From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751515AbcLENeV (ORCPT ); Mon, 5 Dec 2016 08:34:21 -0500 Received: from mailout4.w1.samsung.com ([210.118.77.14]:52767 "EHLO mailout4.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751161AbcLENeS (ORCPT ); Mon, 5 Dec 2016 08:34:18 -0500 X-AuditID: cbfec7f5-f79ce6d000004c54-a6-58456cb4ce39 Subject: Re: usb/gadget: GPF in usb_gadget_unregister_driver To: Andrey Konovalov , Greg Kroah-Hartman Cc: Felipe Balbi , Marek Szyprowski , Ruslan Bilovol , Peter Chen , Yoshihiro Shimoda , Colin Ian King , linux-usb@vger.kernel.org, LKML , Dmitry Vyukov , Kostya Serebryany , syzkaller From: Krzysztof Opasiak Message-id: Date: Mon, 05 Dec 2016 14:33:37 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.3.0 MIME-version: 1.0 In-reply-to: Content-type: text/plain; charset=utf-8 Content-transfer-encoding: 7bit X-Brightmail-Tracker: H4sIAAAAAAAAA01SbUhTYRTu3b279265uk7Ng5nWUqQgK8i4lZiByv1nEdSQwpZeP9Cp7Kpk /RGtpVNzZlCNjJFouObMadOZUi0/01Cw/BG5sg/LUjPMlWRZ807w33Oe85zznOflpTD5U3EA lZ6Vy2myVJkKQorbeheHd7Vmxir3mH9LmPKHdhHTq/1AMr/vVRCMfkJLMsW1TQTTNjkjYkY7 bhHMnfpLGNPYPU4yS87XYqbc3o+Y7ukyjFnomieiZayhsIJg7YZxkjVa89jOqgGCtZpKCfZR jZlkm2fbRaxrqApnr7SaEDtvDToqTZBGJnOZ6fmcZnfUGWnar7FBcc7g9nP6xbRCpA/SIQkF 9D5o/GPEBbwJRpxNhA5JKTldh2BkakgsFPMIXJYxcnVi2vLF06hHMPu3GwnFJwTFuvcit8qH joTn2q4V7EsnwsvinhUPjLZj8Odytg5RFEHvhtsdfm4oo6Ng6d5ptwKnQ+Fi+QDhpv1oJVQO hblpGe0Nv6qduJuW0Meh6O1ZYd8O+Pzjqmd3MLSYZzD3MUAvkjDorF7RA70FrI8x4foYME/M efL6wJe+Vk+qQCgteSISZosRlHRO4kKhR2CzODyqQ7BkqiIEtw1w1XYdEwxkUKKVC5CFWUu8 oD4Ceuc1UnicShG863fhehRsWBPHsCaDYU0GI8JMyJfL49WpHB8RzqvUfF5WanhSttqK/n+t wb99C+2orvegA9EUUnjJ7gfGKOViVT5foHYgoDCFr6wuI1YplyWrCs5zmuxETV4mxzvQZgpX +Ms6jS9OyulUVS6XwXE5nGa1K6IkAYWoLKgt4dUy079t44nqoK8hI1NTDT2u5NJn8caPknVJ GbnLw591N21FESnRXw9/U1psztm4mR/mS5UtR1Le3Jhaf6Kr+WdKXIs9JKXy9QWHf+1cw6nh nANh2uqtXjzve25oVPQ9tLWISLdG3LVQJuT9YP8xRWdNlnohf9mVm09qpAqcT1Pt3YlpeNU/ FhhdXFYDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFnrEIsWRmVeSWpSXmKPExsVy+t/xa7onclwjDLZuU7fo2b2TyeJY2xN2 i9+re9ksJjxsY7doXryezWL7s7dMFpd3zWGzWLSsldli7ZG77BZ/7t1htejZeYLR4sibbmaL r3s/sznwesxq6GXz2DnrLrvHgk2lHnsmnmTz2LSqk81j/9w17B4b3+1g8vh2ZiKLR9+WVYwe nzfJBXBFudlkpCampBYppOYl56dk5qXbKoWGuOlaKCnkJeam2ipF6PqGBCkplCXmlAJ5RgZo wME5wD1YSd8uwS3jx7XTrAWnlSsm/MxoYJwg18XIySEhYCLxZt0rVghbTOLCvfVsXYxcHEIC SxglTh6dCeU8Z5RYMOceG0iVsICNxNm2vUxdjBwcIgLxEhcu+oCEhQQmMkl0P/cDqWcW2Mks MXPWLGaQGjYBfYl5u0RBTF4BO4k/q2NBylkEVCVaek6CTRQViJC49bCDBcTmFRCU+DH5HpjN KRAs0f3wJRtIK7OAusSUKbkgYWYBeYnNa94yT2AUmIWkYxZC1SwkVQsYmVcxiqSWFuem5xYb 6hUn5haX5qXrJefnbmIExu+2Yz8372C8tDH4EKMAB6MSD+8GGZcIIdbEsuLK3EOMEhzMSiK8 