Baolin Wang b3ce3ce02d usb: gadget: f_fs: Fix possibe deadlock ... When system try to close /dev/usb-ffs/adb/ep0 on one core, at the same time another core try to attach new UDC, which will cause deadlock as below scenario. Thus we should release ffs lock before issuing unregister_gadget_item(). [ 52.642225] c1 ====================================================== [ 52.642228] c1 [ INFO: possible circular locking dependency detected ] [ 52.642236] c1 4.4.6+ #1 Tainted: G W O [ 52.642241] c1 ------------------------------------------------------- [ 52.642245] c1 usb ffs open/2808 is trying to acquire lock: [ 52.642270] c0 (udc_lock){+.+.+.}, at: [<ffffffc00065aeec>] usb_gadget_unregister_driver+0x3c/0xc8 [ 52.642272] c1 but task is already holding lock: [ 52.642283] c0 (ffs_lock){+.+.+.}, at: [<ffffffc00066b244>] ffs_data_clear+0x30/0x140 [ 52.642285] c1 which lock already depends on the new lock. [ 52.642287] c1 the existing dependency chain (in reverse order) is: [ 52.642295] c0 -> #1 (ffs_lock){+.+.+.}: [ 52.642307] c0 [<ffffffc00012340c>] __lock_acquire+0x20f0/0x2238 [ 52.642314] c0 [<ffffffc000123b54>] lock_acquire+0xe4/0x298 [ 52.642322] c0 [<ffffffc000aaf6e8>] mutex_lock_nested+0x7c/0x3cc [ 52.642328] c0 [<ffffffc00066f7bc>] ffs_func_bind+0x504/0x6e8 [ 52.642334] c0 [<ffffffc000654004>] usb_add_function+0x84/0x184 [ 52.642340] c0 [<ffffffc000658ca4>] configfs_composite_bind+0x264/0x39c [ 52.642346] c0 [<ffffffc00065b348>] udc_bind_to_driver+0x58/0x11c [ 52.642352] c0 [<ffffffc00065b49c>] usb_udc_attach_driver+0x90/0xc8 [ 52.642358] c0 [<ffffffc0006598e0>] gadget_dev_desc_UDC_store+0xd4/0x128 [ 52.642369] c0 [<ffffffc0002c14e8>] configfs_write_file+0xd0/0x13c [ 52.642376] c0 [<ffffffc00023c054>] vfs_write+0xb8/0x214 [ 52.642381] c0 [<ffffffc00023cad4>] SyS_write+0x54/0xb0 [ 52.642388] c0 [<ffffffc000085ff0>] el0_svc_naked+0x24/0x28 [ 52.642395] c0 -> #0 (udc_lock){+.+.+.}: [ 52.642401] c0 [<ffffffc00011e3d0>] print_circular_bug+0x84/0x2e4 [ 52.642407] c0 [<ffffffc000123454>] __lock_acquire+0x2138/0x2238 [ 52.642412] c0 [<ffffffc000123b54>] lock_acquire+0xe4/0x298 [ 52.642420] c0 [<ffffffc000aaf6e8>] mutex_lock_nested+0x7c/0x3cc [ 52.642427] c0 [<ffffffc00065aeec>] usb_gadget_unregister_driver+0x3c/0xc8 [ 52.642432] c0 [<ffffffc00065995c>] unregister_gadget_item+0x28/0x44 [ 52.642439] c0 [<ffffffc00066b34c>] ffs_data_clear+0x138/0x140 [ 52.642444] c0 [<ffffffc00066b374>] ffs_data_reset+0x20/0x6c [ 52.642450] c0 [<ffffffc00066efd0>] ffs_data_closed+0xac/0x12c [ 52.642454] c0 [<ffffffc00066f070>] ffs_ep0_release+0x20/0x2c [ 52.642460] c0 [<ffffffc00023dbe4>] __fput+0xb0/0x1f4 [ 52.642466] c0 [<ffffffc00023dd9c>] ____fput+0x20/0x2c [ 52.642473] c0 [<ffffffc0000ee944>] task_work_run+0xb4/0xe8 [ 52.642482] c0 [<ffffffc0000cd45c>] do_exit+0x360/0xb9c [ 52.642487] c0 [<ffffffc0000cf228>] do_group_exit+0x4c/0xb0 [ 52.642494] c0 [<ffffffc0000dd3c8>] get_signal+0x380/0x89c [ 52.642501] c0 [<ffffffc00008a8f0>] do_signal+0x154/0x518 [ 52.642507] c0 [<ffffffc00008af00>] do_notify_resume+0x70/0x78 [ 52.642512] c0 [<ffffffc000085ee8>] work_pending+0x1c/0x20 [ 52.642514] c1 other info that might help us debug this: [ 52.642517] c1 Possible unsafe locking scenario: [ 52.642518] c1 CPU0 CPU1 [ 52.642520] c1 ---- ---- [ 52.642525] c0 lock(ffs_lock); [ 52.642529] c0 lock(udc_lock); [ 52.642533] c0 lock(ffs_lock); [ 52.642537] c0 lock(udc_lock); [ 52.642539] c1 *** DEADLOCK *** [ 52.642543] c1 1 lock held by usb ffs open/2808: [ 52.642555] c0 #0: (ffs_lock){+.+.+.}, at: [<ffffffc00066b244>] ffs_data_clear+0x30/0x140 [ 52.642557] c1 stack backtrace: [ 52.642563] c1 CPU: 1 PID: 2808 Comm: usb ffs open Tainted: G [ 52.642565] c1 Hardware name: Spreadtrum SP9860g Board (DT) [ 52.642568] c1 Call trace: [ 52.642573] c1 [<ffffffc00008b430>] dump_backtrace+0x0/0x170 [ 52.642577] c1 [<ffffffc00008b5c0>] show_stack+0x20/0x28 [ 52.642583] c1 [<ffffffc000422694>] dump_stack+0xa8/0xe0 [ 52.642587] c1 [<ffffffc00011e548>] print_circular_bug+0x1fc/0x2e4 [ 52.642591] c1 [<ffffffc000123454>] __lock_acquire+0x2138/0x2238 [ 52.642595] c1 [<ffffffc000123b54>] lock_acquire+0xe4/0x298 [ 52.642599] c1 [<ffffffc000aaf6e8>] mutex_lock_nested+0x7c/0x3cc [ 52.642604] c1 [<ffffffc00065aeec>] usb_gadget_unregister_driver+0x3c/0xc8 [ 52.642608] c1 [<ffffffc00065995c>] unregister_gadget_item+0x28/0x44 [ 52.642613] c1 [<ffffffc00066b34c>] ffs_data_clear+0x138/0x140 [ 52.642618] c1 [<ffffffc00066b374>] ffs_data_reset+0x20/0x6c [ 52.642621] c1 [<ffffffc00066efd0>] ffs_data_closed+0xac/0x12c [ 52.642625] c1 [<ffffffc00066f070>] ffs_ep0_release+0x20/0x2c [ 52.642629] c1 [<ffffffc00023dbe4>] __fput+0xb0/0x1f4 [ 52.642633] c1 [<ffffffc00023dd9c>] ____fput+0x20/0x2c [ 52.642636] c1 [<ffffffc0000ee944>] task_work_run+0xb4/0xe8 [ 52.642640] c1 [<ffffffc0000cd45c>] do_exit+0x360/0xb9c [ 52.642644] c1 [<ffffffc0000cf228>] do_group_exit+0x4c/0xb0 [ 52.642647] c1 [<ffffffc0000dd3c8>] get_signal+0x380/0x89c [ 52.642651] c1 [<ffffffc00008a8f0>] do_signal+0x154/0x518 [ 52.642656] c1 [<ffffffc00008af00>] do_notify_resume+0x70/0x78 [ 52.642659] c1 [<ffffffc000085ee8>] work_pending+0x1c/0x20 Acked-by: Michal Nazarewicz <mina86@mina86.com> Signed-off-by: Baolin Wang <baolin.wang@linaro.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>		2017-01-02 10:55:28 +02:00
..
f_acm.c	usb: gadget: f_acm: Fix configfs attr name	2016-03-04 15:14:50 +02:00
f_ecm.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_eem.c	usb: gadget: prevent potenial null pointer dereference on skb->len	2016-09-06 10:44:03 +03:00
f_fs.c	usb: gadget: f_fs: Fix possibe deadlock	2017-01-02 10:55:28 +02:00
f_hid.c	idr: add ida_is_empty	2016-12-14 16:04:10 -08:00
f_loopback.c	usb: gadget: remove variable ret and remove unnecessary if statement	2016-09-09 13:38:37 +03:00
f_mass_storage.c	usb: gadget: Add per-lun inquiry string	2016-08-25 12:13:13 +03:00
f_mass_storage.h	usb: gadget: Add per-lun inquiry string	2016-08-25 12:13:13 +03:00
f_midi.c	usb: gadget: remove useless parameter in alloc_ep_req()	2016-08-25 12:13:19 +03:00
f_ncm.c	ktime: Cleanup ktime_set() usage	2016-12-25 17:21:22 +01:00
f_obex.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_phonet.c	net: use core MTU range checking in misc drivers	2016-10-20 14:51:10 -04:00
f_printer.c	idr: add ida_is_empty	2016-12-14 16:04:10 -08:00
f_rndis.c	usb: gadget: function: f_rndis: socket buffer may be NULL	2016-08-22 10:45:12 +03:00
f_serial.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_sourcesink.c	usb: gadget: remove useless parameter in alloc_ep_req()	2016-08-25 12:13:19 +03:00
f_subset.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_tcm.c	usb: gadget: Fix second argument of percpu_ida_alloc()	2016-12-09 10:20:08 -08:00
f_uac1.c	usb: gadget: Update usb_assign_descriptors for SuperSpeedPlus	2016-03-04 15:14:23 +02:00
f_uac2.c	usb: gadget: f_uac2: fix error handling at afunc_bind	2016-11-18 13:54:09 +02:00
f_uvc.c	usb: gadget: uvc: Add missing call for additional setup data	2016-08-31 10:06:04 +03:00
f_uvc.h
g_zero.h
Makefile	usb: gadget: f_tcm: convert to new function interface with backward compatibility	2015-12-20 19:40:34 -08:00
ndis.h
rndis.c	usb: gadget: Fix checkpatch error for braces	2016-11-18 13:54:41 +02:00
rndis.h	usb: gadget: Fix checkpatch error for braces	2016-11-18 13:54:41 +02:00
storage_common.c	usb: gadget: Add per-lun inquiry string	2016-08-25 12:13:13 +03:00
storage_common.h	usb: gadget: Add per-lun inquiry string	2016-08-25 12:13:13 +03:00
tcm.h	usb-gadget/tcm: Conversion to percpu_ida tag pre-allocation	2016-03-10 21:48:14 -08:00
u_ecm.h
u_eem.h
u_ether_configfs.h
u_ether.c	USB/PHY patches for 4.10-rc1	2016-12-13 11:10:36 -08:00
u_ether.h	usb: gadget: u_ether: add a flag to avoid skb_reserve() calling	2016-08-31 10:06:03 +03:00
u_fs.h
u_gether.h
u_hid.h
u_midi.h
u_ncm.h
u_phonet.h
u_printer.h
u_rndis.h
u_serial.c	usb: gadget: serial: fix possible Oops caused by calling kthread_stop(NULL)	2016-11-18 13:55:19 +02:00
u_serial.h
u_tcm.h	usb: gadget: f_tcm: convert to new function interface with backward compatibility	2015-12-20 19:40:34 -08:00
u_uac1.c
u_uac1.h
u_uac2.h
u_uvc.h
uvc_configfs.c	fs: configfs: don't return anything from drop_link	2016-12-01 10:50:49 +01:00
uvc_configfs.h
uvc_queue.c	[media] vb2: replace void *alloc_ctxs by struct device *alloc_devs	2016-07-08 14:45:07 -03:00
uvc_queue.h
uvc_v4l2.c	usb: gadget: Fix checkpatch error for braces	2016-11-18 13:54:41 +02:00
uvc_v4l2.h
uvc_video.c	usb: gadget: composite: always set ep->mult to a sensible value	2016-10-31 11:15:33 +02:00
uvc_video.h
uvc.h	usb: gadget: Fix checkpatch error for braces	2016-11-18 13:54:41 +02:00