From patchwork Thu Jul 20 11:31:42 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Aman Deep X-Patchwork-Id: 13320437 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19E63EB64DC for ; Thu, 20 Jul 2023 12:17:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230348AbjGTMRU (ORCPT ); Thu, 20 Jul 2023 08:17:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37032 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229628AbjGTMRT (ORCPT ); Thu, 20 Jul 2023 08:17:19 -0400 Received: from mailout3.samsung.com (mailout3.samsung.com [203.254.224.33]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0AA62118 for ; Thu, 20 Jul 2023 05:17:16 -0700 (PDT) Received: from epcas5p2.samsung.com (unknown [182.195.41.40]) by mailout3.samsung.com (KnoxPortal) with ESMTP id 20230720121714epoutp03fa11ec2026c4247b3057dd4250fd04e1~zkpCb4nWQ2738227382epoutp03D for ; Thu, 20 Jul 2023 12:17:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 mailout3.samsung.com 20230720121714epoutp03fa11ec2026c4247b3057dd4250fd04e1~zkpCb4nWQ2738227382epoutp03D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=samsung.com; s=mail20170921; t=1689855435; bh=635U/utLjBO9EWggPHp+XOGINrUbNQ65lx44UOJalco=; h=From:To:Cc:Subject:Date:References:From; b=svICcv1AgbE7SshKA49UaHJ1pd0nHLqI6SaIsFRxhW2yfWWmy5gez/LL5avqDra7f 7W/CKDq4yxgmYdUfYQalnQk+D98308pAa1+K3KFnyCnuBXW/To16sstXFI4Q4cvgfH FjGX6k6VGCdP1j2LKD0gWP6WXCfjKJ0OUp+GXGjM= Received: from epsmges5p1new.samsung.com (unknown [182.195.42.73]) by epcas5p1.samsung.com (KnoxPortal) with ESMTP id 20230720121714epcas5p1b4b25281c98835d4352bab360f4d1a88~zkpCDgAKd1458414584epcas5p1l; Thu, 20 Jul 2023 12:17:14 +0000 (GMT) Received: from epcas5p3.samsung.com ( [182.195.41.41]) by epsmges5p1new.samsung.com (Symantec Messaging Gateway) with SMTP id D8.B2.55522.AC529B46; Thu, 20 Jul 2023 21:17:14 +0900 (KST) Received: from epsmtrp2.samsung.com (unknown [182.195.40.14]) by epcas5p1.samsung.com (KnoxPortal) with ESMTPA id 20230720113203epcas5p1eb52bec9c076d1a2f3dac5e317d0361b~zkBlSInTU2420324203epcas5p1u; Thu, 20 Jul 2023 11:32:03 +0000 (GMT) Received: from epsmgms1p2new.samsung.com (unknown [182.195.42.42]) by epsmtrp2.samsung.com (KnoxPortal) with ESMTP id 20230720113203epsmtrp27d0ca2e3abd9cec37694966e3cdbb1cc~zkBlRg3iR1522915229epsmtrp2N; Thu, 20 Jul 2023 11:32:03 +0000 (GMT) X-AuditID: b6c32a49-67ffa7000000d8e2-58-64b925cab824 Received: from epsmtip2.samsung.com ( [182.195.34.31]) by epsmgms1p2new.samsung.com (Symantec Messaging Gateway) with SMTP id DD.6B.30535.33B19B46; Thu, 20 Jul 2023 20:32:03 +0900 (KST) Received: from sri-7017.. (unknown [107.108.189.195]) by epsmtip2.samsung.com (KnoxPortal) with ESMTPA id 20230720113202epsmtip26bcaec5c4a39519b53ac9dc3379832e4~zkBj6WYsD3200232002epsmtip2S; Thu, 20 Jul 2023 11:32:01 +0000 (GMT) From: Aman Deep To: gregkh@linuxfoundation.org, stern@rowland.harvard.edu, laurent.pinchart@ideasonboard.com Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Aman Deep , Anuj Gupta Subject: [PATCH] USB: Fix race condition during UVC webcam disconnect Date: Thu, 20 Jul 2023 17:01:42 +0530 Message-Id: <20230720113142.3070583-1-aman.deep@samsung.