* [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
@ 2026-09-03 23:59 Paul E. McKenney
2026-09-07 13:28 ` Vladimir Murzin
0 siblings, 1 reply; 7+ messages in thread
From: Paul E. McKenney @ 2026-09-03 23:59 UTC (permalink / raw)
To: Chunfeng Yun, Greg Kroah-Hartman
Cc: linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel
This is more bug report than patch, but this patch does suppress the
splat, so there is that. ;-)
Kernels built with either KASAN or KCSAN produce this splat:
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] ------------[ cut here ]------------
[ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
[ 0.000000] Hardware name: linux,dummy-virt (DT)
[ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 0.000000] pc : test_double_dereference+0x144/0x14c
[ 0.000000] lr : test_double_dereference+0x144/0x14c
[ 0.000000] sp : ffffc80aa7633bf0
[ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
[ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
[ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
[ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
[ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
[ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
[ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
[ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
[ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
[ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
[ 0.000000] Call trace:
[ 0.000000] test_double_dereference+0x144/0x14c (P)
[ 0.000000] trace_event_raw_init+0x37c/0x5d8
[ 0.000000] event_init+0x34/0xc0
[ 0.000000] trace_event_init+0xec/0x588
[ 0.000000] trace_init+0x24/0x6e0
[ 0.000000] start_kernel+0x4a0/0x8ec
[ 0.000000] __primary_switched+0x88/0x90
[ 0.000000] irq event stamp: 0
[ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
[ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
[ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
[ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
Apparently, the code should instead create another entry in
TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead
of TP_printk(). But simply removing the offending double indirection
in TP_printk() gets this splat out of the way of other debugging.
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Chunfeng Yun <chunfeng.yun@mediatek.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <linux-usb@vger.kernel.org>
Cc: <linux-arm-kernel@lists.infradead.org>
Cc: <linux-mediatek@lists.infradead.org>
diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
index 89870175d63561..7c414e196d5871 100644
--- a/drivers/usb/mtu3/mtu3_trace.h
+++ b/drivers/usb/mtu3/mtu3_trace.h
@@ -236,11 +236,11 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__entry->direction = mep->is_in;
__entry->gpd_ring = &mep->gpd_ring;
),
- TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
+ TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p flags %c:%c%c%c:%c",
__get_str(name), usb_ep_type_string(__entry->type),
__entry->maxp, __entry->slot,
__entry->mult, __entry->maxburst,
- __entry->gpd_ring, &__entry->gpd_ring->dma,
+ __entry->gpd_ring,
__entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
__entry->flags & MTU3_EP_STALL ? 'S' : 's',
__entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
2026-09-03 23:59 [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue Paul E. McKenney
@ 2026-09-07 13:28 ` Vladimir Murzin
2026-09-08 18:08 ` Paul E. McKenney
0 siblings, 1 reply; 7+ messages in thread
From: Vladimir Murzin @ 2026-09-07 13:28 UTC (permalink / raw)
To: paulmck, Chunfeng Yun, Greg Kroah-Hartman, rostedt
Cc: linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel
On 9/4/26 00:59, Paul E. McKenney wrote:
> This is more bug report than patch, but this patch does suppress the
> splat, so there is that. ;-)
>
> Kernels built with either KASAN or KCSAN produce this splat:
>
I see it on kernel w/o KASAN or KCSAN. IIUC, this is new check introduced
by b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()")
so adding Steven :)
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] ------------[ cut here ]------------
> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
> [ 0.000000] Modules linked in:
> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
> [ 0.000000] Hardware name: linux,dummy-virt (DT)
> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 0.000000] pc : test_double_dereference+0x144/0x14c
> [ 0.000000] lr : test_double_dereference+0x144/0x14c
> [ 0.000000] sp : ffffc80aa7633bf0
> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
> [ 0.000000] Call trace:
> [ 0.000000] test_double_dereference+0x144/0x14c (P)
> [ 0.000000] trace_event_raw_init+0x37c/0x5d8
> [ 0.000000] event_init+0x34/0xc0
> [ 0.000000] trace_event_init+0xec/0x588
> [ 0.000000] trace_init+0x24/0x6e0
> [ 0.000000] start_kernel+0x4a0/0x8ec
> [ 0.000000] __primary_switched+0x88/0x90
> [ 0.000000] irq event stamp: 0
> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] ---[ end trace 0000000000000000 ]---
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
>
> Apparently, the code should instead create another entry in
> TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead
> of TP_printk(). But simply removing the offending double indirection
> in TP_printk() gets this splat out of the way of other debugging.
