x348 [ 58.227118] [] irq_exit+0x74/0xbc [ 58.232009] [] __handle_domain_irq+0x78/0xac [ 58.237857] [] gic_handle_irq+0x80/0xac ... The crash happens roughly 125..130ms after the disconnect. This correlates with the 'delay' timer that is started on certain USB tx/rx errors in the URB completion handler. The problem is a race of usbnet_stop() with usbnet_start_xmit(). In usbnet_stop() we call usbnet_terminate_urbs() to cancel all URBs in flight. This only makes sense if no new URBs are submitted concurrently, though. But the usbnet_start_xmit() can run at the same time on another CPU which almost unconditionally submits an URB. The error callback of the new URB will then schedule the timer after it was already stopped. The fix adds a check if the tx queue is stopped after the tx list lock has been taken. This should reliably prevent the submission of new URBs while usbnet_terminate_urbs() does its job. The same thing is done on the rx side even though it might be safe due to other flags that are checked there. Signed-off-by: Jan Klötzke Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/usbnet.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -508,6 +508,7 @@ static int rx_submit (struct usbnet *dev if (netif_running (dev->net) && netif_device_present (dev->net) && + test_bit(EVENT_DEV_OPEN, &dev->flags) && !test_bit (EVENT_RX_HALT, &dev->flags) && !test_bit (EVENT_DEV_ASLEEP, &dev->flags)) { switch (retval = usb_submit_urb (urb, GFP_ATOMIC)) { @@ -1433,6 +1434,11 @@ netdev_tx_t usbnet_start_xmit (struct sk spin_unlock_irqrestore(&dev->txq.lock, flags); goto drop; } + if (netif_queue_stopped(net)) { + usb_autopm_put_interface_async(dev->intf); + spin_unlock_irqrestore(&dev->txq.lock, flags); + goto drop; + } #ifdef CONFIG_PM /* if this triggers the device is still a sleep */