| Message ID | Pine.LNX.4.44L0.1210221116040.1724-100000@iolanthe.rowland.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 22.10.2012 17:17, Alan Stern wrote: > On Sun, 21 Oct 2012, Artem S. Tashkinov wrote: > >> dmesg messages up to a crash can be seen here: https://bugzilla.kernel.org/attachment.cgi?id=84221 > > The first problem in the log is endpoint list corruption. Here's a > debugging patch which should provide a little more information. Maybe add a BUG() after each of these dev_err() so we stop at the first occurance and also see where we're coming from? > drivers/usb/core/hcd.c | 36 ++++++++++++++++++++++++++++++++++++ > 1 file changed, 36 insertions(+) > > Index: usb-3.6/drivers/usb/core/hcd.c > =================================================================== > --- usb-3.6.orig/drivers/usb/core/hcd.c > +++ usb-3.6/drivers/usb/core/hcd.c > @@ -1083,6 +1083,8 @@ EXPORT_SYMBOL_GPL(usb_calc_bus_time); > > /*-------------------------------------------------------------------------*/ > > +static bool list_error; > + > /** > * usb_hcd_link_urb_to_ep - add an URB to its endpoint queue > * @hcd: host controller to which @urb was submitted > @@ -1126,6 +1128,20 @@ int usb_hcd_link_urb_to_ep(struct usb_hc > */ > if (HCD_RH_RUNNING(hcd)) { > urb->unlinked = 0; > + > + { > + struct list_head *cur = &urb->ep->urb_list; > + struct list_head *prev = cur->prev; > + > + if (prev->next != cur && !list_error) { > + list_error = true; > + dev_err(&urb->dev->dev, > + "ep %x list add corruption: %p %p %p\n", > + urb->ep->desc.bEndpointAddress, > + cur, prev, prev->next); > + } > + } > + > list_add_tail(&urb->urb_list, &urb->ep->urb_list); > } else { > rc = -ESHUTDOWN; > @@ -1193,6 +1209,26 @@ void usb_hcd_unlink_urb_from_ep(struct u > { > /* clear all state linking urb to this dev (and hcd) */ > spin_lock(&hcd_urb_list_lock); > + { > + struct list_head *cur = &urb->urb_list; > + struct list_head *prev = cur->prev; > + struct list_head *next = cur->next; > + > + if (prev->next != cur && !list_error) { > + list_error = true; > + dev_err(&urb->dev->dev, > + "ep %x list del corruption prev: %p %p %p\n", > + urb->ep->desc.bEndpointAddress, > + cur, prev, prev->next); > + } > + if (next->prev != cur && !list_error) { > + list_error = true; > + dev_err(&urb->dev->dev, > + "ep %x list del corruption next: %p %p %p\n", > + urb->ep->desc.bEndpointAddress, > + cur, next, next->prev); > + } > + } > list_del_init(&urb->urb_list); > spin_unlock(&hcd_urb_list_lock); > } > -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Mon, 22 Oct 2012, Daniel Mack wrote: > On 22.10.2012 17:17, Alan Stern wrote: > > On Sun, 21 Oct 2012, Artem S. Tashkinov wrote: > > > >> dmesg messages up to a crash can be seen here: https://bugzilla.kernel.org/attachment.cgi?id=84221 > > > > The first problem in the log is endpoint list corruption. Here's a > > debugging patch which should provide a little more information. > > Maybe add a BUG() after each of these dev_err() so we stop at the first > occurance and also see where we're coming from? A BUG() at these points would crash the machine hard. And where we came from doesn't matter; what matters is the values in the pointers. Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Oct 22, 2012, Alan Stern <stern@rowland.harvard.edu> wrote: > A BUG() at these points would crash the machine hard. And where we > came from doesn't matter; what matters is the values in the pointers. OK, here's what the kernel prints with your patch: usb 6.1.4: ep 86 list del corruption prev: e5103b54 e5103a94 e51039d4 A small delay before I got thousands of list_del corruption messages would have been nice, but I managed to catch the message anyway. Artem -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Index: usb-3.6/drivers/usb/core/hcd.c =================================================================== --- usb-3.6.orig/drivers/usb/core/hcd.c +++ usb-3.6/drivers/usb/core/hcd.c @@ -1083,6 +1083,8 @@ EXPORT_SYMBOL_GPL(usb_calc_bus_time); /*-------------------------------------------------------------------------*/ +static bool list_error; + /** * usb_hcd_link_urb_to_ep - add an URB to its endpoint queue * @hcd: host controller to which @urb was submitted @@ -1126,6 +1128,20 @@ int usb_hcd_link_urb_to_ep(struct usb_hc */ if (HCD_RH_RUNNING(hcd)) { urb->unlinked = 0; + + { + struct list_head *cur = &urb->ep->urb_list; + struct list_head *prev = cur->prev; + + if (prev->next != cur && !list_error) { + list_error = true; + dev_err(&urb->dev->dev, + "ep %x list add corruption: %p %p %p\n", + urb->ep->desc.bEndpointAddress, + cur, prev, prev->next); + } + } + list_add_tail(&urb->urb_list, &urb->ep->urb_list); } else { rc = -ESHUTDOWN; @@ -1193,6 +1209,26 @@ void usb_hcd_unlink_urb_from_ep(struct u { /* clear all state linking urb to this dev (and hcd) */ spin_lock(&hcd_urb_list_lock); + { + struct list_head *cur = &urb->urb_list; + struct list_head *prev = cur->prev; + struct list_head *next = cur->next; + + if (prev->next != cur && !list_error) { + list_error = true; + dev_err(&urb->dev->dev, + "ep %x list del corruption prev: %p %p %p\n", + urb->ep->desc.bEndpointAddress, + cur, prev, prev->next); + } + if (next->prev != cur && !list_error) { + list_error = true; + dev_err(&urb->dev->dev, + "ep %x list del corruption next: %p %p %p\n", + urb->ep->desc.bEndpointAddress, + cur, next, next->prev); + } + } list_del_init(&urb->urb_list); spin_unlock(&hcd_urb_list_lock); }
On Sun, 21 Oct 2012, Artem S. Tashkinov wrote: > dmesg messages up to a crash can be seen here: https://bugzilla.kernel.org/attachment.cgi?id=84221 The first problem in the log is endpoint list corruption. Here's a debugging patch which should provide a little more information. Alan Stern drivers/usb/core/hcd.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html