>
Indeed, splat has gone after applying the patch.
Thanks
Vladimir
> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: <linux-usb@vger.kernel.org>
> Cc: <linux-arm-kernel@lists.infradead.org>
> Cc: <linux-mediatek@lists.infradead.org>
>
> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
> index 89870175d63561..7c414e196d5871 100644
> --- a/drivers/usb/mtu3/mtu3_trace.h
> +++ b/drivers/usb/mtu3/mtu3_trace.h
> @@ -236,11 +236,11 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __entry->direction = mep->is_in;
> __entry->gpd_ring = &mep->gpd_ring;
> ),
> - TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
> + TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p flags %c:%c%c%c:%c",
> __get_str(name), usb_ep_type_string(__entry->type),
> __entry->maxp, __entry->slot,
> __entry->mult, __entry->maxburst,
> - __entry->gpd_ring, &__entry->gpd_ring->dma,
> + __entry->gpd_ring,
> __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
> __entry->flags & MTU3_EP_STALL ? 'S' : 's',
> __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
2026-09-07 13:28 ` Vladimir Murzin
@ 2026-09-08 18:08 ` Paul E. McKenney
2026-09-09 10:31 ` Vladimir Murzin
2026-09-09 13:34 ` Steven Rostedt
0 siblings, 2 replies; 7+ messages in thread
From: Paul E. McKenney @ 2026-09-08 18:08 UTC (permalink / raw)
To: Vladimir Murzin
Cc: Chunfeng Yun, Greg Kroah-Hartman, rostedt, linux-usb,
linux-arm-kernel, linux-mediatek, linux-kernel
On Mon, Sep 07, 2026 at 02:28:47PM +0100, Vladimir Murzin wrote:
> On 9/4/26 00:59, Paul E. McKenney wrote:
> > This is more bug report than patch, but this patch does suppress the
> > splat, so there is that. ;-)
> >
> > Kernels built with either KASAN or KCSAN produce this splat:
> >
>
> I see it on kernel w/o KASAN or KCSAN. IIUC, this is new check introduced
> by b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()")
> so adding Steven :)
>
> > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> > [ 0.000000] ------------[ cut here ]------------
> > [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> > [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
> > [ 0.000000] Modules linked in:
> > [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
> > [ 0.000000] Hardware name: linux,dummy-virt (DT)
> > [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > [ 0.000000] pc : test_double_dereference+0x144/0x14c
> > [ 0.000000] lr : test_double_dereference+0x144/0x14c
> > [ 0.000000] sp : ffffc80aa7633bf0
> > [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
> > [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
> > [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
> > [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
> > [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
> > [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
> > [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
> > [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
> > [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
> > [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
> > [ 0.000000] Call trace:
> > [ 0.000000] test_double_dereference+0x144/0x14c (P)
> > [ 0.000000] trace_event_raw_init+0x37c/0x5d8
> > [ 0.000000] event_init+0x34/0xc0
> > [ 0.000000] trace_event_init+0xec/0x588
> > [ 0.000000] trace_init+0x24/0x6e0
> > [ 0.000000] start_kernel+0x4a0/0x8ec
> > [ 0.000000] __primary_switched+0x88/0x90
> > [ 0.000000] irq event stamp: 0
> > [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
> > [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
> > [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
> > [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
> > [ 0.000000] ---[ end trace 0000000000000000 ]---
> > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
> > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
> >
> > Apparently, the code should instead create another entry in
> > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead
> > of TP_printk(). But simply removing the offending double indirection
> > in TP_printk() gets this splat out of the way of other debugging.
>
> Indeed, splat has gone after applying the patch.
>
> Thanks
> Vladimir
Does this less hacky patch do the trick?
Thanx, Paul
------------------------------------------------------------------------
commit afda2321e6e93a5bcc28bfb4717fbc3a1768446c
Author: Paul E. McKenney <paulmck@kernel.org>
Date: Thu Sep 3 16:48:09 2026 -0700
EXP drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
Kernels built with either KASAN or KCSAN produce this splat:
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] ------------[ cut here ]------------
[ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
[ 0.000000] Modules linked in:
[ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
[ 0.000000] Hardware name: linux,dummy-virt (DT)
[ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 0.000000] pc : test_double_dereference+0x144/0x14c
[ 0.000000] lr : test_double_dereference+0x144/0x14c
[ 0.000000] sp : ffffc80aa7633bf0
[ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
[ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
[ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
[ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
[ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
[ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
[ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
[ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
[ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
[ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
[ 0.000000] Call trace:
[ 0.000000] test_double_dereference+0x144/0x14c (P)
[ 0.000000] trace_event_raw_init+0x37c/0x5d8
[ 0.000000] event_init+0x34/0xc0
[ 0.000000] trace_event_init+0xec/0x588
[ 0.000000] trace_init+0x24/0x6e0
[ 0.000000] start_kernel+0x4a0/0x8ec
[ 0.000000] __primary_switched+0x88/0x90
[ 0.000000] irq event stamp: 0
[ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
[ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
[ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
[ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
[ 0.000000] ---[ end trace 0000000000000000 ]---
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
[ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
Therefore, work around this restriction by creating another entry in
TP_STRUCT__entry(), and do the double-indirection TP_fast_assign()
instead of TP_printk().
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Cc: Chunfeng Yun <chunfeng.yun@mediatek.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <linux-usb@vger.kernel.org>
Cc: <linux-arm-kernel@lists.infradead.org>
Cc: <linux-mediatek@lists.infradead.org>
diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
index 89870175d63561..6477ad3ddc66f6 100644
--- a/drivers/usb/mtu3/mtu3_trace.h
+++ b/drivers/usb/mtu3/mtu3_trace.h
@@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__field(unsigned int, flags)
__field(unsigned int, direction)
__field(struct mtu3_gpd_ring *, gpd_ring)
+ __field(dma_addr_t *, gpd_ring_dma)
),
TP_fast_assign(
__assign_str(name);
@@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__entry->flags = mep->flags;
__entry->direction = mep->is_in;
__entry->gpd_ring = &mep->gpd_ring;
+ __entry->gpd_ring_dma = &mep->gpd_ring->dma;
),
TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
__get_str(name), usb_ep_type_string(__entry->type),
__entry->maxp, __entry->slot,
__entry->mult, __entry->maxburst,
- __entry->gpd_ring, &__entry->gpd_ring->dma,
+ __entry->gpd_ring, __entry->gpd_ring_dma,
__entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
__entry->flags & MTU3_EP_STALL ? 'S' : 's',
__entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
2026-09-08 18:08 ` Paul E. McKenney
@ 2026-09-09 10:31 ` Vladimir Murzin
2026-09-09 13:35 ` Steven Rostedt
2026-09-09 13:34 ` Steven Rostedt
1 sibling, 1 reply; 7+ messages in thread
From: Vladimir Murzin @ 2026-09-09 10:31 UTC (permalink / raw)
To: paulmck
Cc: Chunfeng Yun, Greg Kroah-Hartman, rostedt, linux-usb,
linux-arm-kernel, linux-mediatek, linux-kernel
On 9/8/26 19:08, Paul E. McKenney wrote:
> On Mon, Sep 07, 2026 at 02:28:47PM +0100, Vladimir Murzin wrote:
>> On 9/4/26 00:59, Paul E. McKenney wrote:
>>> This is more bug report than patch, but this patch does suppress the
>>> splat, so there is that. ;-)
>>>
>>> Kernels built with either KASAN or KCSAN produce this splat:
>>>
>> I see it on kernel w/o KASAN or KCSAN. IIUC, this is new check introduced
>> by b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()")
>> so adding Steven :)
>>
>>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
>>> [ 0.000000] ------------[ cut here ]------------
>>> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
>>> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
>>> [ 0.000000] Modules linked in:
>>> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
>>> [ 0.000000] Hardware name: linux,dummy-virt (DT)
>>> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>>> [ 0.000000] pc : test_double_dereference+0x144/0x14c
>>> [ 0.000000] lr : test_double_dereference+0x144/0x14c
>>> [ 0.000000] sp : ffffc80aa7633bf0
>>> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
>>> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
>>> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
>>> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
>>> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
>>> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
>>> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
>>> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
>>> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
>>> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
>>> [ 0.000000] Call trace:
>>> [ 0.000000] test_double_dereference+0x144/0x14c (P)
>>> [ 0.000000] trace_event_raw_init+0x37c/0x5d8
>>> [ 0.000000] event_init+0x34/0xc0
>>> [ 0.000000] trace_event_init+0xec/0x588
>>> [ 0.000000] trace_init+0x24/0x6e0
>>> [ 0.000000] start_kernel+0x4a0/0x8ec
>>> [ 0.000000] __primary_switched+0x88/0x90
>>> [ 0.000000] irq event stamp: 0
>>> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] ---[ end trace 0000000000000000 ]---
>>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
>>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
>>>
>>> Apparently, the code should instead create another entry in
>>> TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead
>>> of TP_printk(). But simply removing the offending double indirection
>>> in TP_printk() gets this splat out of the way of other debugging.
