* [PATCH] usb: mtu3: Fix double dereference in TP_printk
@ 2026-09-22 10:37 Vladimir Murzin
2026-09-28 13:11 ` Vladimir Murzin
0 siblings, 1 reply; 5+ messages in thread
From: Vladimir Murzin @ 2026-09-22 10:37 UTC (permalink / raw)
To: linux-usb
Cc: linux-arm-kernel, linux-mediatek, linux-kernel, chunfeng.yun,
gregkh, rostedt, paulmck, mark.rutland, Vladimir Murzin
Paul reported kernel splat:
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] ------------[ cut here ]------------
[ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
[ 0.000000] Hardware name: linux,dummy-virt (DT)
[ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 0.000000] pc : test_double_dereference+0x144/0x14c
[ 0.000000] lr : test_double_dereference+0x144/0x14c
[ 0.000000] sp : ffffc80aa7633bf0
[ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
[ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
[ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
[ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
[ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
[ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
[ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
[ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
[ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
[ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
[ 0.000000] Call trace:
[ 0.000000] test_double_dereference+0x144/0x14c (P)
[ 0.000000] trace_event_raw_init+0x37c/0x5d8
[ 0.000000] event_init+0x34/0xc0
[ 0.000000] trace_event_init+0xec/0x588
[ 0.000000] trace_init+0x24/0x6e0
[ 0.000000] start_kernel+0x4a0/0x8ec
[ 0.000000] __primary_switched+0x88/0x90
[ 0.000000] irq event stamp: 0
[ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
[ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
[ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
[ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
Which also observed by Mark and myself.
The splat it result of new check introduced by b5cc230af5e5 ("tracing:
Warn when an event dereferences a pointer in TP_printk()") which
correctly catches issue with %pad dereferencing the address saved in
the ring buffer. TP_fast_assign() logic gets executed when the
tracepoint is triggered, however the TP_printk() is executed when the
user reads the trace buffer which could be seconds, minutes, hours,
days, even months later and nothing guarantee that __entry->gpd_ring
pointer will still be pointing to what it was when it was recorded.
Fix the issue by capturing immediate value of gpd_ring.dma when trace
point is triggered.
Reported-by: Paul E. McKenney <paulmck@kernel.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
---
drivers/usb/mtu3/mtu3_trace.h | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
index 89870175d635..9aaa167d69c1 100644
--- a/drivers/usb/mtu3/mtu3_trace.h
+++ b/drivers/usb/mtu3/mtu3_trace.h
@@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__field(unsigned int, flags)
__field(unsigned int, direction)
__field(struct mtu3_gpd_ring *, gpd_ring)
+ __field(dma_addr_t, gpd_ring_dma)
),
TP_fast_assign(
__assign_str(name);
@@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__entry->flags = mep->flags;
__entry->direction = mep->is_in;
__entry->gpd_ring = &mep->gpd_ring;
+ __entry->gpd_ring_dma = mep->gpd_ring.dma
),
TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
__get_str(name), usb_ep_type_string(__entry->type),
__entry->maxp, __entry->slot,
__entry->mult, __entry->maxburst,
- __entry->gpd_ring, &__entry->gpd_ring->dma,
+ __entry->gpd_ring, &__entry->gpd_ring_dma,
__entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
__entry->flags & MTU3_EP_STALL ? 'S' : 's',
__entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] usb: mtu3: Fix double dereference in TP_printk 2026-09-22 10:37 [PATCH] usb: mtu3: Fix double dereference in TP_printk Vladimir Murzin @ 2026-09-28 13:11 ` Vladimir Murzin 2026-09-28 18:21 ` Paul E. McKenney 0 siblings, 1 reply; 5+ messages in thread From: Vladimir Murzin @ 2026-09-28 13:11 UTC (permalink / raw) To: linux-usb Cc: linux-arm-kernel, linux-mediatek, linux-kernel, chunfeng.yun, gregkh, rostedt, paulmck, mark.rutland Hi All, Gentle ping... spat is still present in v7.3-rc5 Cheers Vladimir On 9/22/26 11:37, Vladimir Murzin wrote: > Paul reported kernel splat: > > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] ------------[ cut here ]------------ > [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 > [ 0.000000] Modules linked in: > [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT > [ 0.000000] Hardware name: linux,dummy-virt (DT) > [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > [ 0.000000] pc : test_double_dereference+0x144/0x14c > [ 0.000000] lr : test_double_dereference+0x144/0x14c > [ 0.000000] sp : ffffc80aa7633bf0 > [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f > [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 > [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 > [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 > [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 > [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 > [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 > [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 > [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 > [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 > [ 0.000000] Call trace: > [ 0.000000] test_double_dereference+0x144/0x14c (P) > [ 0.000000] trace_event_raw_init+0x37c/0x5d8 > [ 0.000000] event_init+0x34/0xc0 > [ 0.000000] trace_event_init+0xec/0x588 > [ 0.000000] trace_init+0x24/0x6e0 > [ 0.000000] start_kernel+0x4a0/0x8ec > [ 0.000000] __primary_switched+0x88/0x90 > [ 0.000000] irq event stamp: 0 > [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] ---[ end trace 0000000000000000 ]--- > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma > > Which also observed by Mark and myself. > > The splat it result of new check introduced by b5cc230af5e5 ("tracing: > Warn when an event dereferences a pointer in TP_printk()") which > correctly catches issue with %pad dereferencing the address saved in > the ring buffer. TP_fast_assign() logic gets executed when the > tracepoint is triggered, however the TP_printk() is executed when the > user reads the trace buffer which could be seconds, minutes, hours, > days, even months later and nothing guarantee that __entry->gpd_ring > pointer will still be pointing to what it was when it was recorded. > > Fix the issue by capturing immediate value of gpd_ring.dma when trace > point is triggered. > > Reported-by: Paul E. McKenney <paulmck@kernel.org> > Tested-by: Mark Rutland <mark.rutland@arm.com> > Reviewed-by: Steven Rostedt <rostedt@goodmis.org> > Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> > --- > drivers/usb/mtu3/mtu3_trace.h | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > index 89870175d635..9aaa167d69c1 100644 > --- a/drivers/usb/mtu3/mtu3_trace.h > +++ b/drivers/usb/mtu3/mtu3_trace.h > @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __field(unsigned int, flags) > __field(unsigned int, direction) > __field(struct mtu3_gpd_ring *, gpd_ring) > + __field(dma_addr_t, gpd_ring_dma) > ), > TP_fast_assign( > __assign_str(name); > @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __entry->flags = mep->flags; > __entry->direction = mep->is_in; > __entry->gpd_ring = &mep->gpd_ring; > + __entry->gpd_ring_dma = mep->gpd_ring.dma > ), > TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", > __get_str(name), usb_ep_type_string(__entry->type), > __entry->maxp, __entry->slot, > __entry->mult, __entry->maxburst, > - __entry->gpd_ring, &__entry->gpd_ring->dma, > + __entry->gpd_ring, &__entry->gpd_ring_dma, > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > __entry->flags & MTU3_EP_STALL ? 'S' : 's', > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', > -- 2.34.1 > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] usb: mtu3: Fix double dereference in TP_printk 2026-09-28 13:11 ` Vladimir Murzin @ 2026-09-28 18:21 ` Paul E. McKenney 2026-10-05 12:07 ` Vladimir Murzin 0 siblings, 1 reply; 5+ messages in thread From: Paul E. McKenney @ 2026-09-28 18:21 UTC (permalink / raw) To: Vladimir Murzin Cc: linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel, chunfeng.yun, gregkh, rostedt, mark.rutland On Mon, Sep 28, 2026 at 02:11:42PM +0100, Vladimir Murzin wrote: > Hi All, > > Gentle ping... spat is still present in v7.3-rc5 If no one else wants to push it, I can do so. I gotta admit that the resulting test failures when I forget to apply it are a bit annoying. ;-) Thanx, Paul > Cheers > Vladimir > > On 9/22/26 11:37, Vladimir Murzin wrote: > > Paul reported kernel splat: > > > > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > > [ 0.000000] ------------[ cut here ]------------ > > [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > > [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 > > [ 0.000000] Modules linked in: > > [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT > > [ 0.000000] Hardware name: linux,dummy-virt (DT) > > [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > > [ 0.000000] pc : test_double_dereference+0x144/0x14c > > [ 0.000000] lr : test_double_dereference+0x144/0x14c > > [ 0.000000] sp : ffffc80aa7633bf0 > > [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f > > [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 > > [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 > > [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 > > [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 > > [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 > > [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 > > [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 > > [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 > > [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 > > [ 0.000000] Call trace: > > [ 0.000000] test_double_dereference+0x144/0x14c (P) > > [ 0.000000] trace_event_raw_init+0x37c/0x5d8 > > [ 0.000000] event_init+0x34/0xc0 > > [ 0.000000] trace_event_init+0xec/0x588 > > [ 0.000000] trace_init+0x24/0x6e0 > > [ 0.000000] start_kernel+0x4a0/0x8ec > > [ 0.000000] __primary_switched+0x88/0x90 > > [ 0.000000] irq event stamp: 0 > > [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] ---[ end trace 0000000000000000 ]--- > > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma > > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma > > > > Which also observed by Mark and myself. > > > > The splat it result of new check introduced by b5cc230af5e5 ("tracing: > > Warn when an event dereferences a pointer in TP_printk()") which > > correctly catches issue with %pad dereferencing the address saved in > > the ring buffer. TP_fast_assign() logic gets executed when the > > tracepoint is triggered, however the TP_printk() is executed when the > > user reads the trace buffer which could be seconds, minutes, hours, > > days, even months later and nothing guarantee that __entry->gpd_ring > > pointer will still be pointing to what it was when it was recorded. > > > > Fix the issue by capturing immediate value of gpd_ring.dma when trace > > point is triggered. > > > > Reported-by: Paul E. McKenney <paulmck@kernel.org> > > Tested-by: Mark Rutland <mark.rutland@arm.com> > > Reviewed-by: Steven Rostedt <rostedt@goodmis.org> > > Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> > > --- > > drivers/usb/mtu3/mtu3_trace.h | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > > index 89870175d635..9aaa167d69c1 100644 > > --- a/drivers/usb/mtu3/mtu3_trace.h > > +++ b/drivers/usb/mtu3/mtu3_trace.h > > @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > > __field(unsigned int, flags) > > __field(unsigned int, direction) > > __field(struct mtu3_gpd_ring *, gpd_ring) > > + __field(dma_addr_t, gpd_ring_dma) > > ), > > TP_fast_assign( > > __assign_str(name); > > @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > > __entry->flags = mep->flags; > > __entry->direction = mep->is_in; > > __entry->gpd_ring = &mep->gpd_ring; > > + __entry->gpd_ring_dma = mep->gpd_ring.dma > > ), > > TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", > > __get_str(name), usb_ep_type_string(__entry->type), > > __entry->maxp, __entry->slot, > > __entry->mult, __entry->maxburst, > > - __entry->gpd_ring, &__entry->gpd_ring->dma, > > + __entry->gpd_ring, &__entry->gpd_ring_dma, > > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > > __entry->flags & MTU3_EP_STALL ? 'S' : 's', > > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', > > -- 2.34.1 > > > ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] usb: mtu3: Fix double dereference in TP_printk 2026-09-28 18:21 ` Paul E. McKenney @ 2026-10-05 12:07 ` Vladimir Murzin 2026-10-05 15:51 ` Paul E. McKenney 0 siblings, 1 reply; 5+ messages in thread From: Vladimir Murzin @ 2026-10-05 12:07 UTC (permalink / raw) To: paulmck Cc: linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel, chunfeng.yun, gregkh, rostedt, mark.rutland Hi All, On 9/28/26 19:21, Paul E. McKenney wrote: > On Mon, Sep 28, 2026 at 02:11:42PM +0100, Vladimir Murzin wrote: >> Hi All, >> >> Gentle ping... spat is still present in v7.3-rc5 > If no one else wants to push it, I can do so. I gotta admit that the > resulting test failures when I forget to apply it are a bit annoying. ;-) > > Thanx, Paul > FYI, splat is still present in v7.3-rc6 :( Thanks Vladimir >> Cheers >> Vladimir >> >> On 9/22/26 11:37, Vladimir Murzin wrote: >>> Paul reported kernel splat: >>> >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma >>> [ 0.000000] ------------[ cut here ]------------ >>> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma >>> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 >>> [ 0.000000] Modules linked in: >>> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT >>> [ 0.000000] Hardware name: linux,dummy-virt (DT) >>> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) >>> [ 0.000000] pc : test_double_dereference+0x144/0x14c >>> [ 0.000000] lr : test_double_dereference+0x144/0x14c >>> [ 0.000000] sp : ffffc80aa7633bf0 >>> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f >>> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 >>> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 >>> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 >>> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 >>> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 >>> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 >>> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 >>> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 >>> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 >>> [ 0.000000] Call trace: >>> [ 0.000000] test_double_dereference+0x144/0x14c (P) >>> [ 0.000000] trace_event_raw_init+0x37c/0x5d8 >>> [ 0.000000] event_init+0x34/0xc0 >>> [ 0.000000] trace_event_init+0xec/0x588 >>> [ 0.000000] trace_init+0x24/0x6e0 >>> [ 0.000000] start_kernel+0x4a0/0x8ec >>> [ 0.000000] __primary_switched+0x88/0x90 >>> [ 0.000000] irq event stamp: 0 >>> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] ---[ end trace 0000000000000000 ]--- >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma >>> >>> Which also observed by Mark and myself. >>> >>> The splat it result of new check introduced by b5cc230af5e5 ("tracing: >>> Warn when an event dereferences a pointer in TP_printk()") which >>> correctly catches issue with %pad dereferencing the address saved in >>> the ring buffer. TP_fast_assign() logic gets executed when the >>> tracepoint is triggered, however the TP_printk() is executed when the >>> user reads the trace buffer which could be seconds, minutes, hours, >>> days, even months later and nothing guarantee that __entry->gpd_ring >>> pointer will still be pointing to what it was when it was recorded. >>> >>> Fix the issue by capturing immediate value of gpd_ring.dma when trace >>> point is triggered. >>> >>> Reported-by: Paul E. McKenney <paulmck@kernel.org> >>> Tested-by: Mark Rutland <mark.rutland@arm.com> >>> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> >>> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> >>> --- >>> drivers/usb/mtu3/mtu3_trace.h | 4 +++- >>> 1 file changed, 3 insertions(+), 1 deletion(-) >>> >>> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h >>> index 89870175d635..9aaa167d69c1 100644 >>> --- a/drivers/usb/mtu3/mtu3_trace.h >>> +++ b/drivers/usb/mtu3/mtu3_trace.h >>> @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, >>> __field(unsigned int, flags) >>> __field(unsigned int, direction) >>> __field(struct mtu3_gpd_ring *, gpd_ring) >>> + __field(dma_addr_t, gpd_ring_dma) >>> ), >>> TP_fast_assign( >>> __assign_str(name); >>> @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, >>> __entry->flags = mep->flags; >>> __entry->direction = mep->is_in; >>> __entry->gpd_ring = &mep->gpd_ring; >>> + __entry->gpd_ring_dma = mep->gpd_ring.dma >>> ), >>> TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", >>> __get_str(name), usb_ep_type_string(__entry->type), >>> __entry->maxp, __entry->slot, >>> __entry->mult, __entry->maxburst, >>> - __entry->gpd_ring, &__entry->gpd_ring->dma, >>> + __entry->gpd_ring, &__entry->gpd_ring_dma, >>> __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', >>> __entry->flags & MTU3_EP_STALL ? 'S' : 's', >>> __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', >>> -- 2.34.1 >>> ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] usb: mtu3: Fix double dereference in TP_printk 2026-10-05 12:07 ` Vladimir Murzin @ 2026-10-05 15:51 ` Paul E. McKenney 0 siblings, 0 replies; 5+ messages in thread From: Paul E. McKenney @ 2026-10-05 15:51 UTC (permalink / raw) To: Vladimir Murzin Cc: linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel, chunfeng.yun, gregkh, rostedt, mark.rutland On Mon, Oct 05, 2026 at 01:07:18PM +0100, Vladimir Murzin wrote: > Hi All, > > On 9/28/26 19:21, Paul E. McKenney wrote: > > On Mon, Sep 28, 2026 at 02:11:42PM +0100, Vladimir Murzin wrote: > >> Hi All, > >> > >> Gentle ping... spat is still present in v7.3-rc5 > > If no one else wants to push it, I can do so. I gotta admit that the > > resulting test failures when I forget to apply it are a bit annoying. ;-) > > > > Thanx, Paul > > > > FYI, splat is still present in v7.3-rc6 :( OK, I was thinking in terms of pushing it into the upcoming merge window, but I could be persuaded to see if Linus will take it this week. I have one other commit I need to push anyway. Thanx, Paul > Thanks > Vladimir > > >> Cheers > >> Vladimir > >> > >> On 9/22/26 11:37, Vladimir Murzin wrote: > >>> Paul reported kernel splat: > >>> > >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > >>> [ 