{"action":"created","issue":{"url":"https://api.github.com/repos/raspberrypi/linux/issues/830","repository_url":"https://api.github.com/repos/raspberrypi/linux","labels_url":"https://api.github.com/repos/raspberrypi/linux/issues/830/labels{/name}","comments_url":"https://api.github.com/repos/raspberrypi/linux/issues/830/comments","events_url":"https://api.github.com/repos/raspberrypi/linux/issues/830/events","html_url":"https://github.com/raspberrypi/linux/issues/830","id":57705262,"number":830,"title":"possible racecondition in dwc_otg driver","user":{"login":"flipreverse","id":1066130,"avatar_url":"https://avatars.githubusercontent.com/u/1066130?v=3","gravatar_id":"","url":"https://api.github.com/users/flipreverse","html_url":"https://github.com/flipreverse","followers_url":"https://api.github.com/users/flipreverse/followers","following_url":"https://api.github.com/users/flipreverse/following{/other_user}","gists_url":"https://api.github.com/users/flipreverse/gists{/gist_id}","starred_url":"https://api.github.com/users/flipreverse/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flipreverse/subscriptions","organizations_url":"https://api.github.com/users/flipreverse/orgs","repos_url":"https://api.github.com/users/flipreverse/repos","events_url":"https://api.github.com/users/flipreverse/events{/privacy}","received_events_url":"https://api.github.com/users/flipreverse/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"P33M","id":2474547,"avatar_url":"https://avatars.githubusercontent.com/u/2474547?v=3","gravatar_id":"","url":"https://api.github.com/users/P33M","html_url":"https://github.com/P33M","followers_url":"https://api.github.com/users/P33M/followers","following_url":"https://api.github.com/users/P33M/following{/other_user}","gists_url":"https://api.github.com/users/P33M/gists{/gist_id}","starred_url":"https://api.github.com/users/P33M/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/P33M/subscriptions","organizations_url":"https://api.github.com/users/P33M/orgs","repos_url":"https://api.github.com/users/P33M/repos","events_url":"https://api.github.com/users/P33M/events{/privacy}","received_events_url":"https://api.github.com/users/P33M/received_events","type":"User","site_admin":false},"milestone":null,"comments":17,"created_at":"2015-02-14T20:21:56Z","updated_at":"2016-06-01T10:49:40Z","closed_at":null,"body":"Hi all,\r\n\r\ni discovered a seriuos bug in the dwc driver. When i connect multiple usb devices and each of them generates a serious amount of traffic, i get a null pointer dereference error after a while.\r\nThe error message itself is quoted below. I narrowed the bug down to drivers/usb/host/dwc_otg/dwc_otg_hcd.c line 1205. To be more precise, the assignement of the new predecessor of the next element fails.\r\n```\r\n(elm)->field.cqe_next->field.cqe_prev =                 \\\r\n                    (elm)->field.cqe_prev;\r\n```\r\nThis might happen while a certain context tries to remove an item from the free list another context already removed. Hence, the first context fails during the *DWC_CIRECLEQ_REMOVE_INIT* macro.\r\nAs a first guess, i secured the list using a spinlock. I'm currently testing my fix.\r\nI'll inform you as soon as i know if i fixed that issue.\r\nMeanwhile, can you please tell me if there might be other sources for this bug?\r\n\r\nThanks!\r\n\r\nGreetings\r\nflip\r\n```\r\n[ 4989.166141] Unable to handle kernel NULL pointer dereference at virtual address 00000034                                                                                                \r\n[ 4989.174235] pgd = ede30000                                                                                                                                                              \r\n[ 4989.176936] [00000034] *pgd=2cef2831, *pte=00000000, *ppte=00000000                                                                                                                     \r\n[ 4989.183214] Internal error: Oops: 817 [#1] PREEMPT SMP ARM                                                                                                                              \r\n[ 4989.188689] Modules linked in: ipv6 snd_bcm2835 sg uas evdev rc_su3000 ts2022 ds3103 ts2020 ds3000 dvb_usb_dw2102 dvb_usb dvb_core rc_core snd_soc_wm8804 snd_soc_pcm512x_i2c regmap_sp8\r\n[ 4989.221576] CPU: 0 PID: 3261 Comm: mpegts_input_th Not tainted 3.18.5-v7-al-gddabc66-dirty #1                                                                                           \r\n[ 4989.230085] task: ec17c500 ti: ecf2e000 task.ti: ecf2e000                                                                                                                               \r\n[ 4989.235480] PC is at assign_and_init_hc+0x60/0x610                                                                                                                                      \r\n[ 4989.240264] LR is at dwc_otg_hcd_select_transactions+0x244/0x370                                                                                                                        \r\n[ 4989.246261] pc : [<c03d76fc>]    lr : [<c03d9850>]    psr: 00000193                                                                                                                     \r\n[ 4989.246261] sp : ecf2f928  ip : ecf2f960  fp : ecf2f95c                                                                                                                                 \r\n[ 4989.257716] r10: edced828  r9 : ee6c9000  r8 : e1b334c0                                                                                                                                 \r\n[ 4989.262929] r7 : ee6c9000  r6 : edced800  r5 : e1b33cc0  r4 : ee79c000                                                                                                                  \r\n[ 4989.269442] r3 : ee6c9060  r2 : 00000000  r1 : 00000000  r0 : ee6c9000                                                                                                                  \r\n[ 4989.275957] Flags: nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user                                                                                                          \r\n[ 4989.283163] Control: 10c5387d  Table: 2de3006a  DAC: 00000015                                                                                                                           \r\n[ 4989.288895] Process mpegts_input_th (pid: 3261, stack limit = 0xecf2e238)                                                                                                               \r\n[ 4989.295669] Stack: (0xecf2f928 to 0xecf30000)                                                                                                                                           \r\n[ 4989.300019] f920:                   ecf2f94c ecf2f938 c0533c6c c00d14ec ee78a3c0 c081248a                                                                                               \r\n[ 4989.308183] f940: edced800 ee6c9014 ee6c9060 ee6c9000 ecf2f9a4 ecf2f960 c03d9850 c03d76a8                                                                                               \r\n[ 4989.316347] f960: ee78a3c0 00000008 ee6c9038 ee6c901c ecf2f994 20000193 c0533c6c ee6c9000                                                                                               \r\n[ 4989.324511] f980: ee780f00 edced800 ee78a3c0 00000002 e1b33dc0 00000001 ecf2f9cc ecf2f9a8                                                                                               \r\n[ 4989.332675] f9a0: c03dc758 c03d9618 0c004c14 20000193 ee6c9000 ee780f00 e1b33e00 ee6c9000                                                                                               \r\n[ 4989.340839] f9c0: ecf2f9f4 ecf2f9d0 c03dc930 c03dc5d4 00000002 ecf2f9e0 c03af8cc e1b33e00                                                                                               \r\n[ 4989.349003] f9e0: ee780f00 f3980568 ecf2fa24 ecf2f9f8 c03dca6c c03dc88c 00000000 c03dd7f8                                                                                               \r\n[ 4989.357168] fa00: ecf2fa24 e1b33e00 ee780f00 f3980560 ee6c9000 00000002 ecf2fa64 ecf2fa28                                                                                               \r\n[ 4989.365331] fa20: c03ddaec c03dc9f4 00000002 c045ba3c ecf2fa84 ee78ee00 00000000 00000002                                                                                               \r\n[ 4989.373496] fa40: ee6c9000 ee780f00 00000000 f3980560 e1b33e00 00000001 ecf2fabc ecf2fa68                                                                                               \r\n[ 4989.381660] fa60: c03defe4 c03dd844 ee6c1800 c03d9c54 ee6c901c ec033628 ecf2fac4 ecf2fa88                                                                                               \r\n[ 4989.389825] fa80: 00000023 00000000 f398056c f3980568 f3980000 00000003 00000008 ee6c9000                                                                                               \r\n[ 4989.397988] faa0: 00000000 c08122b8 f301080e 00000000 ecf2fadc ecf2fac0 c03df3f4 c03dec8c                                                                                               \r\n[ 4989.406153] fac0: ee6c9000 ee6c8c00 00000001 02000008 ecf2fb04 ecf2fae0 c03df6a4 c03df350                                                                                               \r\n[ 4989.414316] fae0: ee78a600 c07cd95c 00000020 00000000 00000000 00000000 ecf2fb14 ecf2fb08                                                                                               \r\n[ 4989.422481] fb00: c03dbbf4 c03df440 ecf2fb24 ecf2fb18 c03af870 c03dbbe4 ecf2fb64 ecf2fb28                                                                                               \r\n[ 4989.430645] fb20: c0069a1c c03af848 c052dd98 c00d13c0 c052dd90 c07cd900 01400000 c07cd900                                                                                               \r\n[ 4989.438809] fb40: c07cd95c ee78a040 00000000 00000000 00000000 00000002 ecf2fb84 ecf2fb68                                                                                               \r\n[ 4989.446973] fb60: c0069c6c c00699e8 00020000 c07cd900 c07cd95c ecf2ffb0 ecf2fb9c ecf2fb88                                                                                               \r\n[ 4989.455137] fb80: c006ccdc c0069c2c 00000020 c07c6d44 ecf2fbc4 ecf2fba0 c0069384 c006cc3c                                                                                               \r\n[ 4989.463302] fba0: ecf2fbd8 c04ac6c0 60000113 f300b200 ecf2fc0c ec0e45b4 ecf2fbd4 ecf2fbc8                                                                                               \r\n[ 4989.471466] fbc0: c0008564 c006930c ecf2fc94 ecf2fbd8 c05345f4 c0008544 000005a8 e19bc600                                                                                               \r\n[ 4989.479630] fbe0: ad7c148c ad7d8857 ec0e4200 e19bc600 000005a8 00000001 ec0e45b4 00000000                                                                                               \r\n[ 4989.487794] fc00: 00000002 ecf2fc94 00055f80 ecf2fc20 00000000 c04ac6c0 60000113 ffffffff                                                                                               \r\n[ 4989.495958] fc20: ecf2fcb4 ecf2fc30 c04a8444 00000000 d216806a d216ff40 e19c2240 ec0e4200                                                                                               \r\n[ 4989.504122] fc40: 0000cdca 0000006a ecf2fc64 c044799c c0447f1c c0135d44 00000000 00000001                                                                                               \r\n[ 4989.512287] fc60: ec0e45b4 00000000 d216806a ec0e4200 d216806a e19c2240 00000020 ec0e4200                                                                                               \r\n[ 4989.520451] fc80: 0000cdca 0000006a ecf2fcb4 ecf2fc98 c04ad59c c04ac660 00000020 c048b6a4                                                                                               \r\n[ 4989.528615] fca0: ec0e4200 ec0e4200 ecf2fcec ecf2fcb8 c04a8fc8 c04ad568 ecf2fd1c 00000020                                                                                               \r\n[ 4989.536779] fcc0: c03dbab4 c03e5d28 00004a00 e19c2240 ec0e4200 edcd5700 00000000 ec0e4200\r\n[ 4989.544943] fce0: ecf2fd2c ecf2fcf0 c04b148c c04a8db8 ecf2fd0c edcede80 ee777e00 c046edc0                                                                                               \r\n[ 4989.553107] fd00: 00000000 c04b3d3c e19c2240 c08191c0 ec0e4258 00000000 ec0e4200 0000cdca                                                                                               \r\n[ 4989.561271] fd20: ecf2fd84 ecf2fd30 c04b3d54 c04b134c 00000020 00010220 00004b40 c0499da8                                                                                               \r\n[ 4989.569435] fd40: 71b2a8c0 e19c2240 c08e5040 c048f7c8 c08191c0 a4364ac5 ecf2fdac c059bd7c                                                                                               \r\n[ 4989.577599] fd60: 00000000 e19c2240 c07eb550 c08191c0 e19c2240 00000000 ecf2fdac ecf2fd88                                                                                               \r\n[ 4989.585763] fd80: c048f7b0 c04b34fc ee6c1800 e19c2240 d2168000 e19c2240 ee6c1800 00000000                                                                                               \r\n[ 4989.593927] fda0: ecf2fdd4 ecf2fdb0 c048ff04 c048f6d0 c9b2a8c0 000026fe 00000002 c04f9160                                                                                               \r\n[ 4989.602091] fdc0: d2168056 d2168056 ecf2fdfc ecf2fdd8 c048fafc c048fec4 c044799c c0135aa8                                                                                               \r\n[ 4989.610255] fde0: ecf2fe0c 00000056 d2168000 e19c2240 ecf2fe2c ecf2fe00 c0490250 c048f9a8                                                                                               \r\n[ 4989.618419] fe00: ecf2fe2c ecf2fe10 c04f9160 c0447f48 c07ea6fc 00000008 ee6c1800 c07ea710                                                                                               \r\n[ 4989.626583] fe20: ecf2fe7c ecf2fe30 c0459604 c048ff70 e19c2240 ede27380 ecf2e020 c03b2628                                                                                               \r\n[ 4989.634747] fe40: ee401e80 e19c2240 ecf2fe74 c07ea710 c04aad0c e19c2240 ee9d51f4 00000000                                                                                               \r\n[ 4989.642911] fe60: ee9d5194 00000040 ee9d51e4 00000000 ecf2fe94 ecf2fe80 c0459848 c0459010                                                                                               \r\n[ 4989.651075] fe80: e19c2240 ee9d51f4 ecf2fecc ecf2fe98 c045b09c c0459834 c047b46c ee9d51f0                                                                                               \r\n[ 4989.659240] fea0: ecf2fec4 00000001 00000000 00000040 0000012c ee9d5180 ecf2e000 ee9d51f4                                                                                               \r\n[ 4989.667404] fec0: ecf2ff0c ecf2fed0 c045aea0 c045b004 ecf2ff0c 0007279c ee9d5188 ecf2e000                                                                                               \r\n[ 4989.675568] fee0: c045776c 00000003 ecf2e000 c07cc08c 00000001 00000001 00000100 000002ff                                                                                               \r\n[ 4989.683732] ff00: ecf2ff5c ecf2ff10 c0028ee0 c045ad70 01400000 c07cd900 00000001 00400040                                                                                               \r\n[ 4989.691896] ff20: 0007279b 00000005 ecf2e010 0000000c c006c72c ecf2e020 c07c6d44 00000000                                                                                               \r\n[ 4989.700060] ff40: 00000000 00000000 018cd15c 000002ff ecf2ff74 ecf2ff60 c00294bc c0028dc0                                                                                               \r\n[ 4989.708224] ff60: 00000000 c07c6d44 ecf2ff9c ecf2ff78 c006938c c0029408 ecf2ffb0 b6b47408                                                                                               \r\n[ 4989.716389] ff80: a0000010 f300b200 10c5387d 10c5387d ecf2ffac ecf2ffa0 c0008564 c006930c                                                                                               \r\n[ 4989.724555] ffa0: 00000000 ecf2ffb0 c05349bc c0008544 b0100010 00000001 000005e8 00000000                                                                                               \r\n[ 4989.732720] ffc0: 018cd1b0 000000bc 00000010 54df62ab 00000000 018cd15c 000002ff 80000000                                                                                               \r\n[ 4989.740884] ffe0: 000cfc28 b1a82688 b6b473f4 b6b47408 a0000010 ffffffff 2effa821 2effac21                                                                                               \r\n[ 4989.749065] [<c03d76fc>] (assign_and_init_hc) from [<c03d9850>] (dwc_otg_hcd_select_transactions+0x244/0x370)                                                                           \r\n[ 4989.758971] [<c03d9850>] (dwc_otg_hcd_select_transactions) from [<c03dc758>] (release_channel.isra.10+0x190/0x224)                                                                      \r\n[ 4989.769307] [<c03dc758>] (release_channel.isra.10) from [<c03dc930>] (halt_channel+0xb0/0x168)                                                                                          \r\n[ 