From: Oliver Neukum <oneukum@suse.com>
To: Alan Stern <stern@rowland.harvard.edu>, Oliver Neukum <oneukum@suse.com>
Cc: 白烁冉 <baishuoran@hrbeu.edu.cn>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Dmitry Torokhov" <dmitry.torokhov@gmail.com>,
"Kun Hu" <huk23@m.fudan.edu.cn>,
"Jiaji Qin" <jjtan24@m.fudan.edu.cn>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-input@vger.kernel.org, syzkaller@googlegroups.com
Subject: Re: WARNING in cm109_urb_irq_callback/usb_submit_urb
Date: Thu, 27 Mar 2025 12:42:41 +0100 [thread overview]
Message-ID: <04a011b5-a7fa-4270-a072-365b5abd2aec@suse.com> (raw)
In-Reply-To: <07f2ec1a-0363-4734-97ff-a129699b1907@rowland.harvard.edu>
Hi,
On 20.03.25 18:25, Alan Stern wrote:
>> static void cm109_stop_traffic(struct cm109_dev *dev)
>> {
>> dev->shutdown = 1;
>> /*
>> * Make sure other CPUs see this
>> */
>> smp_wmb();
>> usb_kill_urb(dev->urb_ctl);
>> usb_kill_urb(dev->urb_irq);
>> cm109_toggle_buzzer_sync(dev, 0);
>> dev->shutdown = 0;
>> smp_wmb();
>
> I don't know anything about this driver, but the placement of the second
> smp_wmb() looks odd. Should it really come before the line that sets
Indeed. This driver is not written for comprehension. As far as I can tell
it is not necessary at all. You need to set shutdown to zero before you
resubmit the URBs. But I don't see how the barrier helps with that.
> dev->shutdown to 0? In general, smp_wmb() is used to separate two sets
> of stores; if it comes after all the relevant stores have been performed
> then it won't accomplish anything.
Don't we guarantee an interaction between smp_wmb() and taking a spinlock?
>
>> }
>>
>> This driver has a tough job as the two completion
>> handlers submitted each other's as well as their own
>> URBs based on the data they get.
>> That scheme is rather complex, but as far as I can tell correct,
>> but you need to test that flag everywhere.
>
> However, it's quite noticeable that the code you want to change in
> cm109_submit_buzz_toggle() doesn't have any memory barriers to pair with
> the smb_wmb()'s above. Shouldn't there at least be an smp_rmb() after
> you read dev->shutdown?
I think this driver assumes that the ctl_submit_lock spinlock makes
it safe.
> As long you're updating the synchronization, it might be a good idea to
> also improve the comment describing the memory barriers. "Make sure
> other CPUs see this" doesn't mean anything -- of course all the other
> CPUs will eventually see the changes made here. The point is that they
> should see the new value of dev->shutdown before seeing the final
> completion of the two URBs. Also, the comment should say which other
> memory barriers pair with the ones here.
Before the completion? AFAICT they need to see it before they try
to submit an URB.
Regards
Oliver
next prev parent reply other threads:[~2025-03-27 11:42 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-03-20 4:39 WARNING in cm109_urb_irq_callback/usb_submit_urb 白烁冉
2025-03-20 13:35 ` Oliver Neukum
2025-03-20 14:16 ` 胡焜
2025-03-20 14:25 ` Alan Stern
2025-03-20 15:42 ` Oliver Neukum
2025-03-20 17:25 ` Alan Stern
2025-03-27 11:42 ` Oliver Neukum [this message]
2025-03-27 14:27 ` Alan Stern
2025-04-01 9:40 ` 胡焜
2025-04-07 3:46 ` 胡焜
2025-03-20 13:40 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=04a011b5-a7fa-4270-a072-365b5abd2aec@suse.com \
--to=oneukum@suse.com \
--cc=baishuoran@hrbeu.edu.cn \
--cc=dmitry.torokhov@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=huk23@m.fudan.edu.cn \
--cc=jjtan24@m.fudan.edu.cn \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stern@rowland.harvard.edu \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox