Received: by 2002:a25:7ec1:0:0:0:0:0 with SMTP id z184csp3187846ybc; Thu, 14 Nov 2019 05:25:42 -0800 (PST) X-Google-Smtp-Source: APXvYqyBRt7LtD46lsT32c+10w6a3Unbky4w4somcSEiHXuG4KK0CfpLRLNlrAjtT5FqptOZZMqS X-Received: by 2002:a17:906:68d9:: with SMTP id y25mr8594164ejr.136.1573737942149; Thu, 14 Nov 2019 05:25:42 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1573737942; cv=none; d=google.com; s=arc-20160816; b=SfNXzxDDpe0PbW1v/tPSnZ6BmG5tSZXU9DcxRuwsNd03eoP7ey3ycvfUJo/ouK9G1W e0gR+eD3J5SKoVm+IeEBd/drIkOxA4lYjyn7XDq5+g1nIF7PWIpQc9IT7kEcviQqnPwP 3mpl2HkKtaG586MkJvkGVEtzQdYDso5V+2uTIWm7PZFBxTe1M0iCaxP6So09vB++/4x+ 2QZuGhwhcEsD701fFXOKbIGhHu7NGEJw7KE3j8J9PWW8EzU4tczTwmJdaWLFu9rylcFd qSoaVnSwKnzmPd712BQ+CKGtK/nefp2F1toDpppp2gCy0eHctevO3/sw36j585mBUNgv wwaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:user-agent:in-reply-to :content-transfer-encoding:content-disposition:mime-version :references:mail-followup-to:message-id:subject:cc:to:from:date; bh=gHTU2TR02mSNCEU4ePE7TUgjohXDO1xHXq+ZA+IafSY=; b=AEx+lxdWD8yNoM5ckN131Wkgud9B1GoRIy0/M9N4tiKL/CpadRs6Rocg0BSrZ6Cm2s SbpdvAHtrF6gjOJaN+Rm5NaZYTyUKHzJeHuEKYUnicmWLAB12W5UTA/1XoirARCaPbav NSPkjvzDOJVKEj67iJTwZFT5nkq6+k54iuznicvACZr6KDeXR6Jc3LYt+3SUvct88AU7 SNtgCgsrNfvXUfN6kEtejurycJWNytlHZHCRDTJEcegNOokTm89BLFS1PAv0fV9kUB5p azj6HKIZi89Qk0HEzCgZk8vF1MrTA03sNthHdEzpzylZMdkGf1/N7eOCUVpnFMw5XrcL 4YHg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d12si3654227edy.39.2019.11.14.05.25.16; Thu, 14 Nov 2019 05:25:42 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727064AbfKNNXg convert rfc822-to-8bit (ORCPT + 99 others); Thu, 14 Nov 2019 08:23:36 -0500 Received: from metis.ext.pengutronix.de ([85.220.165.71]:57469 "EHLO metis.ext.pengutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726139AbfKNNXg (ORCPT ); Thu, 14 Nov 2019 08:23:36 -0500 Received: from ptx.hi.pengutronix.de ([2001:67c:670:100:1d::c0]) by metis.ext.pengutronix.de with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1iVF5v-0005VS-Fn; Thu, 14 Nov 2019 14:23:31 +0100 Received: from mol by ptx.hi.pengutronix.de with local (Exim 4.89) (envelope-from ) id 1iVF5u-0003tK-Fh; Thu, 14 Nov 2019 14:23:30 +0100 Date: Thu, 14 Nov 2019 14:23:30 +0100 From: Michael Olbrich To: Alan Stern Cc: Peter Chen , "linux-usb@vger.kernel.org" , Felipe Balbi , Greg Kroah-Hartman , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] usb: gadget: composite: split spinlock to avoid recursion Message-ID: <20191114132330.iw4ucbfaxofi6cfy@pengutronix.de> Mail-Followup-To: Alan Stern , Peter Chen , "linux-usb@vger.kernel.org" , Felipe Balbi , Greg Kroah-Hartman , "linux-kernel@vger.kernel.org" References: <20191113063414.GA30608@b29397-desktop> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: 8BIT In-Reply-To: X-Sent-From: Pengutronix Hildesheim X-URL: http://www.pengutronix.de/ X-IRC: #ptxdist @freenode X-Accept-Language: de,en X-Accept-Content-Type: text/plain X-Uptime: 14:17:51 up 129 days, 19:28, 139 users, load average: 0.05, 0.13, 0.13 User-Agent: NeoMutt/20170113 (1.7.2) X-SA-Exim-Connect-IP: 2001:67c:670:100:1d::c0 X-SA-Exim-Mail-From: mol@pengutronix.de X-SA-Exim-Scanned: No (on metis.ext.pengutronix.de); SAEximRunCond expanded to false X-PTX-Original-Recipient: linux-kernel@vger.kernel.org Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Nov 13, 2019 at 10:36:25AM -0500, Alan Stern wrote: > On Wed, 13 