From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Tony Lindgren <tony@atomide.com>,
Bin Liu <b-liu@ti.com>
Subject: [PATCH 4.9 16/16] usb: musb: fix possible spinlock deadlock
Date: Thu, 30 Mar 2017 12:16:07 +0200 [thread overview]
Message-ID: <20170330100432.195149121@linuxfoundation.org> (raw)
In-Reply-To: <20170330100431.550322562@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bin Liu <b-liu@ti.com>
commit bc1e2154542071e3cfe1734b143af9b8bdacf8bd upstream.
The DSPS glue calls del_timer_sync() in its musb_platform_disable()
implementation, which requires the caller to not hold a lock. But
musb_remove() calls musb_platform_disable() will musb->lock held. This
could causes spinlock deadlock.
So change musb_remove() to call musb_platform_disable() without holds
musb->lock. This doesn't impact the musb_platform_disable implementation
in other glue drivers.
root@am335x-evm:~# modprobe -r musb-dsps
[ 126.134879] musb-hdrc musb-hdrc.1: remove, state 1
[ 126.140465] usb usb2: USB disconnect, device number 1
[ 126.146178] usb 2-1: USB disconnect, device number 2
[ 126.416985] musb-hdrc musb-hdrc.1: USB bus 2 deregistered
[ 126.423943]
[ 126.425525] ======================================================
[ 126.431997] [ INFO: possible circular locking dependency detected ]
[ 126.438564] 4.11.0-rc1-00003-g1557f13bca04-dirty #77 Not tainted
[ 126.444852] -------------------------------------------------------
[ 126.451414] modprobe/778 is trying to acquire lock:
[ 126.456523] (((&glue->timer))){+.-...}, at: [<c01b8788>] del_timer_sync+0x0/0xd0
[ 126.464403]
[ 126.464403] but task is already holding lock:
[ 126.470511] (&(&musb->lock)->rlock){-.-...}, at: [<bf30b7f8>] musb_remove+0x50/0x1
30 [musb_hdrc]
[ 126.479965]
[ 126.479965] which lock already depends on the new lock.
[ 126.479965]
[ 126.488531]
[ 126.488531] the existing dependency chain (in reverse order) is:
[ 126.496368]
[ 126.496368] -> #1 (&(&musb->lock)->rlock){-.-...}:
[ 126.502968] otg_timer+0x80/0xec [musb_dsps]
[ 126.507990] call_timer_fn+0xb4/0x390
[ 126.512372] expire_timers+0xf0/0x1fc
[ 126.516754] run_timer_softirq+0x80/0x178
[ 126.521511] __do_softirq+0xc4/0x554
[ 126.525802] irq_exit+0xe8/0x158
[ 126.529735] __handle_domain_irq+0x58/0xb8
[ 126.534583] __irq_usr+0x54/0x80
[ 126.538507]
[ 126.538507] -> #0 (((&glue->timer))){+.-...}:
[ 126.544636] del_timer_sync+0x40/0xd0
[ 126.549066] musb_remove+0x6c/0x130 [musb_hdrc]
[ 126.554370] platform_drv_remove+0x24/0x3c
[ 126.559206] device_release_driver_internal+0x14c/0x1e0
[ 126.565225] bus_remove_device+0xd8/0x108
[ 126.569970] device_del+0x1e4/0x308
[ 126.574170] platform_device_del+0x24/0x8c
[ 126.579006] platform_device_unregister+0xc/0x20
[ 126.584394] dsps_remove+0x14/0x30 [musb_dsps]
[ 126.589595] platform_drv_remove+0x24/0x3c
[ 126.594432] device_release_driver_internal+0x14c/0x1e0
[ 126.600450] driver_detach+0x38/0x6c
[ 126.604740] bus_remove_driver+0x4c/0xa0
[ 126.609407] SyS_delete_module+0x11c/0x1e4
[ 126.614252] __sys_trace_return+0x0/0x10
Fixes: ea2f35c01d5ea ("usb: musb: Fix sleeping function called from invalid context for hdrc glue")
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Bin Liu <b-liu@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/musb_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2467,8 +2467,8 @@ static int musb_remove(struct platform_d
pm_runtime_get_sync(musb->controller);
musb_host_cleanup(musb);
musb_gadget_cleanup(musb);
- spin_lock_irqsave(&musb->lock, flags);
musb_platform_disable(musb);
+ spin_lock_irqsave(&musb->lock, flags);
musb_generic_disable(musb);
spin_unlock_irqrestore(&musb->lock, flags);
musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
next prev parent reply other threads:[~2017-03-30 10:17 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-30 10:15 [PATCH 4.9 00/16] 4.9.20-stable review Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 01/16] xfrm: policy: init locks early Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 02/16] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 03/16] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 04/16] KVM: x86: cleanup the page tracking SRCU instance Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 05/16] virtio_balloon: init 1st buffer in stats vq Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 06/16] pinctrl: qcom: Dont clear status bit on irq_unmask Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 07/16] c6x/ptrace: Remove useless PTRACE_SETREGSET implementation Greg Kroah-Hartman
2017-03-30 10:15 ` [PATCH 4.9 08/16] h8300/ptrace: Fix incorrect register transfer count Greg Kroah-Hartman
2017-03-30 10:16 ` [PATCH 4.9 09/16] mips/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman
2017-03-30 10:16 ` [PATCH 4.9 10/16] sparc/ptrace: " Greg Kroah-Hartman
2017-03-30 10:16 ` [PATCH 4.9 11/16] metag/ptrace: " Greg Kroah-Hartman
2017-03-30 10:16 ` [PATCH 4.9 12/16] metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS Greg Kroah-Hartman
2017-03-30 10:16 ` [PATCH 4.9 13/16] metag/ptrace: Reject partial NT_METAG_RPIPE writes Greg Kroah-Hartman
2017-03-30 10:16 ` [PATCH 4.9 14/16] fscrypt: remove broken support for detecting keyring key revocation Greg Kroah-Hartman
2017-03-30 10:16 ` [PATCH 4.9 15/16] sched/rt: Add a missing rescheduling point Greg Kroah-Hartman
2017-03-30 10:16 ` Greg Kroah-Hartman [this message]
2017-03-30 18:55 ` [PATCH 4.9 00/16] 4.9.20-stable review Shuah Khan
2017-03-31 3:45 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170330100432.195149121@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=b-liu@ti.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tony@atomide.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).