>> Indeed, splat has gone after applying the patch.
>>
>> Thanks
>> Vladimir
> Does this less hacky patch do the trick?
>
Not quite :(
> Thanx, Paul
>
> ------------------------------------------------------------------------
>
> commit afda2321e6e93a5bcc28bfb4717fbc3a1768446c
> Author: Paul E. McKenney <paulmck@kernel.org>
> Date: Thu Sep 3 16:48:09 2026 -0700
>
> EXP drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
What is EXP?
>
> Kernels built with either KASAN or KCSAN produce this splat:
>
Like I said in my other reply I hit the splat with neither KASAN or KCSAN are enabled.
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] ------------[ cut here ]------------
> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
> [ 0.000000] Modules linked in:
> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
> [ 0.000000] Hardware name: linux,dummy-virt (DT)
> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 0.000000] pc : test_double_dereference+0x144/0x14c
> [ 0.000000] lr : test_double_dereference+0x144/0x14c
> [ 0.000000] sp : ffffc80aa7633bf0
> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
> [ 0.000000] Call trace:
> [ 0.000000] test_double_dereference+0x144/0x14c (P)
> [ 0.000000] trace_event_raw_init+0x37c/0x5d8
> [ 0.000000] event_init+0x34/0xc0
> [ 0.000000] trace_event_init+0xec/0x588
> [ 0.000000] trace_init+0x24/0x6e0
> [ 0.000000] start_kernel+0x4a0/0x8ec
> [ 0.000000] __primary_switched+0x88/0x90
> [ 0.000000] irq event stamp: 0
> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] ---[ end trace 0000000000000000 ]---
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
>
> Therefore, work around this restriction by creating another entry in
> TP_STRUCT__entry(), and do the double-indirection TP_fast_assign()
> instead of TP_printk().
>
> Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: <linux-usb@vger.kernel.org>
> Cc: <linux-arm-kernel@lists.infradead.org>
> Cc: <linux-mediatek@lists.infradead.org>
>
> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
> index 89870175d63561..6477ad3ddc66f6 100644
> --- a/drivers/usb/mtu3/mtu3_trace.h
> +++ b/drivers/usb/mtu3/mtu3_trace.h
> @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __field(unsigned int, flags)
> __field(unsigned int, direction)
> __field(struct mtu3_gpd_ring *, gpd_ring)
> + __field(dma_addr_t *, gpd_ring_dma)
> ),
> TP_fast_assign(
> __assign_str(name);
> @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __entry->flags = mep->flags;
> __entry->direction = mep->is_in;
> __entry->gpd_ring = &mep->gpd_ring;
> + __entry->gpd_ring_dma = &mep->gpd_ring->dma;
This doesn't build for me
./drivers/usb/mtu3/./mtu3_trace.h:239:55: error: invalid type argument of ‘->’ (have ‘struct mtu3_gpd_ring’)
239 | __entry->gpd_ring_dma = &mep->gpd_ring->dma;
| ^~
> ),
> TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
> __get_str(name), usb_ep_type_string(__entry->type),
> __entry->maxp, __entry->slot,
> __entry->mult, __entry->maxburst,
> - __entry->gpd_ring, &__entry->gpd_ring->dma,
> + __entry->gpd_ring, __entry->gpd_ring_dma,
> __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
> __entry->flags & MTU3_EP_STALL ? 'S' : 's',
> __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
>
I've done a little bit massaging and here is what worked for me
diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
index 89870175d635..4d4bae25fa1f 100644
