From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, Denis Kirjanov <kda@linux-powerpc.org>,
"Alan Stern" <stern@rowland.harvard.edu>,
"Yoshihiro Shimoda" <yoshihiro.shimoda.uh@renesas.com>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>
Subject: [PATCH 3.16 54/83] usb: host: ohci: fix a race condition between shutdown and irq
Date: Wed, 20 Nov 2019 15:38:04 +0000 [thread overview]
Message-ID: <lsq.1574264230.547519144@decadent.org.uk> (raw)
In-Reply-To: <lsq.1574264230.280218497@decadent.org.uk>
3.16.78-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit a349b95d7ca0cea71be4a7dac29830703de7eb62 upstream.
This patch fixes an issue that the following error is
possible to happen when ohci hardware causes an interruption
and the system is shutting down at the same time.
[ 34.851754] usb 2-1: USB disconnect, device number 2
[ 35.166658] irq 156: nobody cared (try booting with the "irqpoll" option)
[ 35.173445] CPU: 0 PID: 22 Comm: kworker/0:1 Not tainted 5.3.0-rc5 #85
[ 35.179964] Hardware name: Renesas Salvator-X 2nd version board based on r8a77965 (DT)
[ 35.187886] Workqueue: usb_hub_wq hub_event
[ 35.192063] Call trace:
[ 35.194509] dump_backtrace+0x0/0x150
[ 35.198165] show_stack+0x14/0x20
[ 35.201475] dump_stack+0xa0/0xc4
[ 35.204785] __report_bad_irq+0x34/0xe8
[ 35.208614] note_interrupt+0x2cc/0x318
[ 35.212446] handle_irq_event_percpu+0x5c/0x88
[ 35.216883] handle_irq_event+0x48/0x78
[ 35.220712] handle_fasteoi_irq+0xb4/0x188
[ 35.224802] generic_handle_irq+0x24/0x38
[ 35.228804] __handle_domain_irq+0x5c/0xb0
[ 35.232893] gic_handle_irq+0x58/0xa8
[ 35.236548] el1_irq+0xb8/0x180
[ 35.239681] __do_softirq+0x94/0x23c
[ 35.243253] irq_exit+0xd0/0xd8
[ 35.246387] __handle_domain_irq+0x60/0xb0
[ 35.250475] gic_handle_irq+0x58/0xa8
[ 35.254130] el1_irq+0xb8/0x180
[ 35.257268] kernfs_find_ns+0x5c/0x120
[ 35.261010] kernfs_find_and_get_ns+0x3c/0x60
[ 35.265361] sysfs_unmerge_group+0x20/0x68
[ 35.269454] dpm_sysfs_remove+0x2c/0x68
[ 35.273284] device_del+0x80/0x370
[ 35.276683] hid_destroy_device+0x28/0x60
[ 35.280686] usbhid_disconnect+0x4c/0x80
[ 35.284602] usb_unbind_interface+0x6c/0x268
[ 35.288867] device_release_driver_internal+0xe4/0x1b0
[ 35.293998] device_release_driver+0x14/0x20
[ 35.298261] bus_remove_device+0x110/0x128
[ 35.302350] device_del+0x148/0x370
[ 35.305832] usb_disable_device+0x8c/0x1d0
[ 35.309921] usb_disconnect+0xc8/0x2d0
[ 35.313663] hub_event+0x6e0/0x1128
[ 35.317146] process_one_work+0x1e0/0x320
[ 35.321148] worker_thread+0x40/0x450
[ 35.324805] kthread+0x124/0x128
[ 35.328027] ret_from_fork+0x10/0x18
[ 35.331594] handlers:
[ 35.333862] [<0000000079300c1d>] usb_hcd_irq
[ 35.338126] [<0000000079300c1d>] usb_hcd_irq
[ 35.342389] Disabling IRQ #156
ohci_shutdown() disables all the interrupt and rh_state is set to
OHCI_RH_HALTED. In other hand, ohci_irq() is possible to enable
OHCI_INTR_SF and OHCI_INTR_MIE on ohci_irq(). Note that OHCI_INTR_SF
is possible to be set by start_ed_unlink() which is called:
ohci_irq()
-> process_done_list()
-> takeback_td()
-> start_ed_unlink()
So, ohci_irq() has the following condition, the issue happens by
&ohci->regs->intrenable = OHCI_INTR_MIE | OHCI_INTR_SF and
ohci->rh_state = OHCI_RH_HALTED:
/* interrupt for some other device? */
if (ints == 0 || unlikely(ohci->rh_state == OHCI_RH_HALTED))
return IRQ_NOTMINE;
To fix the issue, ohci_shutdown() holds the spin lock while disabling
the interruption and changing the rh_state flag to prevent reenable
the OHCI_INTR_MIE unexpectedly. Note that io_watchdog_func() also
calls the ohci_shutdown() and it already held the spin lock, so that
the patch makes a new function as _ohci_shutdown().
This patch is inspired by a Renesas R-Car Gen3 BSP patch
from Tho Vu.
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/1566877910-6020-1-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16:
- Drop change in io_watchdog_func()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/usb/host/ohci-hcd.c
+++ b/drivers/usb/host/ohci-hcd.c
@@ -392,8 +392,7 @@ static void ohci_usb_reset (struct ohci_
* other cases where the next software may expect clean state from the
* "firmware". this is bus-neutral, unlike shutdown() methods.
*/
-static void
-ohci_shutdown (struct usb_hcd *hcd)
+static void _ohci_shutdown(struct usb_hcd *hcd)
{
struct ohci_hcd *ohci;
@@ -408,6 +407,16 @@ ohci_shutdown (struct usb_hcd *hcd)
ohci_writel(ohci, ohci->fminterval, &ohci->regs->fminterval);
}
+static void ohci_shutdown(struct usb_hcd *hcd)
+{
+ struct ohci_hcd *ohci = hcd_to_ohci(hcd);
+ unsigned long flags;
+
+ spin_lock_irqsave(&ohci->lock, flags);
+ _ohci_shutdown(hcd);
+ spin_unlock_irqrestore(&ohci->lock, flags);
+}
+
static int check_ed(struct ohci_hcd *ohci, struct ed *ed)
{
return (hc32_to_cpu(ohci, ed->hwINFO) & ED_IN) != 0
next prev parent reply other threads:[~2019-11-20 15:40 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-20 15:37 [PATCH 3.16 00/83] 3.16.78-rc1 review Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 01/83] hwmon: (nct6775) Fix register address and added missed tolerance for nct6106 Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 02/83] x86/sysfb_efi: Add quirks for some devices with swapped width and height Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 03/83] mmc: mmc_spi: Enable stable writes Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 04/83] ALSA: compress: Fix regression on compressed capture streams Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 05/83] can: peak_usb: fix potential double kfree_skb() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 06/83] usb: pci-quirks: Correct AMD PLL quirk detection Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 07/83] usb: wusbcore: fix unbalanced get/put cluster_id Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 08/83] x86/speculation/mds: Apply more accurate check on hypervisor platform Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 09/83] hpet: Fix division by zero in hpet_time_div() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 10/83] sched/fair: Don't free p->numa_faults with concurrent readers Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 11/83] tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 12/83] bnx2x: Disable multi-cos feature Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 13/83] arm64: compat: Allow single-byte watchpoints on all addresses Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 14/83] net: sched: Fix a possible null-pointer dereference in dequeue_func() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 15/83] net: fix ifindex collision during namespace removal Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 16/83] libata: zpodd: Fix small read overflow in zpodd_get_mech_type() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 17/83] selinux: fix memory leak in policydb_init() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 18/83] net: bridge: mcast: don't delete permanent entries when fast leave is enabled Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 19/83] xen/swiotlb: fix condition for calling xen_destroy_contiguous_region() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 20/83] s390/dasd: fix endless loop after read unit address configuration Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 21/83] can: peak_usb: pcan_usb_pro: Fix info-leaks to USB devices Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 22/83] asm-generic: fix -Wtype-limits compiler warnings Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 23/83] NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 24/83] USB: serial: option: Add support for ZTE MF871A Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 25/83] usb: yurex: Fix use-after-free in yurex_delete Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 26/83] SMB3: Fix deadlock in validate negotiate hits reconnect Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 27/83] smb3: send CAP_DFS capability during session setup Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 28/83] sound: fix a memory leak bug Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 29/83] ALSA: firewire: " Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 30/83] ALSA: hda - Fix " Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 31/83] sh: kernel: hw_breakpoint: Fix missing break in switch statement Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 32/83] net: tc35815: Explicitly check NET_IP_ALIGN is not zero in tc35815_rx Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 33/83] staging: comedi: dt3000: Fix signed integer overflow 'divider * base' Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 34/83] staging: comedi: dt3000: Fix rounding up of timer divisor Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 35/83] USB: core: Fix races in character device registration and deregistraion Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 36/83] netfilter: conntrack: Use consistent ct id hash calculation Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 37/83] sctp: fix the transport error_count check Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 38/83] USB: serial: option: Add Motorola modem UARTs Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 39/83] usb: cdc-acm: make sure a refcount is taken early enough Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 40/83] net/packet: fix race in tpacket_snd() Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 41/83] Revert "cfg80211: fix processing world regdomain when non modular" Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 42/83] usb-storage: Add new JMS567 revision to unusual_devs Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 43/83] dm btree: fix order of block initialization in btree_split_beneath Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 44/83] dm space map metadata: fix missing store of apply_bops() return value Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 45/83] dm table: fix invalid memory accesses with too high sector number Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 46/83] x86/retpoline: Don't clobber RFLAGS during CALL_NOSPEC on i386 Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 47/83] batman-adv: Only read OGM tvlv_len after buffer len check Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 48/83] ALSA: seq: Fix potential concurrent access to the deleted pool Ben Hutchings
2019-11-20 15:37 ` [PATCH 3.16 49/83] ptrace,x86: Make user_64bit_mode() available to 32-bit builds Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 50/83] uprobes/x86: Fix detection of 32-bit user mode Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 51/83] x86/apic: Do not initialize LDR and DFR for bigsmp Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 52/83] x86/apic: Drop logical_smp_processor_id() inline Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 53/83] x86/apic/32: Avoid bogus LDR warnings Ben Hutchings
2019-11-20 15:38 ` Ben Hutchings [this message]
2019-11-20 15:38 ` [PATCH 3.16 55/83] USB: storage: ums-realtek: Update module parameter description for auto_delink_en Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 56/83] USB: storage: ums-realtek: Whitelist auto-delink support Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 57/83] USB: cdc-wdm: fix race between write and disconnect due to flag abuse Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 58/83] VMCI: Release resource if the work is already queued Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 59/83] mld: fix memory leak in mld_del_delrec() Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 60/83] ALSA: hda - Fix potential endless loop at applying quirks Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 61/83] mmc: core: Fix init of SD cards reporting an invalid VDD range Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 62/83] net: seeq: Fix the function used to release some memory in an error handling path Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 63/83] sched/fair: Don't assign runtime for throttled cfs_rq Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 64/83] vhost/test: fix build for vhost test Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 65/83] sctp: use transport pf_retrans in sctp_do_8_2_transport_strike Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 66/83] genirq: Prevent NULL pointer dereference in resend_irqs() Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 67/83] keys: Fix missing null pointer check in request_key_auth_describe() Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 68/83] sch_hhf: ensure quantum and hhf_non_hh_weight are non-zero Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 69/83] tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 70/83] tun: fix use-after-free when register netdev failed Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 71/83] ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 72/83] net: Fix null de-reference of device refcount Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 73/83] sctp: Fix the link time qualifier of 'sctp_ctrlsock_exit()' Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 74/83] KVM: nVMX: handle page fault in vmread Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 75/83] KVM: x86: work around leak of uninitialized stack contents Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 76/83] PCI: tegra: Enable Relaxed Ordering only for Tegra20 & Tegra30 Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 77/83] alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 78/83] cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 79/83] CIFS: Fix use after free of file info structures Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 80/83] md/raid: raid5 preserve the writeback action after the parity check Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 81/83] btrfs: partially apply b8b93addde Ben Hutchings
2019-11-20 15:56 ` Hans van Kranenburg
2019-11-21 21:42 ` Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 82/83] btrfs: volumes: Cleanup stripe size calculation Ben Hutchings
2019-11-20 15:38 ` [PATCH 3.16 83/83] btrfs: alloc_chunk: fix more DUP stripe size handling Ben Hutchings
2019-11-20 15:46 ` [PATCH 3.16 00/83] 3.16.78-rc1 review Guenter Roeck
2019-11-20 15:50 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1574264230.547519144@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=gregkh@linuxfoundation.org \
--cc=kda@linux-powerpc.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=yoshihiro.shimoda.uh@renesas.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®