Received: by 2002:a25:7ec1:0:0:0:0:0 with SMTP id z184csp3304185ybc; Mon, 18 Nov 2019 12:57:54 -0800 (PST) X-Google-Smtp-Source: APXvYqz3HEvqwks1M4gKQ0K5TiR0btUcqyjqp+ukuall+Y9XK1e71riY0JnVqefeEg+w+VyESd1s X-Received: by 2002:a17:906:8591:: with SMTP id v17mr29719662ejx.185.1574110674319; Mon, 18 Nov 2019 12:57:54 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1574110674; cv=none; d=google.com; s=arc-20160816; b=OhEMQhhUshVlwwHxhs22LktKaqVOxK5hrkaCUMkfHx7sC3RpFFduOkDlvIftRPWqj+ 6M5LmneK7O8h39j/JiCLDJRdBDSFcnvfsScDXeeMYcfki0MWYvbdwygIvUiyLFM4IZFq sYOfJXh40MuQEc6J6jZElRHck4RIZtcFRx2xttFUeZpiubGWNeMgRP3IG6N5FPD6r5Vb w9CC5AFSMfXzR5TQbbRNrhdbwcRxbL74+vDxbDl1uopAXopZutlICGHgUhYd4a3k7Uc7 ZzfIQW0iYSL7s2dDU8d3BwWF7t6buUHLqmV9WrlsLzOnSt9ydCf/7ieA5dQl5rBC/tPc UvcQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:message-id:in-reply-to :subject:cc:to:from:date; bh=3G9JvwiTI2PUFKoaSwQXE/3OFIFaYyLaZ5zs42j4qP4=; b=fuLNgx8hJAgp9uURh3ZzcgX1s8EVYUE7c3BOpVZsdhqQhhZbWOWcX7RgP3iTlNuh9b sZbgpWwKBE3ixpQdsXY/wiicrXSx5nX9aDKNLmTPj+7bAm80/lwsDHDa6V4ZlKznG3AH G7+A0LDlU1SJzvW2TODQWkOXswuDVMGC6CbuhOsHpNYg7KDHghwllNSuNctFzusZNdsj hpNtf6uJkJYZQ+BaKUhVObE6CseN05cEbv5dEh0QcuU4w/Co3mH9i59PV8KhJKla+3kW OZ4GtRM3U76IUFYc1fNkrS4piJX872GRH0CJcwD8kqRT6ec3uAUMH2rKhDjv4H4jtury gO/Q== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id qn4si12452393ejb.329.2019.11.18.12.57.28; Mon, 18 Nov 2019 12:57:54 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727050AbfKRU4H (ORCPT + 99 others); Mon, 18 Nov 2019 15:56:07 -0500 Received: from iolanthe.rowland.org ([192.131.102.54]:34752 "HELO iolanthe.rowland.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with SMTP id S1726475AbfKRU4G (ORCPT ); Mon, 18 Nov 2019 15:56:06 -0500 Received: (qmail 4606 invoked by uid 2102); 18 Nov 2019 15:56:05 -0500 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 18 Nov 2019 15:56:05 -0500 Date: Mon, 18 Nov 2019 15:56:05 -0500 (EST) From: Alan Stern X-X-Sender: stern@iolanthe.rowland.org To: Michael Olbrich , Felipe Balbi cc: Peter Chen , "linux-usb@vger.kernel.org" , Greg Kroah-Hartman , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH] usb: gadget: composite: split spinlock to avoid recursion In-Reply-To: <20191114132330.iw4ucbfaxofi6cfy@pengutronix.de> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 14 Nov 2019, Michael Olbrich wrote: > On Wed, Nov 13, 2019 at 10:36:25AM -0500, Alan Stern wrote: > > On Wed, 13 Nov 2019, Peter Chen wrote: > > > On 19-11-12 10:33:18, Michael Olbrich wrote: > > > > 'delayed_status' and 'deactivations' are used completely independent but > > > > they share the same spinlock. This can result in spinlock recursion: > > > > > > > > BUG: spinlock recursion on CPU#1, uvc-gadget/322 > > > > lock: 0xffffffc0570364e0, .magic: dead4ead, .owner: uvc-gadget/322, .owner_cpu: 1 > > > > CPU: 1 PID: 322 Comm: uvc-gadget Tainted: G C O 5.3.0-20190916-1+ #55 > > > > Hardware name: XXXXX (DT) > > > > Call trace: > > > > dump_backtrace+0x0/0x178 > > > > show_stack+0x24/0x30 > > > > dump_stack+0xc0/0x104 > > > > spin_dump+0x90/0xa0 > > > > do_raw_spin_lock+0xd8/0x108 > > > > _raw_spin_lock_irqsave+0x40/0x50 > > > > composite_disconnect+0x2c/0x80 > > > > usb_gadget_disconnect+0x84/0x150 > > > > usb_gadget_deactivate+0x64/0x120 > > > > usb_function_deactivate+0x70/0x80 > > > > uvc_function_disconnect+0x20/0x58 > > > > uvc_v4l2_release+0x34/0x90 > > > > v4l2_release+0xbc/0xf0 > > > > __fput+0xb0/0x218 > > > > ____fput+0x20/0x30 > > > > task_work_run+0xa0/0xd0 > > > > do_notify_resume+0x2f4/0x340 > > > > work_pending+0x8/0x14 > > > > > > > > Fix this by using separate spinlocks. > > > > > > This issue may be introduced by 0a55187a1ec8c ("USB: gadget core: Issue > > > ->disconnect() callback from usb_gadget_disconnect()"), which adds > > > gadget's disconnect at usb_gadget_disconnect. Add Alan, if he is Ok > > > with your patch, you may cc to stable tree. > > > > I wasn't aware of the dual usage of that lock in the composite core > > (and 0a55187a1ec8c touches only the gadget core, not composite.c). > > > > In any case, I don't have a good feel for how the locking is supposed > > to work in the composite core. This is really something Felipe should > > look at. > > > > Would a better fix be to change usb_function_deactivate() so that it > > doesn't hold the lock while calling usb_gadget_deactivate()? Maybe > > increment cdev->deactivations unconditionally before dropping the lock > > (for mutual exclusion) and then decrement it again if the call fails? > > Hmm, I think, that would mean that usb_gadget_activate() may be called > while usb_gadget_deactivate() is still running right? That's not > acceptable, is it? It's a little tricky. The lock in question belongs to the composite core, not the UDC core, so it doesn't really apply to the usb_gadget_{de}activate() routines. As for mutual exclusion of usb_gadget_activate() and usb_gadget_deactivate(), I don't know that anyone has ever considered the matter. > Anyways. Something else is needed because executing usb_gadget_deactivate() > under the spinlock has another problem. It's hard to reproduce, but we've > seen this one: > > BUG: scheduling while atomic: pipewire/260/0x00000002 > Modules linked in: allegro(C) regmap_mmio v4l2_mem2mem xlnx_vcu st1232 uio_pdrv_genirq > Preemption disabled at: [] usb_function_deactivate+0x30/0x80 > CPU: 1 PID: 260 Comm: pipewire Tainted: G C O 5.3.0-20191112-1 #2 > Hardware name: Wolfvision ZynqMP PF4 (DT) > Call trace: > dump_backtrace+0x0/0x178 > show_stack+0x24/0x30 > dump_stack+0xc0/0x104 > __schedule_bug+0xb0/0xc0 > __schedule+0x354/0x4d8 > schedule+0x44/0xd8 > schedule_timeout+0x1b4/0x380 > wait_for_common+0xc0/0x188 > wait_for_completion_timeout+0x2c/0x38 > dwc3_gadget_pullup+0x90/0xb0 > usb_gadget_disconnect+0x38/0x150 > usb_gadget_deactivate+0x64/0x120 > usb_function_deactivate+0x70/0x80 > uvc_function_disconnect+0x20/0x58 > uvc_v4l2_release+0x34/0x90 > v4l2_release+0xbc/0xf0 > __fput+0x90/0x208 > ____fput+0x20/0x30 > task_work_run+0x98/0xb8 > do_notify_resume+0x2f4/0x340 > work_pending+0x8/0x14 > dwc3 fe200000.usb: timed out waiting for SETUP phase > > Or maybe it's incorrect for dwc3_gadget_pullup() to sleep? It isn't documented, so there's no definitive answer. My feeling is that the UDC driver pullup routines should not sleep, but that's not official. Of course, Felipe should have the last word on this. Alan Stern