edmuEUK8KYmVValF+fFFpTmpxYcYTYFemMgsJZqcD0wteSXxhiaG5paGRsYWFuZGRkrivCUf roQLCaQnlqRmp6YWpBbB9DFxcEo1MHJGFbB3e83etPbsrA05QV2C3YeKpabYCeiaNK6+d1RS XavbOMLzcV7bPp2WQIUdzJO+ve65ay9rFfDS8bNkpd7UE1/OSr6qFJRvc2dsrGy4krTu6h4d 3eMRgjd2Ghda+tQpcRs+sjSIaFpzc0tKmWbMwh7hY+9PR9xi3XcjI79b5fgsO30VJZbijERD Leai4kQANpL2FfUCAAA= X-MTR: 20000000000000000@CPGS X-CMS-MailID: 20161205133339eucas1p2bf4be8b156439f23c78d3ce6465bcc58 X-Msg-Generator: CA X-Sender-IP: 182.198.249.179 X-Local-Sender: =?UTF-8?B?S3J6eXN6dG9mIE9wYXNpYWsbU1JQT0wtU3lzdGVtIChUUCkb?= =?UTF-8?B?7IK87ISx7KCE7J6QG1NvZnR3YXJlIEVuZ2luZWVy?= X-Global-Sender: =?UTF-8?B?S3J6eXN6dG9mIE9wYXNpYWsbU1JQT0wtU3lzdGVtIChUUCkb?= =?UTF-8?B?U2Ftc3VuZ8KgRWxlY3Ryb25pY3MbU29mdHdhcmUgRW5naW5lZXI=?= X-Sender-Code: =?UTF-8?B?QzEwG0VIURtDMTBDRDAyQ0QwMjczOTY=?= CMS-TYPE: 201P X-HopCount: 7 X-CMS-RootMailID: 20161205125138epcas4p46f3f55ebb1d04a644c90d8e01e172289 X-RootMTR: 20161205125138epcas4p46f3f55ebb1d04a644c90d8e01e172289 References: <20161203171315.GA5277@kroah.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12/05/2016 01:50 PM, Andrey Konovalov wrote: > On Sat, Dec 3, 2016 at 6:13 PM, Greg Kroah-Hartman > wrote: >> On Sat, Dec 03, 2016 at 05:36:35PM +0100, Andrey Konovalov wrote: >>> Hi! >>> >>> I've got the following error report while running the syzkaller fuzzer. >>> >>> On commit 3c49de52d5647cda8b42c4255cf8a29d1e22eff5 (Dec 2). >>> >>> general protection fault: 0000 [#1] SMP KASAN >>> Dumping ftrace buffer: >>> (ftrace buffer empty) >>> Modules linked in: >>> CPU: 0 PID: 10564 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #4 >>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 >>> task: ffff88006cd0db40 task.stack: ffff88006a050000 >>> RIP: 0010:[] [] >>> __list_del_entry+0xce/0x280 lib/list_debug.c:57 >>> RSP: 0018:ffff88006a056ea8 EFLAGS: 00010246 >>> RAX: dffffc0000000000 RBX: 1ffff1000d40add6 RCX: ffffffff860ceac8 >>> RDX: 0000000000000000 RSI: ffff88006cd0e340 RDI: ffffffff860cead0 >>> RBP: ffff88006a056f38 R08: 0000000000000000 R09: 0000000000000000 >>> R10: 0000000000000006 R11: 0000000000000000 R12: 0000000000000000 >>> R13: 0000000000000000 R14: ffffffff860cea00 R15: ffff88006a056f10 >>> FS: 0000000000000000(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000 >>> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 >>> CR2: 000000002000d000 CR3: 0000000005c1d000 CR4: 00000000000006f0 >>> Stack: >>> ffffffff859785e0 0000000041b58ab3 ffffffff8593717a ffffffff8201a9d0 >>> 1ffff1000d40ade0 ffff88006cd0db40 ffffffff817e5a3c ffff88006cd0e338 >>> 0000000000000a06 1ffff1000d40ade4 ffff88006cd0e340 0000000000000000 >>> Call Trace: >>> [] list_del+0xd/0x70 lib/list_debug.c:77 >>> [] usb_gadget_unregister_driver+0x120/0x240 >>> drivers/usb/gadget/udc/core.c:1365 >>> [] dev_release+0x80/0x160 >>> drivers/usb/gadget/legacy/inode.c:1187 >>> [] __fput+0x332/0x7f0 fs/file_table.c:208 >>> [] ____fput+0x15/0x20 fs/file_table.c:244 >>> [] task_work_run+0x19b/0x270 kernel/task_work.c:116 >>> [< inline >] exit_task_work include/linux/task_work.h:21 >>> [] do_exit+0x16aa/0x2530 kernel/exit.c:828 >>> [] do_group_exit+0x149/0x420 kernel/exit.c:932 >>> [] get_signal+0x76d/0x17b0 kernel/signal.c:2307 >>> [] do_signal+0xd2/0x2120 arch/x86/kernel/signal.c:807 >>> [] exit_to_usermode_loop+0x170/0x200 >>> arch/x86/entry/common.c:156 >>> [< inline >] prepare_exit_to_usermode arch/x86/entry/common.c:190 >>> [] syscall_return_slowpath+0x3d3/0x420 >>> arch/x86/entry/common.c:259 >>> [] entry_SYSCALL_64_fastpath+0xc0/0xc2 >>> Code: c5 0f 84 e2 00 00 00 48 b8 00 02 00 00 00 00 ad de 49 39 c4 0f >>> 84 ec 00 00 00 4c 89 e2 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <80> >>> 3c 02 00 0f 85 35 01 00 00 4d 8b 04 24 49 39 c8 0f 85 e1 00 >>> RIP [] __list_del_entry+0xce/0x280 lib/list_debug.c:57 >>> RSP >>> ---[ end trace 883f708e6720200f ]--- >>> Kernel panic - not syncing: Fatal exception >>> Dumping ftrace buffer: >>> (ftrace buffer empty) >>> Kernel Offset: disabled >> >> Any hints as to what you were doing when this happend? > > I've looked at the code. > > As far as I can see, it's possible for usb_gadget_probe_driver() to > return 0 without adding driver to gadget_driver_pending_list (in case > strcmp() returns 0 and driver->match_existing_only == true). > As a result dev->gadget_registered will be set to true in dev_config() > and dev_release() will call usb_gadget_unregister_driver(), which in > turn will try to remove driver from gadget_driver_pending_list. > > Does it make any sense? > Yes. We should add gadget to pending list only if suitable UDC has not been found and gadget driver is willing to wait for new UDC to appear. Otherwise we call udc_bind_to_gadget() and if this success then we should just return 0 as we took some free udc. usually you should have empty pending list;) Your description sounds really quite similar to what Felix fixed in his patch[1]. This patch fix this function in case when we found matching UDC but it is busy. Footnotes: 1 - http://marc.info/?l=linux-usb&m=148054830631070&w=2 Best regards, -- Krzysztof Opasiak Samsung R&D Institute Poland Samsung Electronics