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFmpnleLIzCtJLcpLzFFi42LZdlhTU/eU6s4Ug1+/ZSz2v9/CYnHlpo9F 8+L1bBadE5ewW1zeNYfNYtGyVmaLCb8vsDmwe8zumMnqsX/uGiDr7g9Gj74tqxg9Pm+SC2CN 4rJJSc3JLEst0rdL4MpYu/kDc8EtlYrH388xNzB+lu9i5OSQEDCR2LH0HHsXIxeHkMBuRond pzYwQjifGCV6D91iB6kSEvjGKHH0ojFMx8tvp5gg4nsZJS63xkA0vGKU2Pu5nQUkwSagLtH6 +wuYLSIQJ/Hoxn9WkCJmgXZGiQ1bjjKCJIQFXCVOtC0EmsTBwSKgKtF/1AwkzCtgI7F0yglW iGXyEvsPnmWGiAtKnJz5BGwmM1C8eetsZpCZEgKn2CW2LFgO1eAicfbjISYIW1ji1fEt7BC2 lMTnd3vZIOxyiYdPJ7BANLcwSvx6+YgFImEv0XjkEthBzAKaEut36UOEZSWmnlrHBLGYT6L3 9xOo+bwSO+bB2MoS729+gNolKXHwUg8zhO0h0Xn3FisktGIlZu86yTyBUX4Wkn9mIflnFsLm BYzMqxglUwuKc9NTi00LDPNSy/WKE3OLS/PS9ZLzczcxgtOKlucOxrsPPugdYmTiYDzEKMHB rCTC++jythQh3pTEyqrUovz4otKc1OJDjNIcLErivK9b56YICaQnlqRmp6YWpBbBZJk4OKUa mELbrNbsfLDv/sdvfEqpy87uiKn+GRZx6Hp4latgxrXT0qL/76n7M6ZYbpTtm3B61gthnUaH icxVeefEC9f84LEr4pk70UuKfbH8c7k7kyadru9Xm77qu0pUon/R/fNargVZXN3XHon1xyQ3 mwfvqDmkf59dOanp6mq7N1PKjO5YFHAqPb5x9Fia5aK0jpenXq+eNfUgvzH7jv436uJtBiff R9541O+nfaCMRe+lrtXXKO25wldVLyn3Vaq9ZnjpknzF3maN4NqiokDRrVseMdcfvvn6ro51 /K5NTZYLvhlq7Wdy2u9bIvpT/l21pYGTTPGiZxJPXW0kr2m3rlPXjjxX/TJXtug8W7ZOpQ2/ EktxRqKhFnNRcSIA5niQMpoDAAA= X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFlrHLMWRmVeSWpSXmKPExsWy7bCSvK6x9M4Ug4UfZC32v9/CYnHlpo9F 8+L1bBadE5ewW1zeNYfNYtGyVmaLCb8vsDmwe8zumMnqsX/uGiDr7g9Gj74tqxg9Pm+SC2CN 4rJJSc3JLEst0rdL4MpYu/kDc8EtlYrH388xNzB+lu9i5OSQEDCRePntFFMXIxeHkMBuRol9 07axQCQkJSZ2vGSFsIUlVv57zg5R9IJR4uS3B8wgCTYBdYnW31/AGkQEEiSWn73CAlLELNDN KHFjySmwhLCAq8SJtoVAKzg4WARUJfqPmoGEeQVsJJZOOQG1QF5i/8GzzBBxQYmTM5+AtTID xZu3zmaewMg3C0lqFpLUAkamVYySqQXFuem5xYYFRnmp5XrFibnFpXnpesn5uZsYwUGqpbWD cc+qD3qHGJk4GA8xSnAwK4nwPrq8LUWINyWxsiq1KD++qDQntfgQozQHi5I477fXvSlCAumJ JanZqakFqUUwWSYOTqkGpl3rNrqf2XKx/GWxL6/cR5WNy5T1RI+k2IlsMVhhzxtjKLjJzUmn o+DunwO7q5m6Naoln2/smmP8nTn2pNC73JqLh62OyO4QaJz30b9y19Xaxys3xrZ5dJQf5xWv qznyZmbY3wkTFPIv1XgeM0jtSUlIqfmrcfbbVp0VNdJq3YkBW9Ltbm5xiH0c/6qNZfOHErmr B3z7Nlf9agl85bNpadu6EE0J5nll6SqWlRu+L7/rsV6MOVjCNWMv+3eppcYRFW/K5+p6Spxp Y3ott/jIu5j3209OOlfnX/i3e2a99YVbT/ZNz1Rqith+RrU6r1w36NupG14TJ6ZXbJPMmfBp 7x7VqJ5t7qtO35zep7QkR4mlOCPRUIu5qDgRALGmnLvBAgAA X-CMS-MailID: 20230720113203epcas5p1eb52bec9c076d1a2f3dac5e317d0361b X-Msg-Generator: CA X-Sendblock-Type: REQ_APPROVE CMS-TYPE: 105P X-CMS-RootMailID: 20230720113203epcas5p1eb52bec9c076d1a2f3dac5e317d0361b References: Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org In the bug happened during uvc webcam disconect,there is race between stopping a video transfer and usb disconnect.This issue is reproduced in my system running Linux kernel when UVC webcam play is stopped and UVC webcam is disconnected at the same