kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/drivers/usb/mtu3
History
Vladimir Murzin cfb3293c45 usb: mtu3: Fix double dereference in TP_printk 
Paul reported kernel splat:

[    0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[    0.000000] ------------[ cut here ]------------
[    0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
[    0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
[    0.000000] Hardware name: linux,dummy-virt (DT)
[    0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    0.000000] pc : test_double_dereference+0x144/0x14c
[    0.000000] lr : test_double_dereference+0x144/0x14c
[    0.000000] sp : ffffc80aa7633bf0
[    0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
[    0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
[    0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
[    0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
[    0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
[    0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
[    0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
[    0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
[    0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
[    0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
[    0.000000] Call trace:
[    0.000000]  test_double_dereference+0x144/0x14c (P)
[    0.000000]  trace_event_raw_init+0x37c/0x5d8
[    0.000000]  event_init+0x34/0xc0
[    0.000000]  trace_event_init+0xec/0x588
[    0.000000]  trace_init+0x24/0x6e0
[    0.000000]  start_kernel+0x4a0/0x8ec
[    0.000000]  __primary_switched+0x88/0x90
[    0.000000] irq event stamp: 0
[    0.000000] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[    0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
[    0.000000] softirqs last  enabled at (0): [<0000000000000000>] 0x0
[    0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
[    0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma

Which also observed by Mark and myself.

The splat it result of new check introduced by b5cc230af5 ("tracing:
Warn when an event dereferences a pointer in TP_printk()") which
correctly catches issue with %pad dereferencing the address saved in
the ring buffer. TP_fast_assign() logic gets executed when the
tracepoint is triggered, however the TP_printk() is executed when the
user reads the trace buffer which could be seconds, minutes, hours,
days, even months later and nothing guarantee that __entry->gpd_ring
pointer will still be pointing to what it was when it was recorded.

Fix the issue by capturing immediate value of gpd_ring.dma when trace
point is triggered.

Reported-by: Paul E. McKenney <paulmck@kernel.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
History 2026-09-29 17:26:50 -07:00
..
Kconfig usb: use "prompt" instead of "bool" for choice prompts 2024-11-04 17:53:09 +09:00
Makefile usb: mtu3: add tracepoints to help debug 2019-03-26 16:40:14 +09:00
mtu3.h usb: mtu3: fix invalid kernel-doc in mtu3.h 2025-10-28 15:35:25 +01:00
mtu3_core.c usb: mtu3: allow system suspend during active gadget connection 2026-07-10 15:56:19 +02:00
mtu3_debug.h usb: mtu3: mtu3_debug: remove an unused struct member 2020-12-04 16:49:06 +01:00
mtu3_debugfs.c Driver core and debugfs updates 2025-01-28 12:25:12 -08:00
mtu3_dr.c USB: Use str_enable_disable-like helpers 2025-01-15 18:28:13 +01:00
mtu3_dr.h usb: mtu3: support suspend/resume for dual-role mode 2021-07-27 15:58:37 +02:00
mtu3_gadget.c usb: mtu3: unmap request DMA on queue failure 2026-06-25 16:04:26 +01:00
mtu3_gadget_ep0.c usb: mtu3: support function remote wakeup 2022-07-08 14:53:30 +02:00
mtu3_host.c usb: mtu3: add support remote wakeup of mt8196 2026-07-10 14:52:11 +02:00
mtu3_hw_regs.h usb: mtu3: fix the failure of qmu stop 2023-01-19 14:12:08 +01:00
mtu3_plat.c usb: mtu3: condition PHY wakeup for host mode and runtime suspend 2026-07-10 15:56:19 +02:00
mtu3_qmu.c usb: mtu3: fix misspelled words 2025-10-28 15:35:25 +01:00
mtu3_qmu.h USB: mtu3: Use the correct style for SPDX License Identifier 2020-04-16 14:32:48 +02:00
mtu3_trace.c usb: mtu3: mtu3_trace: Supply missing mtu3_debug.h include file 2020-07-15 17:25:57 +02:00
mtu3_trace.h usb: mtu3: Fix double dereference in TP_printk 2026-09-29 17:26:50 -07:00