Nov 2019, Peter Chen wrote: > > On 19-11-12 10:33:18, Michael Olbrich wrote: > > > 'delayed_status' and 'deactivations' are used completely independent but > > > they share the same spinlock. This can result in spinlock recursion: > > > > > > BUG: spinlock recursion on CPU#1, uvc-gadget/322 > > > lock: 0xffffffc0570364e0, .magic: dead4ead, .owner: uvc-gadget/322, .owner_cpu: 1 > > > CPU: 1 PID: 322 Comm: uvc-gadget Tainted: G C O 5.3.0-20190916-1+ #55 > > > Hardware name: XXXXX (DT) > > > Call trace: > > > dump_backtrace+0x0/0x178 > > > show_stack+0x24/0x30 > > > dump_stack+0xc0/0x104 > > > spin_dump+0x90/0xa0 > > > do_raw_spin_lock+0xd8/0x108 > > > _raw_spin_lock_irqsave+0x40/0x50 > > > composite_disconnect+0x2c/0x80 > > > usb_gadget_disconnect+0x84/0x150 > > > usb_gadget_deactivate+0x64/0x120 > > > usb_function_deactivate+0x70/0x80 > > > uvc_function_disconnect+0x20/0x58 > > > uvc_v4l2_release+0x34/0x90 > > > v4l2_release+0xbc/0xf0 > > > __fput+0xb0/0x218 > > > ____fput+0x20/0x30 > > > task_work_run+0xa0/0xd0 > > > do_notify_resume+0x2f4/0x340 > > > work_pending+0x8/0x14 > > > > > > Fix this by using separate spinlocks. > > > > This issue may be introduced by 0a55187a1ec8c ("USB: gadget core: Issue > > ->disconnect() callback from usb_gadget_disconnect()"), which adds > > gadget's disconnect at usb_gadget_disconnect. Add Alan, if he is Ok > > with your patch, you may cc to stable tree. > > I wasn't aware of the dual usage of that lock in the composite core > (and 0a55187a1ec8c touches only the gadget core, not composite.c). > > In any case, I don't have a good feel for how the locking is supposed > to work in the composite core. This is really something Felipe should > look at. > > Would a better fix be to change usb_function_deactivate() so that it > doesn't hold the lock while calling usb_gadget_deactivate()? Maybe > increment cdev->deactivations unconditionally before dropping the lock > (for mutual exclusion) and then decrement it again if the call fails? Hmm, I think, that would mean that usb_gadget_activate() may be called while usb_gadget_deactivate() is still running right? That's not acceptable, is it? Anyways. Something else is needed because executing usb_gadget_deactivate() under the spinlock has another problem. It's hard to reproduce, but we've seen this one: BUG: scheduling while atomic: pipewire/260/0x00000002 Modules linked in: allegro(C) regmap_mmio v4l2_mem2mem xlnx_vcu st1232 uio_pdrv_genirq Preemption disabled at: [] usb_function_deactivate+0x30/0x80 CPU: 1 PID: 260 Comm: pipewire Tainted: G C O 5.3.0-20191112-1 #2 Hardware name: Wolfvision ZynqMP PF4 (DT) Call trace: dump_backtrace+0x0/0x178 show_stack+0x24/0x30 dump_stack+0xc0/0x104 __schedule_bug+0xb0/0xc0 __schedule+0x354/0x4d8 schedule+0x44/0xd8 schedule_timeout+0x1b4/0x380 wait_for_common+0xc0/0x188 wait_for_completion_timeout+0x2c/0x38 dwc3_gadget_pullup+0x90/0xb0 usb_gadget_disconnect+0x38/0x150 usb_gadget_deactivate+0x64/0x120 usb_function_deactivate+0x70/0x80 uvc_function_disconnect+0x20/0x58 uvc_v4l2_release+0x34/0x90 v4l2_release+0xbc/0xf0 __fput+0x90/0x208 ____fput+0x20/0x30 task_work_run+0x98/0xb8 do_notify_resume+0x2f4/0x340 work_pending+0x8/0x14 dwc3 fe200000.usb: timed out waiting for SETUP phase Or maybe it's incorrect for dwc3_gadget_pullup() to sleep? Regards, Michael -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |