From patchwork Thu Mar 9 14:44:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 661348 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BF117C742A7 for ; Thu, 9 Mar 2023 14:46:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232071AbjCIOqC (ORCPT ); Thu, 9 Mar 2023 09:46:02 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232152AbjCIOpH (ORCPT ); Thu, 9 Mar 2023 09:45:07 -0500 Received: from mail-ed1-x531.google.com (mail-ed1-x531.google.com [IPv6:2a00:1450:4864:20::531]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CCF33FD2A3 for ; Thu, 9 Mar 2023 06:44:23 -0800 (PST) Received: by mail-ed1-x531.google.com with SMTP id j11so7952774edq.4 for ; Thu, 09 Mar 2023 06:44:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1678373062; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=RGloBNHxOua9Iw1+mH1830UlqyJSA0ubuVXGPR5VpVE=; b=Bf5APZdqT3K6VVDk4+ybnR0BxTte+I0bAOPPNfDGeIlJ3IUIoKDg0Z2QNBneKc+yR3 sxRjPLLStzOPLh8F3CjUTPmckywHqjgwWG/pzBIEkMvblzkmXWglK19wRZ+EIWlfySkz A6opliPI5NIXQP1M/HGCVsKowTNSqaOcuJPUE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678373062; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=RGloBNHxOua9Iw1+mH1830UlqyJSA0ubuVXGPR5VpVE=; b=FpSCJP4IMlwX04z9bt2vRJimlycKvmjgWiYIc98+OJ66Dvg7RJZfyr0+kEM+oeCGNV wsYRJVtQUDNSY3PzYisWmv2Pdyw5vhDkOfIb5xHTAgCs9zabdFomPD1B9LfuiCxLLOvd baxIX52A1ybfzFkBaLsVVNt1kKGNF0xWnoQ9ybWqWmFf0DhKgto3FbQLguqDuKpV2FdH 0mYP4823MExo5ZrcnGULXnZpz9rjfQLhvU9igXV+jpT+2v1Ss1jH83xBu+RZ1ZvOhZyR +CMmdKJ+RGoUuLHgaPboSd0rA6TnoaqxjKF5Li4kceZ0BHGzopNh9kVB+tllDyGRzbkR f73Q== X-Gm-Message-State: AO0yUKWShJ2TEN+N98LhL/ub0gKQNEyB9BGZFN2ASGWMnTJp3+8gTPBS v28EtPAaT/Kx8+NqMLu09yyk7w== X-Google-Smtp-Source: AK7set/ZeYuFKvSKId7fT7aGQyo38zgWhAUxXKPGVMvvkNp7gTgoUVbVjmWea+Tr46T+6j1NyIdGoQ== X-Received: by 2002:a17:906:8145:b0:8f4:9ef9:27bd with SMTP id z5-20020a170906814500b008f49ef927bdmr25149983ejw.12.1678373062394; Thu, 09 Mar 2023 06:44:22 -0800 (PST) Received: from alco.roam.corp.google.com ([2620:0:1059:10:1645:7aa4:a765:1966]) by smtp.gmail.com with ESMTPSA id l6-20020a50d6c6000000b004bdcc480c41sm9708931edj.96.2023.03.09.06.44.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Mar 2023 06:44:22 -0800 (PST) From: Ricardo Ribalda Date: Thu, 09 Mar 2023 15:44:07 +0100 Subject: [PATCH v2 3/3] media: uvcvideo: Release stream queue when unregistering video device MIME-Version: 1.0 Message-Id: <20230309-guenter-mini-v2-3-e6410d590d43@chromium.org> References: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> In-Reply-To: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> To: Mauro Carvalho Chehab Cc: Ricardo Ribalda , Laurent Pinchart , Max Staudt , Alan Stern , Sakari Ailus , Guenter Roeck , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Sean Paul , Tomasz Figa , Hans Verkuil X-Mailer: b4 0.11.0-dev-696ae X-Developer-Signature: v=1; a=openpgp-sha256; l=3750; i=ribalda@chromium.org; h=from:subject:message-id; bh=BOH3IOWNxfqaNBRdefVmQLKOUCCvdngRMwRhJ9U9HtI=; b=owEBbQKS/ZANAwAKAdE30T7POsSIAcsmYgBkCfDBZZCAsDZoV+Uj3AcB7rPDnPOlhvem/gT0dPE9 2SpUApKJAjMEAAEKAB0WIQREDzjr+/4oCDLSsx7RN9E+zzrEiAUCZAnwwQAKCRDRN9E+zzrEiMT5D/ sFKGVLG1o4uVDZBkY8X9lWNriff4Ta2f7S0CWt4L9/JAAe98LBiZ7hq2HU4+hQnCSnAI6v8L0nY4vb Yuxpxfdslfvd7shxhsnQjkzVZGOCRMunmlGvInbhuraUzhD0Boyx6JUQtVhAx0LKflsHoTw3ASMWxJ nsxF/pnwRTb52pNpJzIM7kQGy4OjRhEgUEK2lAubcW71BtpxtVLIx8pSxuxEdqH9OuhuVGsEed5bpp SieEJKZBgxmG+293HdxXjOJ6zqvesWFEc8KF8p65fpFDTaDntRLwsTZ9sDoMO5KKTPpNeUoeQNMZrj ACzcLcfrmJ+F+0tMj0XjMXt9Pe0biHjiKtgYF0pTS7J8oolssixQo8XkDcX7hqLCK8gqonPbD8uEij g0YO4/AmSWNEDYjzUAuVzSphq97xzZbCv3LO2+jl91MpD6gTyQ+p0X/61R6laOiBg2mcRvyN0Wu/J9 k1pB7E72K0NUS4u332k8IQIHDthh3cL6U7prZrX24NIYhit8yKUOljIJjEJgNETD9qRICvHfMjTKne Zh09PpX3bz0Abk2vPU8QCAxNkPyolxWCyrFoFOwTGBhZa9shA3UOAg9LA0UQZoOrdjUKk8ZriLqT/s Kynw4i7b89LXM+U7HGaeAyhZHbZnKgQg+nGsFlAhVHArQAxqzkiNBCMwpmrA== X-Developer-Key: i=ribalda@chromium.org; a=openpgp; fpr=9EC3BB66E2FC129A6F90B39556A0D81F9F782DA9 Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org From: Guenter Roeck The following traceback was observed when stress testing the uvcvideo driver. config->interface[0] is NULL WARNING: CPU: 0 PID: 2757 at drivers/usb/core/usb.c:285 usb_ifnum_to_if+0x81/0x85 ^^^ added log message and WARN() to prevent crash Modules linked in: <...> CPU: 0 PID: 2757 Comm: inotify_reader Not tainted 4.19.139 #20 Hardware name: Google Phaser/Phaser, BIOS Google_Phaser.10952.0.0 08/09/2018 RIP: 0010:usb_ifnum_to_if+0x81/0x85 Code: <...> RSP: 0018:ffff9ee20141fa58 EFLAGS: 00010246 RAX: 438a0e5a525f1800 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff975477a1de90 RSI: ffff975477a153d0 RDI: ffff975477a153d0 RBP: ffff9ee20141fa70 R08: 000000000000002c R09: 002daec189138d78 R10: 0000001000000000 R11: ffffffffa7da42e6 R12: ffff975459594800 R13: 0000000000000001 R14: 0000000000000001 R15: ffff975465376400 FS: 00007ddebffd6700(0000) GS:ffff975477a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000012c83000 CR3: 00000001bbaf8000 CR4: 0000000000340ef0 Call Trace: usb_set_interface+0x3b/0x2f3 uvc_video_stop_streaming+0x38/0x81 [uvcvideo] uvc_stop_streaming+0x21/0x49 [uvcvideo] __vb2_queue_cancel+0x33/0x249 [videobuf2_common] vb2_core_queue_release+0x1c/0x45 [videobuf2_common] uvc_queue_release+0x26/0x32 [uvcvideo] uvc_v4l2_release+0x41/0xdd [uvcvideo] v4l2_release+0x99/0xed __fput+0xf0/0x1ea task_work_run+0x7f/0xa7 do_exit+0x1d1/0x6eb do_group_exit+0x9d/0xac get_signal+0x135/0x482 do_signal+0x4a/0x63c exit_to_usermode_loop+0x86/0xa5 do_syscall_64+0x171/0x269 ? __do_page_fault+0x272/0x474 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7ddec156dc26 Code: Bad RIP value. RSP: 002b:00007ddebffd5c10 EFLAGS: 00000293 ORIG_RAX: 0000000000000017 RAX: fffffffffffffdfe RBX: 000000000000000a RCX: 00007ddec156dc26 RDX: 0000000000000000 RSI: 00007ddebffd5d28 RDI: 000000000000000a RBP: 00007ddebffd5c50 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 00007ddebffd5d28 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 When this was observed, a USB disconnect was in progress, uvc_disconnect() had returned, but usb_disable_device() was still running. Drivers are not supposed to call any USB functions after the driver disconnect function has been called. The uvcvideo driver does not follow that convention and tries to write to the disconnected USB interface anyway. This results in a variety of race conditions. To solve this specific problem, release the uvc queue from uvc_unregister_video() after the associated video devices have been unregistered. Since the function already holds the uvc queue mutex, bypass uvc_queue_release() and call vb2_queue_release() directly. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Reviewed-by: Tomasz Figa Reviewed-by: Sean Paul Signed-off-by: Guenter Roeck Signed-off-by: Ricardo Ribalda --- drivers/media/usb/uvc/uvc_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 9fda863ec446..23d839f74ca5 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1896,6 +1896,8 @@ static void uvc_unregister_video(struct uvc_device *dev) uvc_debugfs_cleanup_stream(stream); + vb2_queue_release(&stream->queue.queue); + mutex_unlock(&stream->queue.mutex); mutex_unlock(&stream->mutex); }