time. This causes the below backtrace: [2-3496.7275] PC is at 0xbf418000+0x2d8 [usbcore] [2-3496.7275] LR is at 0x00000005 [2-3496.7275] pc : []((usb_ifnum_to_if )) lr : [<00000005>]() psr: 20000013 [2-3496.7275] Function entered at []((usb_ifnum_to_if )) (0xbf418000+0x2a4 [usbcore]) from []((usb_hcd_alloc_bandwidth )) (0xbf418000+0xb974 [usbcore]) [2-3496.7275] Function entered at []((usb_hcd_alloc_bandwidth )) (0xbf418000+0xb738 [usbcore]) from []((usb_set_interface )) (0xbf418000+0xeca0 [usbcore]) [2-3496.7275] Function entered at []((usb_set_interface )) (0xbf418000+0xeb9c [usbcore]) from []((uvc_video_clock_cleanup )) (0xbf9bd000+0x7dd4 [uvcvideo]) [2-3496.7275] Function entered at []((uvc_video_stop_streaming )) (0xbf9bd000+0x7d98 [uvcvideo]) from []((spin_lock_irq )) (0xbf9bd000+0x2ab8 [uvcvideo]) [2-3496.7276] Function entered at []((uvc_stop_streaming )) (0xbf9bd000+0x2a94 [uvcvideo]) from []((__read_once_size )) (0xbe306000+0x1150 [videobuf2_common]) [2-3496.7276] Function entered at []((__vb2_queue_cancel )) (0xbe306000+0x1120 [videobuf2_common]) from []((vb2_core_streamoff Signed-off-by: Aman Deep --- drivers/usb/core/hcd.c | 7 ++++++- drivers/usb/core/message.c | 4 ++++ drivers/usb/core/usb.c | 9 ++++++--- 3 files changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c index 8300baedafd2..a06452cbbaa4 100644 --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -1931,7 +1931,12 @@ int usb_hcd_alloc_bandwidth(struct usb_device *udev, } } if (cur_alt && new_alt) { - struct usb_interface *iface = usb_ifnum_to_if(udev, + struct usb_interface *iface; + + if (udev->state == USB_STATE_NOTATTACHED) + return -ENODEV; + + iface = usb_ifnum_to_if(udev, cur_alt->desc.bInterfaceNumber); if (!iface) diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index b5811620f1de..f31c7287dc01 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -1575,7 +1575,11 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) for (i = 0; i < iface->cur_altsetting->desc.bNumEndpoints; i++) iface->cur_altsetting->endpoint[i].streams = 0; + if (dev->state == USB_STATE_NOTATTACHED) + return -ENODEV; + ret = usb_hcd_alloc_bandwidth(dev, NULL, iface->cur_altsetting, alt); + if (ret < 0) { dev_info(&dev->dev, "Not enough bandwidth for altsetting %d\n", alternate); diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c index 901ec732321c..6fb8b14469ae 100644 --- a/drivers/usb/core/usb.c +++ b/drivers/usb/core/usb.c @@ -352,10 +352,13 @@ struct usb_interface *usb_ifnum_to_if(const struct usb_device *dev, if (!config) return NULL; - for (i = 0; i < config->desc.bNumInterfaces; i++) - if (config->interface[i]->altsetting[0] - .desc.bInterfaceNumber == ifnum) + for (i = 0; i < config->desc.bNumInterfaces; i++) { + if (config->interface[i] && + config->interface[i]->altsetting[0] + .desc.bInterfaceNumber == ifnum) { return config->interface[i]; + } + } return NULL; }