--- a/drivers/usb/mtu3/mtu3_trace.h
+++ b/drivers/usb/mtu3/mtu3_trace.h
@@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__field(unsigned int, flags)
__field(unsigned int, direction)
__field(struct mtu3_gpd_ring *, gpd_ring)
+ __field(dma_addr_t, gpd_ring_dma)
),
TP_fast_assign(
__assign_str(name);
@@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__entry->flags = mep->flags;
__entry->direction = mep->is_in;
__entry->gpd_ring = &mep->gpd_ring;
+ __entry->gpd_ring_dma = mep->gpd_ring.dma;
),
TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
__get_str(name), usb_ep_type_string(__entry->type),
__entry->maxp, __entry->slot,
__entry->mult, __entry->maxburst,
- __entry->gpd_ring, &__entry->gpd_ring->dma,
+ __entry->gpd_ring, &__entry->gpd_ring_dma,
__entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
__entry->flags & MTU3_EP_STALL ? 'S' : 's',
__entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
Cheers
Vladimir
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
2026-09-08 18:08 ` Paul E. McKenney
2026-09-09 10:31 ` Vladimir Murzin
@ 2026-09-09 13:34 ` Steven Rostedt
2026-09-09 15:14 ` Paul E. McKenney
1 sibling, 1 reply; 7+ messages in thread
From: Steven Rostedt @ 2026-09-09 13:34 UTC (permalink / raw)
To: Paul E. McKenney
Cc: Vladimir Murzin, Chunfeng Yun, Greg Kroah-Hartman, linux-usb,
linux-arm-kernel, linux-mediatek, linux-kernel
On Tue, 8 Sep 2026 11:08:33 -0700
"Paul E. McKenney" <paulmck@kernel.org> wrote:
> > > Apparently, the code should instead create another entry in
> > > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead
> > > of TP_printk(). But simply removing the offending double indirection
> > > in TP_printk() gets this splat out of the way of other debugging.
> >
> > Indeed, splat has gone after applying the patch.
> >
> > Thanks
> > Vladimir
>
> Does this less hacky patch do the trick?
Nope!
> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
> index 89870175d63561..6477ad3ddc66f6 100644
> --- a/drivers/usb/mtu3/mtu3_trace.h
> +++ b/drivers/usb/mtu3/mtu3_trace.h
> @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __field(unsigned int, flags)
> __field(unsigned int, direction)
> __field(struct mtu3_gpd_ring *, gpd_ring)
> + __field(dma_addr_t *, gpd_ring_dma)
> ),
> TP_fast_assign(
> __assign_str(name);
> @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __entry->flags = mep->flags;
> __entry->direction = mep->is_in;
> __entry->gpd_ring = &mep->gpd_ring;
> + __entry->gpd_ring_dma = &mep->gpd_ring->dma;
You are still saving the address of some memory into the ring buffer.
> ),
> TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
^^^^
That %pad dereferences the pointer passed to it.
> __get_str(name), usb_ep_type_string(__entry->type),
> __entry->maxp, __entry->slot,
> __entry->mult, __entry->maxburst,
> - __entry->gpd_ring, &__entry->gpd_ring->dma,
> + __entry->gpd_ring, __entry->gpd_ring_dma,
That will read the address saved in the ring buffer and dereference it.
Remember, the above TP_fast_assign() logic gets executed when the
tracepoint is triggered. The TP_printk() is executed when the user reads
the trace buffer. That could be seconds, minutes, hours, days, even months
later!
You can't trust that the memory you are dereferencing will not be freed
when the user reads the trace.
The original patch is not hacky. It is actually the correct way of handling
this.
-- Steve
> __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
> __entry->flags & MTU3_EP_STALL ? 'S' : 's',
> __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
2026-09-09 10:31 ` Vladimir Murzin
@ 2026-09-09 13:35 ` Steven Rostedt
0 siblings, 0 replies; 7+ messages in thread
From: Steven Rostedt @ 2026-09-09 13:35 UTC (permalink / raw)
To: Vladimir Murzin
Cc: paulmck, Chunfeng Yun, Greg Kroah-Hartman, linux-usb,
linux-arm-kernel, linux-mediatek, linux-kernel
On Wed, 9 Sep 2026 11:31:28 +0100
Vladimir Murzin <vladimir.murzin@arm.com> wrote:
> I've done a little bit massaging and here is what worked for me
>
>
> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
> index 89870175d635..4d4bae25fa1f 100644
> --- a/drivers/usb/mtu3/mtu3_trace.h
> +++ b/drivers/usb/mtu3/mtu3_trace.h
> @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __field(unsigned int, flags)
> __field(unsigned int, direction)
> __field(struct mtu3_gpd_ring *, gpd_ring)
> + __field(dma_addr_t, gpd_ring_dma)
> ),
> TP_fast_assign(
> __assign_str(name);
> @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __entry->flags = mep->flags;
> __entry->direction = mep->is_in;
> __entry->gpd_ring = &mep->gpd_ring;
> + __entry->gpd_ring_dma = mep->gpd_ring.dma;
> ),
> TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
> __get_str(name), usb_ep_type_string(__entry->type),
> __entry->maxp, __entry->slot,
> __entry->mult, __entry->maxburst,
> - __entry->gpd_ring, &__entry->gpd_ring->dma,
> + __entry->gpd_ring, &__entry->gpd_ring_dma,
> __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
> __entry->flags & MTU3_EP_STALL ? 'S' : 's',
> __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
LGTM,
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
-- Steve
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue
2026-09-09 13:34 ` Steven Rostedt
@ 2026-09-09 15:14 ` Paul E. McKenney
0 siblings, 0 replies; 7+ messages in thread
From: Paul E. McKenney @ 2026-09-09 15:14 UTC (permalink / raw)
To: Steven Rostedt
Cc: Vladimir Murzin, Chunfeng Yun, Greg Kroah-Hartman, linux-usb,
linux-arm-kernel, linux-mediatek, linux-kernel
On Wed, Sep 09, 2026 at 09:34:17AM -0400, Steven Rostedt wrote:
> On Tue, 8 Sep 2026 11:08:33 -0700
> "Paul E. McKenney" <paulmck@kernel.org> wrote:
>
> > > > Apparently, the code should instead create another entry in
> > > > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead
> > > > of TP_printk(). But simply removing the offending double indirection
> > > > in TP_printk() gets this splat out of the way of other debugging.
> > >
> > > Indeed, splat has gone after applying the patch.
> > >
> > > Thanks
> > > Vladimir
> >
> > Does this less hacky patch do the trick?
>
> Nope!
>
>
> > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
> > index 89870175d63561..6477ad3ddc66f6 100644
> > --- a/drivers/usb/mtu3/mtu3_trace.h
> > +++ b/drivers/usb/mtu3/mtu3_trace.h
> > @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> > __field(unsigned int, flags)
> > __field(unsigned int, direction)
> > __field(struct mtu3_gpd_ring *, gpd_ring)
> > + __field(dma_addr_t *, gpd_ring_dma)
> > ),
> > TP_fast_assign(
> > __assign_str(name);
> > @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> > __entry->flags = mep->flags;
> > __entry->direction = mep->is_in;
> > __entry->gpd_ring = &mep->gpd_ring;
> > + __entry->gpd_ring_dma = &mep->gpd_ring->dma;
>
> You are still saving the address of some memory into the ring buffer.
>
>
> > ),
> > TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
> ^^^^
>
> That %pad dereferences the pointer passed to it.
>
> > __get_str(name), usb_ep_type_string(__entry->type),
> > __entry->maxp, __entry->slot,
> > __entry->mult, __entry->maxburst,
> > - __entry->gpd_ring, &__entry->gpd_ring->dma,
> > + __entry->gpd_ring, __entry->gpd_ring_dma,
>
> That will read the address saved in the ring buffer and dereference it.
>
> Remember, the above TP_fast_assign() logic gets executed when the
> tracepoint is triggered. The TP_printk() is executed when the user reads
> the trace buffer. That could be seconds, minutes, hours, days, even months
> later!
>
> You can't trust that the memory you are dereferencing will not be freed
> when the user reads the trace.
>
> The original patch is not hacky. It is actually the correct way of handling
> this.
Very well, "git revert" followed by "git cherry-pick" of the original.
Or someone can feel free to pull in the original from earlier in this
thread.
Either way, thank you!
Thanx, Paul
> -- Steve
>
>
> > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
> > __entry->flags & MTU3_EP_STALL ? 'S' : 's',
> > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
>
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-09-09 15:14 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-03 23:59 [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue Paul E. McKenney
2026-09-07 13:28 ` Vladimir Murzin
2026-09-08 18:08 ` Paul E. McKenney
2026-09-09 10:31 ` Vladimir Murzin
2026-09-09 13:35 ` Steven Rostedt
2026-09-09 13:34 ` Steven Rostedt
2026-09-09 15:14 ` Paul E. McKenney
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox