2.6.22+: BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524,in_atomic():1, irqs_disabled():0

2.6.22+: BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524,in_atomic():1, irqs_disabled():0

[Jeremy Fitzhardinge]

I get this when suspending.  The kernel is 2.6.22+recent git (just before -rc1).

usb 2-1: USB disconnect, address 3
BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524
in_atomic():1, irqs_disabled():0
1 lock held by khubd/207:
 #0:  (&table_lock){--..}, at: [<f89fba38>] usb_serial_put+0x13/0x2c [usbserial]
 [<c0109162>] show_trace_log_lvl+0x1a/0x2f
 [<c0109bf8>] show_trace+0x12/0x14
 [<c0109c10>] dump_stack+0x16/0x18
 [<c01247b7>] __might_sleep+0xea/0xf1
 [<c02cd7a2>] usb_kill_urb+0x1a/0xc7
 [<f89e7203>] sierra_shutdown+0x5d/0x9c [sierra]
 [<f89fbb5a>] destroy_serial+0x45/0x10a [usbserial]
 [<c0219a2f>] kref_put+0x63/0x71
 [<f89fba44>] usb_serial_put+0x1f/0x2c [usbserial]
 [<f89fbf00>] usb_serial_disconnect+0x79/0xa6 [usbserial]
 [<c02d06df>] usb_unbind_interface+0x47/0x98
 [<c02925f2>] __device_release_driver+0x74/0x90
 [<c02929e0>] device_release_driver+0x30/0x47
 [<c0291f81>] bus_remove_device+0x73/0x82
 [<c0290650>] device_del+0x208/0x27e
 [<c02cdf2a>] usb_disable_device+0x5f/0xbc
 [<c02ca497>] usb_disconnect+0x95/0x12f
 [<c02caba8>] hub_thread+0x377/0xa57
 [<c013cb7f>] kthread+0x3b/0x64
 [<c0108d27>] kernel_thread_helper+0x7/0x10
 =======================
sierra3 ttyUSB0: Sierra USB modem (3 port) converter now disconnected from ttyUSB0
sierra3 ttyUSB1: Sierra USB modem (3 port) converter now disconnected from ttyUSB1
sierra3 ttyUSB2: Sierra USB modem (3 port) converter now disconnected from ttyUSB2
sierra 2-1:1.0: device disconnected

	J

Re: [linux-usb-devel] 2.6.22+: BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0

[Alan Stern]

On Mon, 23 Jul 2007, Jeremy Fitzhardinge wrote:

> I get this when suspending.  The kernel is 2.6.22+recent git (just before -rc1).
> 
> usb 2-1: USB disconnect, address 3
> BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524
> in_atomic():1, irqs_disabled():0
> 1 lock held by khubd/207:
>  #0:  (&table_lock){--..}, at: [<f89fba38>] usb_serial_put+0x13/0x2c [usbserial]
>  [<c0109162>] show_trace_log_lvl+0x1a/0x2f
>  [<c0109bf8>] show_trace+0x12/0x14
>  [<c0109c10>] dump_stack+0x16/0x18
>  [<c01247b7>] __might_sleep+0xea/0xf1
>  [<c02cd7a2>] usb_kill_urb+0x1a/0xc7
>  [<f89e7203>] sierra_shutdown+0x5d/0x9c [sierra]
>  [<f89fbb5a>] destroy_serial+0x45/0x10a [usbserial]
>  [<c0219a2f>] kref_put+0x63/0x71
>  [<f89fba44>] usb_serial_put+0x1f/0x2c [usbserial]
>  [<f89fbf00>] usb_serial_disconnect+0x79/0xa6 [usbserial]
>  [<c02d06df>] usb_unbind_interface+0x47/0x98
>  [<c02925f2>] __device_release_driver+0x74/0x90
>  [<c02929e0>] device_release_driver+0x30/0x47
>  [<c0291f81>] bus_remove_device+0x73/0x82
>  [<c0290650>] device_del+0x208/0x27e
>  [<c02cdf2a>] usb_disable_device+0x5f/0xbc
>  [<c02ca497>] usb_disconnect+0x95/0x12f
>  [<c02caba8>] hub_thread+0x377/0xa57
>  [<c013cb7f>] kthread+0x3b/0x64
>  [<c0108d27>] kernel_thread_helper+0x7/0x10
>  =======================
> sierra3 ttyUSB0: Sierra USB modem (3 port) converter now disconnected from ttyUSB0
> sierra3 ttyUSB1: Sierra USB modem (3 port) converter now disconnected from ttyUSB1
> sierra3 ttyUSB2: Sierra USB modem (3 port) converter now disconnected from ttyUSB2
> sierra 2-1:1.0: device disconnected

Clearly there's a bug in 
drivers/usb/serial/usb-serial.c:usb_serial_put().  It shouldn't call 
kref_put() while holding a spinlock.

Alan Stern

Re: [linux-usb-devel] 2.6.22+: BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0

[Greg KH]

On Mon, Jul 23, 2007 at 04:50:50PM -0400, Alan Stern wrote:
> On Mon, 23 Jul 2007, Jeremy Fitzhardinge wrote:
> 
> > I get this when suspending.  The kernel is 2.6.22+recent git (just before -rc1).
> > 
> > usb 2-1: USB disconnect, address 3
> > BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524
> > in_atomic():1, irqs_disabled():0
> > 1 lock held by khubd/207:
> >  #0:  (&table_lock){--..}, at: [<f89fba38>] usb_serial_put+0x13/0x2c [usbserial]
> >  [<c0109162>] show_trace_log_lvl+0x1a/0x2f
> >  [<c0109bf8>] show_trace+0x12/0x14
> >  [<c0109c10>] dump_stack+0x16/0x18
> >  [<c01247b7>] __might_sleep+0xea/0xf1
> >  [<c02cd7a2>] usb_kill_urb+0x1a/0xc7
> >  [<f89e7203>] sierra_shutdown+0x5d/0x9c [sierra]
> >  [<f89fbb5a>] destroy_serial+0x45/0x10a [usbserial]
> >  [<c0219a2f>] kref_put+0x63/0x71
> >  [<f89fba44>] usb_serial_put+0x1f/0x2c [usbserial]
> >  [<f89fbf00>] usb_serial_disconnect+0x79/0xa6 [usbserial]
> >  [<c02d06df>] usb_unbind_interface+0x47/0x98
> >  [<c02925f2>] __device_release_driver+0x74/0x90
> >  [<c02929e0>] device_release_driver+0x30/0x47
> >  [<c0291f81>] bus_remove_device+0x73/0x82
> >  [<c0290650>] device_del+0x208/0x27e
> >  [<c02cdf2a>] usb_disable_device+0x5f/0xbc
> >  [<c02ca497>] usb_disconnect+0x95/0x12f
> >  [<c02caba8>] hub_thread+0x377/0xa57
> >  [<c013cb7f>] kthread+0x3b/0x64
> >  [<c0108d27>] kernel_thread_helper+0x7/0x10
> >  =======================
> > sierra3 ttyUSB0: Sierra USB modem (3 port) converter now disconnected from ttyUSB0
> > sierra3 ttyUSB1: Sierra USB modem (3 port) converter now disconnected from ttyUSB1
> > sierra3 ttyUSB2: Sierra USB modem (3 port) converter now disconnected from ttyUSB2
> > sierra 2-1:1.0: device disconnected
> 
> Clearly there's a bug in 
> drivers/usb/serial/usb-serial.c:usb_serial_put().  It shouldn't call 
> kref_put() while holding a spinlock.

Oliver, didn't you make this change to the usb_serial_put() function?

Do we need to audit the shutdown() callbacks in the serial drivers so
that they can not sleep?  Or just change the spinlock to a mutex?

thanks,

greg k-h

Re: [linux-usb-devel] 2.6.22+: BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0

[Oliver Neukum]

> Clearly there's a bug in 
> drivers/usb/serial/usb-serial.c:usb_serial_put().  It shouldn't call 
> kref_put() while holding a spinlock.

Yes, these functions need to sleep.
Does this work?

	Regards
		Oliver
---

--- a/drivers/usb/serial/usb-serial.c	2007-07-23 08:47:35.000000000 +0200
+++ b/drivers/usb/serial/usb-serial.c	2007-07-24 09:33:15.000000000 +0200
@@ -60,19 +60,19 @@ static struct usb_driver usb_serial_driv
 
 static int debug;
 static struct usb_serial *serial_table[SERIAL_TTY_MINORS];	/* initially all NULL */
-static spinlock_t table_lock;
+DEFINE_MUTEX(table_lock);
 static LIST_HEAD(usb_serial_driver_list);
 
 struct usb_serial *usb_serial_get_by_index(unsigned index)
 {
 	struct usb_serial *serial;
 
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	serial = serial_table[index];
 
 	if (serial)
 		kref_get(&serial->kref);
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 	return serial;
 }
 
@@ -84,7 +84,7 @@ static struct usb_serial *get_free_seria
 	dbg("%s %d", __FUNCTION__, num_ports);
 
 	*minor = 0;
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
 		if (serial_table[i])
 			continue;
@@ -106,10 +106,10 @@ static struct usb_serial *get_free_seria
 			serial_table[i] = serial;
 			serial->port[j++]->number = i;
 		}
-		spin_unlock(&table_lock);
+		mutex_unlock(&table_lock);
 		return serial;
 	}
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 	return NULL;
 }
 
@@ -172,9 +172,9 @@ static void destroy_serial(struct kref *
 
 void usb_serial_put(struct usb_serial *serial)
 {
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	kref_put(&serial->kref, destroy_serial);
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 }
 
 /*****************************************************************************
@@ -1128,7 +1128,6 @@ static int __init usb_serial_init(void)
 		return -ENOMEM;
 
 	/* Initialize our global data */
-	spin_lock_init(&table_lock);
 	for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
 		serial_table[i] = NULL;
 	}

Re: [linux-usb-devel] 2.6.22+: BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0

[Oliver Neukum]

> Clearly there's a bug in 
> drivers/usb/serial/usb-serial.c:usb_serial_put().  It shouldn't call 
> kref_put() while holding a spinlock.

As I was reminded, I polluted the namespace. Here's a better
version. Does it fix your problem?

	Regards
		Oliver
Signed-off-by: Oliver Neukum <oneukum@suse.de>
---

--- a/drivers/usb/serial/usb-serial.c	2007-07-23 08:47:35.000000000 +0200
+++ b/drivers/usb/serial/usb-serial.c	2007-07-24 15:07:05.000000000 +0200
@@ -60,19 +60,19 @@ static struct usb_driver usb_serial_driv
 
 static int debug;
 static struct usb_serial *serial_table[SERIAL_TTY_MINORS];	/* initially all NULL */
-static spinlock_t table_lock;
+static DEFINE_MUTEX(table_lock);
 static LIST_HEAD(usb_serial_driver_list);
 
 struct usb_serial *usb_serial_get_by_index(unsigned index)
 {
 	struct usb_serial *serial;
 
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	serial = serial_table[index];
 
 	if (serial)
 		kref_get(&serial->kref);
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 	return serial;
 }
 
@@ -84,7 +84,7 @@ static struct usb_serial *get_free_seria
 	dbg("%s %d", __FUNCTION__, num_ports);
 
 	*minor = 0;
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
 		if (serial_table[i])
 			continue;
@@ -106,10 +106,10 @@ static struct usb_serial *get_free_seria
 			serial_table[i] = serial;
 			serial->port[j++]->number = i;
 		}
-		spin_unlock(&table_lock);
+		mutex_unlock(&table_lock);
 		return serial;
 	}
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 	return NULL;
 }
 
@@ -172,9 +172,9 @@ static void destroy_serial(struct kref *
 
 void usb_serial_put(struct usb_serial *serial)
 {
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	kref_put(&serial->kref, destroy_serial);
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 }
 
 /*****************************************************************************
@@ -1128,7 +1128,6 @@ static int __init usb_serial_init(void)
 		return -ENOMEM;
 
 	/* Initialize our global data */
-	spin_lock_init(&table_lock);
 	for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
 		serial_table[i] = NULL;
 	}

patch usb-fix-bug-sleeping-function-called-from-invalid-context-at-home-jeremy-hg-xen-paravirt-linux-drivers-usb-core-urb.c-524-in_atomic-1-irqs_disabled-0.patch added to gregkh-2.6 tree

[gregkh]

This is a note to let you know that I've just added the patch titled

     Subject: USB: fix BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0

to my gregkh-2.6 tree.  Its filename is

     usb-fix-bug-sleeping-function-called-from-invalid-context-at-home-jeremy-hg-xen-paravirt-linux-drivers-usb-core-urb.c-524-in_atomic-1-irqs_disabled-0.patch

This tree can be found at 
    http://www.kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/patches/


>From oliver@neukum.org Tue Jul 24 06:11:50 2007
From: Oliver Neukum <oliver@neukum.org>
Date: Tue, 24 Jul 2007 15:13:42 +0200
Subject: USB: fix BUG: sleeping function called from invalid context at /home/jeremy/hg/xen/paravirt/linux/drivers/usb/core/urb.c:524, in_atomic():1, irqs_disabled():0
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>, Kevin Lloyd <linux@sierrawireless.com>, Greg KH <gregkh@suse.de>, Linux Kernel Mailing List <linux-kernel@vger.kernel.org>, USB development list <linux-usb-devel@lists.sourceforge.net>
Message-ID: <200707241513.42892.oliver@neukum.org>
Content-Disposition: inline



Clearly there's a bug in
drivers/usb/serial/usb-serial.c:usb_serial_put().  It shouldn't call
kref_put() while holding a spinlock.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/usb/serial/usb-serial.c |   17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -60,19 +60,19 @@ static struct usb_driver usb_serial_driv
 
 static int debug;
 static struct usb_serial *serial_table[SERIAL_TTY_MINORS];	/* initially all NULL */
-static spinlock_t table_lock;
+static DEFINE_MUTEX(table_lock);
 static LIST_HEAD(usb_serial_driver_list);
 
 struct usb_serial *usb_serial_get_by_index(unsigned index)
 {
 	struct usb_serial *serial;
 
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	serial = serial_table[index];
 
 	if (serial)
 		kref_get(&serial->kref);
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 	return serial;
 }
 
@@ -84,7 +84,7 @@ static struct usb_serial *get_free_seria
 	dbg("%s %d", __FUNCTION__, num_ports);
 
 	*minor = 0;
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
 		if (serial_table[i])
 			continue;
@@ -106,10 +106,10 @@ static struct usb_serial *get_free_seria
 			serial_table[i] = serial;
 			serial->port[j++]->number = i;
 		}
-		spin_unlock(&table_lock);
+		mutex_unlock(&table_lock);
 		return serial;
 	}
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 	return NULL;
 }
 
@@ -172,9 +172,9 @@ static void destroy_serial(struct kref *
 
 void usb_serial_put(struct usb_serial *serial)
 {
-	spin_lock(&table_lock);
+	mutex_lock(&table_lock);
 	kref_put(&serial->kref, destroy_serial);
-	spin_unlock(&table_lock);
+	mutex_unlock(&table_lock);
 }
 
 /*****************************************************************************
@@ -1129,7 +1129,6 @@ static int __init usb_serial_init(void)
 		return -ENOMEM;
 
 	/* Initialize our global data */
-	spin_lock_init(&table_lock);
 	for (i = 0; i < SERIAL_TTY_MINORS; ++i) {
 		serial_table[i] = NULL;
 	}


Patches currently in gregkh-2.6 which might be from oliver@neukum.org are

usb/usb-fix-bug-sleeping-function-called-from-invalid-context-at-home-jeremy-hg-xen-paravirt-linux-drivers-usb-core-urb.c-524-in_atomic-1-irqs_disabled-0.patch
usb/usb-nikon-d50-is-an-unusual-device.patch
usb/usb-yet-another-quirky-device.patch
usb/usb-more-quirky-devices.patch