* [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue @ 2026-09-03 23:59 Paul E. McKenney 2026-09-07 13:28 ` Vladimir Murzin 0 siblings, 1 reply; 7+ messages in thread From: Paul E. McKenney @ 2026-09-03 23:59 UTC (permalink / raw) To: Chunfeng Yun, Greg Kroah-Hartman Cc: linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel This is more bug report than patch, but this patch does suppress the splat, so there is that. ;-) Kernels built with either KASAN or KCSAN produce this splat: [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma [ 0.000000] ------------[ cut here ]------------ [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT [ 0.000000] Hardware name: linux,dummy-virt (DT) [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.000000] pc : test_double_dereference+0x144/0x14c [ 0.000000] lr : test_double_dereference+0x144/0x14c [ 0.000000] sp : ffffc80aa7633bf0 [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 [ 0.000000] Call trace: [ 0.000000] test_double_dereference+0x144/0x14c (P) [ 0.000000] trace_event_raw_init+0x37c/0x5d8 [ 0.000000] event_init+0x34/0xc0 [ 0.000000] trace_event_init+0xec/0x588 [ 0.000000] trace_init+0x24/0x6e0 [ 0.000000] start_kernel+0x4a0/0x8ec [ 0.000000] __primary_switched+0x88/0x90 [ 0.000000] irq event stamp: 0 [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 0.000000] ---[ end trace 0000000000000000 ]--- [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma Apparently, the code should instead create another entry in TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead of TP_printk(). But simply removing the offending double indirection in TP_printk() gets this splat out of the way of other debugging. Signed-off-by: Paul E. McKenney <paulmck@kernel.org> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: <linux-usb@vger.kernel.org> Cc: <linux-arm-kernel@lists.infradead.org> Cc: <linux-mediatek@lists.infradead.org> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h index 89870175d63561..7c414e196d5871 100644 --- a/drivers/usb/mtu3/mtu3_trace.h +++ b/drivers/usb/mtu3/mtu3_trace.h @@ -236,11 +236,11 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, __entry->direction = mep->is_in; __entry->gpd_ring = &mep->gpd_ring; ), - TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", + TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p flags %c:%c%c%c:%c", __get_str(name), usb_ep_type_string(__entry->type), __entry->maxp, __entry->slot, __entry->mult, __entry->maxburst, - __entry->gpd_ring, &__entry->gpd_ring->dma, + __entry->gpd_ring, __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', __entry->flags & MTU3_EP_STALL ? 'S' : 's', __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue 2026-09-03 23:59 [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue Paul E. McKenney @ 2026-09-07 13:28 ` Vladimir Murzin 2026-09-08 18:08 ` Paul E. McKenney 0 siblings, 1 reply; 7+ messages in thread From: Vladimir Murzin @ 2026-09-07 13:28 UTC (permalink / raw) To: paulmck, Chunfeng Yun, Greg Kroah-Hartman, rostedt Cc: linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel On 9/4/26 00:59, Paul E. McKenney wrote: > This is more bug report than patch, but this patch does suppress the > splat, so there is that. ;-) > > Kernels built with either KASAN or KCSAN produce this splat: > I see it on kernel w/o KASAN or KCSAN. IIUC, this is new check introduced by b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()") so adding Steven :) > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] ------------[ cut here ]------------ > [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 > [ 0.000000] Modules linked in: > [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT > [ 0.000000] Hardware name: linux,dummy-virt (DT) > [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > [ 0.000000] pc : test_double_dereference+0x144/0x14c > [ 0.000000] lr : test_double_dereference+0x144/0x14c > [ 0.000000] sp : ffffc80aa7633bf0 > [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f > [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 > [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 > [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 > [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 > [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 > [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 > [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 > [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 > [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 > [ 0.000000] Call trace: > [ 0.000000] test_double_dereference+0x144/0x14c (P) > [ 0.000000] trace_event_raw_init+0x37c/0x5d8 > [ 0.000000] event_init+0x34/0xc0 > [ 0.000000] trace_event_init+0xec/0x588 > [ 0.000000] trace_init+0x24/0x6e0 > [ 0.000000] start_kernel+0x4a0/0x8ec > [ 0.000000] __primary_switched+0x88/0x90 > [ 0.000000] irq event stamp: 0 > [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] ---[ end trace 0000000000000000 ]--- > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma > > Apparently, the code should instead create another entry in > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead > of TP_printk(). But simply removing the offending double indirection > in TP_printk() gets this splat out of the way of other debugging. > Indeed, splat has gone after applying the patch. Thanks Vladimir > Signed-off-by: Paul E. McKenney <paulmck@kernel.org> > Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > Cc: <linux-usb@vger.kernel.org> > Cc: <linux-arm-kernel@lists.infradead.org> > Cc: <linux-mediatek@lists.infradead.org> > > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > index 89870175d63561..7c414e196d5871 100644 > --- a/drivers/usb/mtu3/mtu3_trace.h > +++ b/drivers/usb/mtu3/mtu3_trace.h > @@ -236,11 +236,11 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __entry->direction = mep->is_in; > __entry->gpd_ring = &mep->gpd_ring; > ), > - TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", > + TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p flags %c:%c%c%c:%c", > __get_str(name), usb_ep_type_string(__entry->type), > __entry->maxp, __entry->slot, > __entry->mult, __entry->maxburst, > - __entry->gpd_ring, &__entry->gpd_ring->dma, > + __entry->gpd_ring, > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > __entry->flags & MTU3_EP_STALL ? 'S' : 's', > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue 2026-09-07 13:28 ` Vladimir Murzin @ 2026-09-08 18:08 ` Paul E. McKenney 2026-09-09 10:31 ` Vladimir Murzin 2026-09-09 13:34 ` Steven Rostedt 0 siblings, 2 replies; 7+ messages in thread From: Paul E. McKenney @ 2026-09-08 18:08 UTC (permalink / raw) To: Vladimir Murzin Cc: Chunfeng Yun, Greg Kroah-Hartman, rostedt, linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel On Mon, Sep 07, 2026 at 02:28:47PM +0100, Vladimir Murzin wrote: > On 9/4/26 00:59, Paul E. McKenney wrote: > > This is more bug report than patch, but this patch does suppress the > > splat, so there is that. ;-) > > > > Kernels built with either KASAN or KCSAN produce this splat: > > > > I see it on kernel w/o KASAN or KCSAN. IIUC, this is new check introduced > by b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()") > so adding Steven :) > > > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > > [ 0.000000] ------------[ cut here ]------------ > > [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > > [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 > > [ 0.000000] Modules linked in: > > [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT > > [ 0.000000] Hardware name: linux,dummy-virt (DT) > > [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > > [ 0.000000] pc : test_double_dereference+0x144/0x14c > > [ 0.000000] lr : test_double_dereference+0x144/0x14c > > [ 0.000000] sp : ffffc80aa7633bf0 > > [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f > > [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 > > [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 > > [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 > > [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 > > [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 > > [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 > > [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 > > [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 > > [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 > > [ 0.000000] Call trace: > > [ 0.000000] test_double_dereference+0x144/0x14c (P) > > [ 0.000000] trace_event_raw_init+0x37c/0x5d8 > > [ 0.000000] event_init+0x34/0xc0 > > [ 0.000000] trace_event_init+0xec/0x588 > > [ 0.000000] trace_init+0x24/0x6e0 > > [ 0.000000] start_kernel+0x4a0/0x8ec > > [ 0.000000] __primary_switched+0x88/0x90 > > [ 0.000000] irq event stamp: 0 > > [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 > > [ 0.000000] ---[ end trace 0000000000000000 ]--- > > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma > > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma > > > > Apparently, the code should instead create another entry in > > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead > > of TP_printk(). But simply removing the offending double indirection > > in TP_printk() gets this splat out of the way of other debugging. > > Indeed, splat has gone after applying the patch. > > Thanks > Vladimir Does this less hacky patch do the trick? Thanx, Paul ------------------------------------------------------------------------ commit afda2321e6e93a5bcc28bfb4717fbc3a1768446c Author: Paul E. McKenney <paulmck@kernel.org> Date: Thu Sep 3 16:48:09 2026 -0700 EXP drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue Kernels built with either KASAN or KCSAN produce this splat: [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma [ 0.000000] ------------[ cut here ]------------ [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT [ 0.000000] Hardware name: linux,dummy-virt (DT) [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.000000] pc : test_double_dereference+0x144/0x14c [ 0.000000] lr : test_double_dereference+0x144/0x14c [ 0.000000] sp : ffffc80aa7633bf0 [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 [ 0.000000] Call trace: [ 0.000000] test_double_dereference+0x144/0x14c (P) [ 0.000000] trace_event_raw_init+0x37c/0x5d8 [ 0.000000] event_init+0x34/0xc0 [ 0.000000] trace_event_init+0xec/0x588 [ 0.000000] trace_init+0x24/0x6e0 [ 0.000000] start_kernel+0x4a0/0x8ec [ 0.000000] __primary_switched+0x88/0x90 [ 0.000000] irq event stamp: 0 [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 [ 0.000000] ---[ end trace 0000000000000000 ]--- [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma Therefore, work around this restriction by creating another entry in TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead of TP_printk(). Signed-off-by: Paul E. McKenney <paulmck@kernel.org> Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: <linux-usb@vger.kernel.org> Cc: <linux-arm-kernel@lists.infradead.org> Cc: <linux-mediatek@lists.infradead.org> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h index 89870175d63561..6477ad3ddc66f6 100644 --- a/drivers/usb/mtu3/mtu3_trace.h +++ b/drivers/usb/mtu3/mtu3_trace.h @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, __field(unsigned int, flags) __field(unsigned int, direction) __field(struct mtu3_gpd_ring *, gpd_ring) + __field(dma_addr_t *, gpd_ring_dma) ), TP_fast_assign( __assign_str(name); @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, __entry->flags = mep->flags; __entry->direction = mep->is_in; __entry->gpd_ring = &mep->gpd_ring; + __entry->gpd_ring_dma = &mep->gpd_ring->dma; ), TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", __get_str(name), usb_ep_type_string(__entry->type), __entry->maxp, __entry->slot, __entry->mult, __entry->maxburst, - __entry->gpd_ring, &__entry->gpd_ring->dma, + __entry->gpd_ring, __entry->gpd_ring_dma, __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', __entry->flags & MTU3_EP_STALL ? 'S' : 's', __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue 2026-09-08 18:08 ` Paul E. McKenney @ 2026-09-09 10:31 ` Vladimir Murzin 2026-09-09 13:35 ` Steven Rostedt 2026-09-09 13:34 ` Steven Rostedt 1 sibling, 1 reply; 7+ messages in thread From: Vladimir Murzin @ 2026-09-09 10:31 UTC (permalink / raw) To: paulmck Cc: Chunfeng Yun, Greg Kroah-Hartman, rostedt, linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel On 9/8/26 19:08, Paul E. McKenney wrote: > On Mon, Sep 07, 2026 at 02:28:47PM +0100, Vladimir Murzin wrote: >> On 9/4/26 00:59, Paul E. McKenney wrote: >>> This is more bug report than patch, but this patch does suppress the >>> splat, so there is that. ;-) >>> >>> Kernels built with either KASAN or KCSAN produce this splat: >>> >> I see it on kernel w/o KASAN or KCSAN. IIUC, this is new check introduced >> by b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()") >> so adding Steven :) >> >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma >>> [ 0.000000] ------------[ cut here ]------------ >>> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma >>> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 >>> [ 0.000000] Modules linked in: >>> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT >>> [ 0.000000] Hardware name: linux,dummy-virt (DT) >>> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) >>> [ 0.000000] pc : test_double_dereference+0x144/0x14c >>> [ 0.000000] lr : test_double_dereference+0x144/0x14c >>> [ 0.000000] sp : ffffc80aa7633bf0 >>> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f >>> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 >>> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 >>> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 >>> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 >>> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 >>> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 >>> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 >>> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 >>> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 >>> [ 0.000000] Call trace: >>> [ 0.000000] test_double_dereference+0x144/0x14c (P) >>> [ 0.000000] trace_event_raw_init+0x37c/0x5d8 >>> [ 0.000000] event_init+0x34/0xc0 >>> [ 0.000000] trace_event_init+0xec/0x588 >>> [ 0.000000] trace_init+0x24/0x6e0 >>> [ 0.000000] start_kernel+0x4a0/0x8ec >>> [ 0.000000] __primary_switched+0x88/0x90 >>> [ 0.000000] irq event stamp: 0 >>> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 >>> [ 0.000000] ---[ end trace 0000000000000000 ]--- >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma >>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma >>> >>> Apparently, the code should instead create another entry in >>> TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead >>> of TP_printk(). But simply removing the offending double indirection >>> in TP_printk() gets this splat out of the way of other debugging. >> Indeed, splat has gone after applying the patch. >> >> Thanks >> Vladimir > Does this less hacky patch do the trick? > Not quite :( > Thanx, Paul > > ------------------------------------------------------------------------ > > commit afda2321e6e93a5bcc28bfb4717fbc3a1768446c > Author: Paul E. McKenney <paulmck@kernel.org> > Date: Thu Sep 3 16:48:09 2026 -0700 > > EXP drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue What is EXP? > > Kernels built with either KASAN or KCSAN produce this splat: > Like I said in my other reply I hit the splat with neither KASAN or KCSAN are enabled. > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] ------------[ cut here ]------------ > [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0 > [ 0.000000] Modules linked in: > [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT > [ 0.000000] Hardware name: linux,dummy-virt (DT) > [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) > [ 0.000000] pc : test_double_dereference+0x144/0x14c > [ 0.000000] lr : test_double_dereference+0x144/0x14c > [ 0.000000] sp : ffffc80aa7633bf0 > [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f > [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8 > [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8 > [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001 > [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573 > [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045 > [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000 > [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001 > [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000 > [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700 > [ 0.000000] Call trace: > [ 0.000000] test_double_dereference+0x144/0x14c (P) > [ 0.000000] trace_event_raw_init+0x37c/0x5d8 > [ 0.000000] event_init+0x34/0xc0 > [ 0.000000] trace_event_init+0xec/0x588 > [ 0.000000] trace_init+0x24/0x6e0 > [ 0.000000] start_kernel+0x4a0/0x8ec > [ 0.000000] __primary_switched+0x88/0x90 > [ 0.000000] irq event stamp: 0 > [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0 > [ 0.000000] ---[ end trace 0000000000000000 ]--- > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma > [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma > > Therefore, work around this restriction by creating another entry in > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() > instead of TP_printk(). > > Signed-off-by: Paul E. McKenney <paulmck@kernel.org> > Cc: Chunfeng Yun <chunfeng.yun@mediatek.com> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > Cc: <linux-usb@vger.kernel.org> > Cc: <linux-arm-kernel@lists.infradead.org> > Cc: <linux-mediatek@lists.infradead.org> > > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > index 89870175d63561..6477ad3ddc66f6 100644 > --- a/drivers/usb/mtu3/mtu3_trace.h > +++ b/drivers/usb/mtu3/mtu3_trace.h > @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __field(unsigned int, flags) > __field(unsigned int, direction) > __field(struct mtu3_gpd_ring *, gpd_ring) > + __field(dma_addr_t *, gpd_ring_dma) > ), > TP_fast_assign( > __assign_str(name); > @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __entry->flags = mep->flags; > __entry->direction = mep->is_in; > __entry->gpd_ring = &mep->gpd_ring; > + __entry->gpd_ring_dma = &mep->gpd_ring->dma; This doesn't build for me ./drivers/usb/mtu3/./mtu3_trace.h:239:55: error: invalid type argument of ‘->’ (have ‘struct mtu3_gpd_ring’) 239 | __entry->gpd_ring_dma = &mep->gpd_ring->dma; | ^~ > ), > TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", > __get_str(name), usb_ep_type_string(__entry->type), > __entry->maxp, __entry->slot, > __entry->mult, __entry->maxburst, > - __entry->gpd_ring, &__entry->gpd_ring->dma, > + __entry->gpd_ring, __entry->gpd_ring_dma, > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > __entry->flags & MTU3_EP_STALL ? 'S' : 's', > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', > I've done a little bit massaging and here is what worked for me diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h index 89870175d635..4d4bae25fa1f 100644 --- a/drivers/usb/mtu3/mtu3_trace.h +++ b/drivers/usb/mtu3/mtu3_trace.h @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, __field(unsigned int, flags) __field(unsigned int, direction) __field(struct mtu3_gpd_ring *, gpd_ring) + __field(dma_addr_t, gpd_ring_dma) ), TP_fast_assign( __assign_str(name); @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, __entry->flags = mep->flags; __entry->direction = mep->is_in; __entry->gpd_ring = &mep->gpd_ring; + __entry->gpd_ring_dma = mep->gpd_ring.dma; ), TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", __get_str(name), usb_ep_type_string(__entry->type), __entry->maxp, __entry->slot, __entry->mult, __entry->maxburst, - __entry->gpd_ring, &__entry->gpd_ring->dma, + __entry->gpd_ring, &__entry->gpd_ring_dma, __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', __entry->flags & MTU3_EP_STALL ? 'S' : 's', __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', Cheers Vladimir ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue 2026-09-09 10:31 ` Vladimir Murzin @ 2026-09-09 13:35 ` Steven Rostedt 0 siblings, 0 replies; 7+ messages in thread From: Steven Rostedt @ 2026-09-09 13:35 UTC (permalink / raw) To: Vladimir Murzin Cc: paulmck, Chunfeng Yun, Greg Kroah-Hartman, linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel On Wed, 9 Sep 2026 11:31:28 +0100 Vladimir Murzin <vladimir.murzin@arm.com> wrote: > I've done a little bit massaging and here is what worked for me > > > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > index 89870175d635..4d4bae25fa1f 100644 > --- a/drivers/usb/mtu3/mtu3_trace.h > +++ b/drivers/usb/mtu3/mtu3_trace.h > @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __field(unsigned int, flags) > __field(unsigned int, direction) > __field(struct mtu3_gpd_ring *, gpd_ring) > + __field(dma_addr_t, gpd_ring_dma) > ), > TP_fast_assign( > __assign_str(name); > @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __entry->flags = mep->flags; > __entry->direction = mep->is_in; > __entry->gpd_ring = &mep->gpd_ring; > + __entry->gpd_ring_dma = mep->gpd_ring.dma; > ), > TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", > __get_str(name), usb_ep_type_string(__entry->type), > __entry->maxp, __entry->slot, > __entry->mult, __entry->maxburst, > - __entry->gpd_ring, &__entry->gpd_ring->dma, > + __entry->gpd_ring, &__entry->gpd_ring_dma, > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > __entry->flags & MTU3_EP_STALL ? 'S' : 's', > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', LGTM, Reviewed-by: Steven Rostedt <rostedt@goodmis.org> -- Steve ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue 2026-09-08 18:08 ` Paul E. McKenney 2026-09-09 10:31 ` Vladimir Murzin @ 2026-09-09 13:34 ` Steven Rostedt 2026-09-09 15:14 ` Paul E. McKenney 1 sibling, 1 reply; 7+ messages in thread From: Steven Rostedt @ 2026-09-09 13:34 UTC (permalink / raw) To: Paul E. McKenney Cc: Vladimir Murzin, Chunfeng Yun, Greg Kroah-Hartman, linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel On Tue, 8 Sep 2026 11:08:33 -0700 "Paul E. McKenney" <paulmck@kernel.org> wrote: > > > Apparently, the code should instead create another entry in > > > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead > > > of TP_printk(). But simply removing the offending double indirection > > > in TP_printk() gets this splat out of the way of other debugging. > > > > Indeed, splat has gone after applying the patch. > > > > Thanks > > Vladimir > > Does this less hacky patch do the trick? Nope! > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > index 89870175d63561..6477ad3ddc66f6 100644 > --- a/drivers/usb/mtu3/mtu3_trace.h > +++ b/drivers/usb/mtu3/mtu3_trace.h > @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __field(unsigned int, flags) > __field(unsigned int, direction) > __field(struct mtu3_gpd_ring *, gpd_ring) > + __field(dma_addr_t *, gpd_ring_dma) > ), > TP_fast_assign( > __assign_str(name); > @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > __entry->flags = mep->flags; > __entry->direction = mep->is_in; > __entry->gpd_ring = &mep->gpd_ring; > + __entry->gpd_ring_dma = &mep->gpd_ring->dma; You are still saving the address of some memory into the ring buffer. > ), > TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", ^^^^ That %pad dereferences the pointer passed to it. > __get_str(name), usb_ep_type_string(__entry->type), > __entry->maxp, __entry->slot, > __entry->mult, __entry->maxburst, > - __entry->gpd_ring, &__entry->gpd_ring->dma, > + __entry->gpd_ring, __entry->gpd_ring_dma, That will read the address saved in the ring buffer and dereference it. Remember, the above TP_fast_assign() logic gets executed when the tracepoint is triggered. The TP_printk() is executed when the user reads the trace buffer. That could be seconds, minutes, hours, days, even months later! You can't trust that the memory you are dereferencing will not be freed when the user reads the trace. The original patch is not hacky. It is actually the correct way of handling this. -- Steve > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > __entry->flags & MTU3_EP_STALL ? 'S' : 's', > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue 2026-09-09 13:34 ` Steven Rostedt @ 2026-09-09 15:14 ` Paul E. McKenney 0 siblings, 0 replies; 7+ messages in thread From: Paul E. McKenney @ 2026-09-09 15:14 UTC (permalink / raw) To: Steven Rostedt Cc: Vladimir Murzin, Chunfeng Yun, Greg Kroah-Hartman, linux-usb, linux-arm-kernel, linux-mediatek, linux-kernel On Wed, Sep 09, 2026 at 09:34:17AM -0400, Steven Rostedt wrote: > On Tue, 8 Sep 2026 11:08:33 -0700 > "Paul E. McKenney" <paulmck@kernel.org> wrote: > > > > > Apparently, the code should instead create another entry in > > > > TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead > > > > of TP_printk(). But simply removing the offending double indirection > > > > in TP_printk() gets this splat out of the way of other debugging. > > > > > > Indeed, splat has gone after applying the patch. > > > > > > Thanks > > > Vladimir > > > > Does this less hacky patch do the trick? > > Nope! > > > > diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h > > index 89870175d63561..6477ad3ddc66f6 100644 > > --- a/drivers/usb/mtu3/mtu3_trace.h > > +++ b/drivers/usb/mtu3/mtu3_trace.h > > @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > > __field(unsigned int, flags) > > __field(unsigned int, direction) > > __field(struct mtu3_gpd_ring *, gpd_ring) > > + __field(dma_addr_t *, gpd_ring_dma) > > ), > > TP_fast_assign( > > __assign_str(name); > > @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep, > > __entry->flags = mep->flags; > > __entry->direction = mep->is_in; > > __entry->gpd_ring = &mep->gpd_ring; > > + __entry->gpd_ring_dma = &mep->gpd_ring->dma; > > You are still saving the address of some memory into the ring buffer. > > > > ), > > TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c", > ^^^^ > > That %pad dereferences the pointer passed to it. > > > __get_str(name), usb_ep_type_string(__entry->type), > > __entry->maxp, __entry->slot, > > __entry->mult, __entry->maxburst, > > - __entry->gpd_ring, &__entry->gpd_ring->dma, > > + __entry->gpd_ring, __entry->gpd_ring_dma, > > That will read the address saved in the ring buffer and dereference it. > > Remember, the above TP_fast_assign() logic gets executed when the > tracepoint is triggered. The TP_printk() is executed when the user reads > the trace buffer. That could be seconds, minutes, hours, days, even months > later! > > You can't trust that the memory you are dereferencing will not be freed > when the user reads the trace. > > The original patch is not hacky. It is actually the correct way of handling > this. Very well, "git revert" followed by "git cherry-pick" of the original. Or someone can feel free to pull in the original from earlier in this thread. Either way, thank you! Thanx, Paul > -- Steve > > > > __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e', > > __entry->flags & MTU3_EP_STALL ? 'S' : 's', > > __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w', > ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-09-09 15:14 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-09-03 23:59 [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue Paul E. McKenney 2026-09-07 13:28 ` Vladimir Murzin 2026-09-08 18:08 ` Paul E. McKenney 2026-09-09 10:31 ` Vladimir Murzin 2026-09-09 13:35 ` Steven Rostedt 2026-09-09 13:34 ` Steven Rostedt 2026-09-09 15:14 ` Paul E. McKenney
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox