[BUG] usb: gadget: Kernel oops with UVC USB gadget and configfs

[robert.jarzmik@free.fr (Robert Jarzmik)]

Petr Cvek <petr.cvek@tul.cz> writes:

> Dne 12.2.2017 v 13:02 Robert Jarzmik napsal(a):
> That's weird I even removed pxa_set_udc_info() from magician machine init and it still fails.
> Host cable and/or actual camera is not required. It fails without them.
>
> So you binded pxa27x-udc as UDC controller (= activated it) and then rmmoded
> it and nobody complained?
No, that usecase actually fails. I think you could submit a proper patch with
the diff in [1], with which the pxa27x-udc unloading will work.

But it's not _your_ testcase, as per your provided callstack :
[ 2152.826529] [<bf4a1914>] (udc_bind_to_driver [udc_core]) from [<bf4a1b08>] (usb_add_gadget_udc_release+0x138/0x21c [udc_core])
[ 2152.826731] [<bf4a1b08>] (usb_add_gadget_udc_release [udc_core]) from [<bf4db838>] (pxa_udc_probe+0x290/0x2fc [pxa27x_udc])
[ 2152.833554] [<bf4db838>] (pxa_udc_probe [pxa27x_udc]) from [<c02522d0>] (platform_drv_probe+0x38/0x84)
[ 2152.833602] [<c02522d0>] (platform_drv_probe) from [<c0250784>] (driver_probe_device+0x1e0/0x3f4)

Your problem seems in the pxa_udc_probe(), which I would presume you're doing
for a second time, ie. after modprobe pxa27x_udc + bind UDC controller + rmmod
pxa27x_udc + modprobe pxa27x_udc.

I suspect that in this case, the problem is that the rmmod works while udc is
still bound to the composite. The lsmod seems to prove that the refcount is
still 0 while usb_f_uvc is is bound to pxa27x_udc.

[@Felipe and @Laurent]
I have no knowledge of usb_f_uvc, so would you tell me if binding usb_f_uvc to
pxa27_udc should have incremented the module refcount of pxa27x_udc or not ?

> Can you try v4.10? Or send me exact commit on what you tested it so I can test
> it too.
My top commit (not counting yours) is : 61c04572de40 ("Merge branch 'for-rc' of
git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux")

Cheers.

-- 
Robert

[1]
diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
index 9fb103348b5d..a239eb836652 100644
--- a/drivers/usb/gadget/udc/pxa27x_udc.c
+++ b/drivers/usb/gadget/udc/pxa27x_udc.c
@@ -2512,7 +2512,8 @@ static int pxa_udc_remove(struct platform_device *_dev)
        usb_del_gadget_udc(&udc->gadget);
        pxa_cleanup_debugfs(udc);
 
-       usb_put_phy(udc->transceiver);
+       if (!IS_ERR(udc->transceiver))
+               usb_put_phy(udc->transceiver);
 
        udc->transceiver = NULL;
        the_controller = NULL;