4989.777908] [<c03dc930>] (halt_channel) from [<c03dca6c>] (complete_non_periodic_xfer+0x84/0xa8)                                                                                        \r\n[ 4989.786683] [<c03dca6c>] (complete_non_periodic_xfer) from [<c03ddaec>] (handle_hc_xfercomp_intr+0x2b4/0x430)                                                                           \r\n[ 4989.796585] [<c03ddaec>] (handle_hc_xfercomp_intr) from [<c03defe4>] (dwc_otg_hcd_handle_hc_n_intr+0x364/0x6c4)                                                                         \r\n[ 4989.806661] [<c03defe4>] (dwc_otg_hcd_handle_hc_n_intr) from [<c03df3f4>] (dwc_otg_hcd_handle_hc_intr+0xb0/0xf0)                                                                        \r\n[ 4989.816822] [<c03df3f4>] (dwc_otg_hcd_handle_hc_intr) from [<c03df6a4>] (dwc_otg_hcd_handle_intr+0x270/0x368)                                                                           \r\n[ 4989.826723] [<c03df6a4>] (dwc_otg_hcd_handle_intr) from [<c03dbbf4>] (dwc_otg_hcd_irq+0x1c/0x28)                                                                                        \r\n[ 4989.835499] [<c03dbbf4>] (dwc_otg_hcd_irq) from [<c03af870>] (usb_hcd_irq+0x34/0x48)                                                                                                    \r\n[ 4989.843236] [<c03af870>] (usb_hcd_irq) from [<c0069a1c>] (handle_irq_event_percpu+0x40/0x244)                                                                                           \r\n[ 4989.851753] [<c0069a1c>] (handle_irq_event_percpu) from [<c0069c6c>] (handle_irq_event+0x4c/0x6c)                                                                                       \r\n[ 4989.860619] [<c0069c6c>] (handle_irq_event) from [<c006ccdc>] (handle_level_irq+0xac/0x130)                                                                                             \r\n[ 4989.868962] [<c006ccdc>] (handle_level_irq) from [<c0069384>] (__handle_domain_irq+0x84/0xdc)                                                                                           \r\n[ 4989.877477] [<c0069384>] (__handle_domain_irq) from [<c0008564>] (asm_do_IRQ+0x2c/0x30)                                                                                                 \r\n[ 4989.885472] [<c0008564>] (asm_do_IRQ) from [<c05345f4>] (__irq_svc+0x34/0x14c)\r\n[ 4989.892679] Exception stack(0xecf2fbd8 to 0xecf2fc20)                                                                                                                                   \r\n[ 4989.897719] fbc0:                                                       000005a8 e19bc600                                                                                               \r\n[ 4989.905884] fbe0: ad7c148c ad7d8857 ec0e4200 e19bc600 000005a8 00000001 ec0e45b4 00000000                                                                                               \r\n[ 4989.914048] fc00: 00000002 ecf2fc94 00055f80 ecf2fc20 00000000 c04ac6c0 60000113 ffffffff                                                                                               \r\n[ 4989.922218] [<c05345f4>] (__irq_svc) from [<c04ac6c0>] (tcp_write_xmit+0x6c/0xc34)                                                                                                      \r\n[ 4989.929781] [<c04ac6c0>] (tcp_write_xmit) from [<c04ad59c>] (__tcp_push_pending_frames+0x40/0xa0)                                                                                       \r\n[ 4989.938643] [<c04ad59c>] (__tcp_push_pending_frames) from [<c04a8fc8>] (tcp_rcv_established+0x21c/0x610)                                                                                \r\n[ 4989.948112] [<c04a8fc8>] (tcp_rcv_established) from [<c04b148c>] (tcp_v4_do_rcv+0x14c/0x368)                                                                                            \r\n[ 4989.956541] [<c04b148c>] (tcp_v4_do_rcv) from [<c04b3d54>] (tcp_v4_rcv+0x864/0x878)                                                                                                     \r\n[ 4989.964191] [<c04b3d54>] (tcp_v4_rcv) from [<c048f7b0>] (ip_local_deliver_finish+0xec/0x2d8)                                                                                            \r\n[ 4989.972620] [<c048f7b0>] (ip_local_deliver_finish) from [<c048ff04>] (ip_local_deliver+0x4c/0xac)                                                                                       \r\n[ 4989.981481] [<c048ff04>] (ip_local_deliver) from [<c048fafc>] (ip_rcv_finish+0x160/0x3ec)                                                                                               \r\n[ 4989.989648] [<c048fafc>] (ip_rcv_finish) from [<c0490250>] (ip_rcv+0x2ec/0x4a4)                                                                                                         \r\n[ 4989.996952] [<c0490250>] (ip_rcv) from [<c0459604>] (__netif_receive_skb_core+0x600/0x824)                                                                                              \r\n[ 4990.005210] [<c0459604>] (__netif_receive_skb_core) from [<c0459848>] (__netif_receive_skb+0x20/0x70)                                                                                   \r\n[ 4990.014418] [<c0459848>] (__netif_receive_skb) from [<c045b09c>] (process_backlog+0xa4/0x170)                                                                                           \r\n[ 4990.022930] [<c045b09c>] (process_backlog) from [<c045aea0>] (net_rx_action+0x13c/0x294)                                                                                                \r\n[ 4990.031011] [<c045aea0>] (net_rx_action) from [<c0028ee0>] (__do_softirq+0x12c/0x384)                                                                                                   \r\n[ 4990.038831] [<c0028ee0>] (__do_softirq) from [<c00294bc>] (irq_exit+0xc0/0x110)                                                                                                         \r\n[ 4990.046131] [<c00294bc>] (irq_exit) from [<c006938c>] (__handle_domain_irq+0x8c/0xdc)                                                                                                   \r\n[ 4990.053951] [<c006938c>] (__handle_domain_irq) from [<c0008564>] (asm_do_IRQ+0x2c/0x30)                                                                                                 \r\n[ 4990.061943] [<c0008564>] (asm_do_IRQ) from [<c05349bc>] (__irq_usr+0x3c/0x140)                                                                                                          \r\n[ 4990.069150] Exception stack(0xecf2ffb0 to 0xecf2fff8)                                                                                                                                   \r\n[ 4990.074191] ffa0:                                     b0100010 00000001 000005e8 00000000                                                                                               \r\n[ 4990.082355] ffc0: 018cd1b0 000000bc 00000010 54df62ab 00000000 018cd15c 000002ff 80000000                                                                                               \r\n[ 4990.090517] ffe0: 000cfc28 b1a82688 b6b473f4 b6b47408 a0000010 ffffffff                                                                                                                 \r\n[ 4990.097123] Code: e1520003 05942034 15941034 05872064 (15821034)\r\n```"},"comment":{"url":"https://api.github.com/repos/raspberrypi/linux/issues/comments/222958116","html_url":"https://github.com/raspberrypi/linux/issues/830#issuecomment-222958116","issue_url":"https://api.github.com/repos/raspberrypi/linux/issues/830","id":222958116,"user":{"login":"P33M","id":2474547,"avatar_url":"https://avatars.githubusercontent.com/u/2474547?v=3","gravatar_id":"","url":"https://api.github.com/users/P33M","html_url":"https://github.com/P33M","followers_url":"https://api.github.com/users/P33M/followers","following_url":"https://api.github.com/users/P33M/following{/other_user}","gists_url":"https://api.github.com/users/P33M/gists{/gist_id}","starred_url":"https://api.github.com/users/P33M/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/P33M/subscriptions","organizations_url":"https://api.github.com/users/P33M/orgs","repos_url":"https://api.github.com/users/P33M/repos","events_url":"https://api.github.com/users/P33M/events{/privacy}","received_events_url":"https://api.github.com/users/P33M/received_events","type":"User","site_admin":false},"created_at":"2016-06-01T10:49:40Z","updated_at":"2016-06-01T10:49:40Z","body":"If that's the case, then there is a path in the driver that is re-entrant in some strange way (two hardware interrupts arriving for the same channel, for example).\r\n\r\nWith there being a double-entry at the end of the list, I'd suspect bogus interrupts occurring in quick succession could cause this."}}
{"actor":{"display_login":"P33M"}}