0.000000] ------------[ cut here ]------------ > >>> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > >>> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 > >>> [ 0.000000] Modules linked in: > >>> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT > >>> [ 0.000000] Hardware name: linux,dummy-virt (DT) > >>> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > >>> [ 0.000000] pc : test_double_dereference+0x144/0x14c > >>> [ 0.000000] lr : test_double_dereference+0x144/0x14c > >>> [ 0.000000] sp : ffffc80aa7633bf0 > >>> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f > >>> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 > >>> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 > >>> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 > >>> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 > >>> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 > >>> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 > >>> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 > >>> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 > >>> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 > >>> [ 0.000000] Call trace: > >>> [ 0.000000] test_double_dereference+0x144/0x14c (P) > >>> [ 0.000000] trace_event_raw_init+0x37c/0x5d8 > >>> [ 0.000000] event_init+0x34/0xc0 > >>> [ 0.000000] trace_event_init+0xec/0x588 > >>> [ 0.000000] trace_init+0x24/0x6e0 > >>> [ 0.000000] start_kernel+0x4a0/0x8ec > >>> [ 0.000000] __primary_switched+0x88/0x90 > >>> [ 0.000000] irq event stamp: 0 > >>> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 > >>> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 > >>> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 > >>> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 > >>> [ 0.000000] ---[ end trace 0000000000000000 ]--- > >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma > >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma > >>> > >>> Which also observed by Mark and myself. > >>> > >>> The splat it result of new check introduced by b5cc230af5e5 ("tracing: > >>> Warn when an event dereferences a pointer in TP_printk()") which > >>> correctly catches issue with %pad dereferencing the address saved in > >>> the ring buffer. TP_fast_assign() logic gets executed when the > >>> tracepoint is triggered, however the TP_printk() is executed when the > >>> user reads the trace buffer which could be seconds, minutes, hours, > >>> days, even months later and nothing guarantee that __entry->gpd_ring > >>> pointer will still be pointing to what it was when it was recorded. > >>> > >>> Fix the issue by capturing immediate value of gpd_ring.dma when trace > >>> point is triggered. > >>> > >>> Reported-by: Paul E. McKenney <paulmck@kernel.org> > >>> Tested-by: Mark Rutland <mark.rutland@arm.com> > >>> Reviewed-by: Steven Rostedt <rostedt@goodmis.org> > >>> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> > >>> --- > >>> drivers/usb/mtu3/mtu3_trace.h | 4 +++- > >>> 1 file changed, 3 insertions(+), 1 deletion(-) > >>> > >>> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > >>> index 89870175d635..9aaa167d69c1 100644 > >>> --- a/drivers/usb/mtu3/mtu3_trace.h > >>> +++ b/drivers/usb/mtu3/mtu3_trace.h > >>> @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > >>> __field(unsigned int, flags) > >>> __field(unsigned int, direction) > >>> __field(struct mtu3_gpd_ring *, gpd_ring) > >>> + __field(dma_addr_t, gpd_ring_dma) > >>> ), > >>> TP_fast_assign( > >>> __assign_str(name); > >>> @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > >>> __entry->flags = mep->flags; > >>> __entry->direction = mep->is_in; > >>> __entry->gpd_ring = &mep->gpd_ring; > >>> + __entry->gpd_ring_dma = mep->gpd_ring.dma > >>> ), > >>> TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", > >>> __get_str(name), usb_ep_type_string(__entry->type), > >>> __entry->maxp, __entry->slot, > >>> __entry->mult, __entry->maxburst, > >>> - __entry->gpd_ring, &__entry->gpd_ring->dma, > >>> + __entry->gpd_ring, &__entry->gpd_ring_dma, > >>> __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > >>> __entry->flags & MTU3_EP_STALL ? 'S' : 's', > >>> __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', > >>> -- 2.34.1 > >>> > ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-05 15:52 UTC | newest] Thread overview: 5+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-09-22 10:37 [PATCH] usb: mtu3: Fix double dereference in TP_printk Vladimir Murzin 2026-09-28 13:11 ` Vladimir Murzin 2026-09-28 18:21 ` Paul E. McKenney 2026-10-05 12:07 ` Vladimir Murzin 2026-10-05 15:51 ` Paul E. McKenney
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox