From patchwork Thu Mar 9 14:44:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 66904 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp340038wrd; Thu, 9 Mar 2023 07:05:58 -0800 (PST) X-Google-Smtp-Source: AK7set9emSELxNucYrIQnF2AxIaDN1lv8M/9Q3LqJsxDOfrmvIUAclZot7u2TEZ+6hTuymN4++bC X-Received: by 2002:a05:6102:5616:b0:404:5ca2:8f8a with SMTP id de22-20020a056102561600b004045ca28f8amr5586144vsb.32.1678374357739; Thu, 09 Mar 2023 07:05:57 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678374357; cv=none; d=google.com; s=arc-20160816; b=idCva53ZjzB3qHwa5tSUs+zxJ7nET5LFxTM9YN6jqHyJaAHL2qpr4SE2Smjlmp6shg QUuLZ9RYIEzN327uFtRlj2CC+WXk54LUJJeKL9xSpXh9oLYvRJ3LuWTKZjIWXG0Y0XB5 37xNolBQBXp/LsryF4XuT1RO18WbV4prra47DfmwJ9Pe6AcSZgbj3N4EjYzjk911x3Ao BFy6LHzIAYI/4h/KDgUuLw3Z74Ya+OcK6eUBhlTYfcfeoTLjXjOEQOE22VRXqjQATkES H8Sx0fxFsYLXXU1zFavl1Ir54Rao7T5bcCQDRigqQJ5r2zP1HsjwsCYMWm3IMTfmjwaq 37CA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:in-reply-to:references:message-id :content-transfer-encoding:mime-version:subject:date:from :dkim-signature; bh=OqmvUbZhLfOLwhFDS2wZLjxzrgKFRfOQHbUU0CPsFYY=; b=mAoYbZh6CqRGm7T6MR/XFYtaFknkVBQDiiQEnmRhLlZLFFdX+/DWwNsC0KrYLzgjVt UwR1dZihd5f+wJhQc6iLQcWETtPj/jw40BeJt0TM/EyqX8ZBXgeQI60dOp68BFmfxvp0 1KfqlWo28iqKGrLvrig1mzMO0/mThLuKFGm8yx9xT21RCrUGtZlo7ASH5EcpURssUeUY aM2Pz+R5J7p8JLdiBVolG62veGxNMsl3vN30Wnii7QGku6uJYMCT3Gt9MZTjpCRFqwBN 31na4lSPDSVIPmB3c7Sl0haX6m3RVGgj+6G7n2eSzzkqhUQIru+hIRMJKUxQKlgJFrSN aS6g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=VKrNMvZP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id x5-20020a67dc05000000b00421a32fce9fsi5597035vsj.38.2023.03.09.07.05.41; Thu, 09 Mar 2023 07:05:57 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=VKrNMvZP; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232084AbjCIOqI (ORCPT + 99 others); Thu, 9 Mar 2023 09:46:08 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:52796 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232139AbjCIOpF (ORCPT ); Thu, 9 Mar 2023 09:45:05 -0500 Received: from mail-ed1-x52f.google.com (mail-ed1-x52f.google.com [IPv6:2a00:1450:4864:20::52f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7DE1E8A8B for ; Thu, 9 Mar 2023 06:44:22 -0800 (PST) Received: by mail-ed1-x52f.google.com with SMTP id j11so7952407edq.4 for ; Thu, 09 Mar 2023 06:44:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1678373060; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=OqmvUbZhLfOLwhFDS2wZLjxzrgKFRfOQHbUU0CPsFYY=; b=VKrNMvZPlKm1Qz4l+fhTQC7XAAcpAauJauBDIzx9QoOHSHipsD306AV7r1NqL6TaF9 ekGVH1m7BoCibiMaXP4121CJHRm40qye645wa5lXUYx4vN4y5atPzSIZpCJnDVLKBYQg GMZXkoMsZfCGgDE48E5JcNx6EQ6rH6ymeI6DQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678373060; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=OqmvUbZhLfOLwhFDS2wZLjxzrgKFRfOQHbUU0CPsFYY=; b=EK21cldialtGxs7khm8fa2234/WE0b8nL3X32rcEuRbipJEc5+qEfHyBAZlDoiRDiG gxnAGGglW9Nx3EFtysvlB1wM8vinbmK+2ALeEdulI8FYLZvgTCfu7GvTbls4z/6StEJP qRKE1cAIkAxUbt6uoZ6134fTKBDeVKnPi+st+Ae9SDuVQYM+UDRZt2iSFVys5tK7FZWv WFdkaLVgclmzmSAHOM5YSAa/9/T/YflbidFzeLi2kElm61jKN1p4YR4eq2njEhubAs43 IzWteBIBSX/CgXXO8idoIkXOdYV6fCFvjPkiLwuOX/gDKgnwqwmkUPiuvc+IsfgIl4hQ d4KA== X-Gm-Message-State: AO0yUKV5Txf8ij2LeeZ1unI963kzp+rhNYu8YXdChpw0aeD8Ckiu46LM 9GkgNR58grA9Yayj5pgxyyNvDA== X-Received: by 2002:a17:906:da89:b0:8b1:7de6:e292 with SMTP id xh9-20020a170906da8900b008b17de6e292mr29214835ejb.9.1678373060768; Thu, 09 Mar 2023 06:44:20 -0800 (PST) Received: from alco.roam.corp.google.com ([2620:0:1059:10:1645:7aa4:a765:1966]) by smtp.gmail.com with ESMTPSA id l6-20020a50d6c6000000b004bdcc480c41sm9708931edj.96.2023.03.09.06.44.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Mar 2023 06:44:20 -0800 (PST) From: Ricardo Ribalda Date: Thu, 09 Mar 2023 15:44:05 +0100 Subject: [PATCH v2 1/3] media: uvcvideo: Cancel async worker earlier MIME-Version: 1.0 Message-Id: <20230309-guenter-mini-v2-1-e6410d590d43@chromium.org> References: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> In-Reply-To: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> To: Mauro Carvalho Chehab Cc: Ricardo Ribalda , Laurent Pinchart , Max Staudt , Alan Stern , Sakari Ailus , Guenter Roeck , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Sean Paul , Tomasz Figa , Hans Verkuil X-Mailer: b4 0.11.0-dev-696ae X-Developer-Signature: v=1; a=openpgp-sha256; l=4230; i=ribalda@chromium.org; h=from:subject:message-id; bh=c4r9Zh1+85Fx2Zh7mY0BgdJ1GoRPl8v5yT/Vrh7HusA=; b=owEBbQKS/ZANAwAKAdE30T7POsSIAcsmYgBkCfC9Wtr20EFiqZKoGO6jW6rq3jpfSZDg8FcEUYBd fOXf4dqJAjMEAAEKAB0WIQREDzjr+/4oCDLSsx7RN9E+zzrEiAUCZAnwvQAKCRDRN9E+zzrEiHpAD/ 9zHvYkkEbMQEPYZu3fsJnJjirfXct3kHO7LHKKArNySruobQeuVulNDi4chIzFt3atGrtwUFlrz63/ XQJgEqyJT/t1ZFWDON120/lnUk5OOWbvc36uclhNdJKLnghbdgYSCdbblZrLzYqHcCs+oIJ+yFw4ZA 9rNgDpnFbjn4lrd1TyMUqIsEE7n4ZVuQfV8Q2sIPAh+fxqcr9MIstymbE5BANTHzroshhfxxIBhLNr 1G37pGkyqEd67SHwc16tWa3Tur7lghpgKacL7J7rFDiy+PyiEjBZl01ay+LYAskZlMfh2bAUUgQigy +rzB4PQsCzHn3FhTojVlB4eE1dZP6/WEu4d/Yv/8dyRTgUlB9289RJXL26PXCIqYZIBvfRAKtICX+E fFWtdoeg3jIuBsi6SG8VSsgh3TP39BZlmvZpLYFXCBoD9Ra7p4QCcsx6Kj9ryDIUo9f2cCOyYsJAhU VYdAFs9WkHzTqSqpoBoOIblfy5WO9SrH+glqpjSFBcLKO8+U9NmCucC341czL5fBoW2/Jyw3d0PzH+ LSIKtRa6+zspflNkqtBN7JCphrXqVMeW2LqyJ9dUxdssmJLBnkmrHeqIQCNygnhknWBXacUYUhPTFO 511Q+7FK6qqsFISv8cRaVgg9WW5MUvD8T8GjI7dM9q6SaxVL/6wHmWFm7P3w== X-Developer-Key: i=ribalda@chromium.org; a=openpgp; fpr=9EC3BB66E2FC129A6F90B39556A0D81F9F782DA9 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759903070736540476?= X-GMAIL-MSGID: =?utf-8?q?1759903070736540476?= From: Guenter Roeck So far the asynchronous control worker was canceled only in uvc_ctrl_cleanup_device. This is much later than the call to uvc_disconnect. However, after the call to uvc_disconnect returns, there must be no more USB activity. This can result in all kinds of problems in the USB code. One observed example: URB ffff993e83d0bc00 submitted while active WARNING: CPU: 0 PID: 4046 at drivers/usb/core/urb.c:364 usb_submit_urb+0x4ba/0x55e Modules linked in: <...> CPU: 0 PID: 4046 Comm: kworker/0:35 Not tainted 4.19.139 #18 Hardware name: Google Phaser/Phaser, BIOS Google_Phaser.10952.0.0 08/09/2018 Workqueue: events uvc_ctrl_status_event_work [uvcvideo] RIP: 0010:usb_submit_urb+0x4ba/0x55e Code: <...> RSP: 0018:ffffb08d471ebde8 EFLAGS: 00010246 RAX: a6da85d923ea5d00 RBX: ffff993e71985928 RCX: 0000000000000000 RDX: ffff993f37a1de90 RSI: ffff993f37a153d0 RDI: ffff993f37a153d0 RBP: ffffb08d471ebe28 R08: 000000000000003b R09: 001424bf85822e96 R10: 0000001000000000 R11: ffffffff975a4398 R12: ffff993e83d0b000 R13: ffff993e83d0bc00 R14: 0000000000000000 R15: 00000000fffffff0 FS: 0000000000000000(0000) GS:ffff993f37a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000ec9c0000 CR3: 000000025b160000 CR4: 0000000000340ef0 Call Trace: uvc_ctrl_status_event_work+0xd6/0x107 [uvcvideo] process_one_work+0x19b/0x4c5 worker_thread+0x10d/0x286 kthread+0x138/0x140 ? process_one_work+0x4c5/0x4c5 ? kthread_associate_blkcg+0xc1/0xc1 ret_from_fork+0x1f/0x40 Introduce new function uvc_ctrl_stop_device() to cancel the worker and call it from uvc_unregister_video() to solve the problem. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Reviewed-by: Tomasz Figa Reviewed-by: Sean Paul Signed-off-by: Guenter Roeck Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart --- drivers/media/usb/uvc/uvc_ctrl.c | 11 +++++++---- drivers/media/usb/uvc/uvc_driver.c | 1 + drivers/media/usb/uvc/uvcvideo.h | 1 + 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c index 5e9d3da862dd..769c1d2a2f45 100644 --- a/drivers/media/usb/uvc/uvc_ctrl.c +++ b/drivers/media/usb/uvc/uvc_ctrl.c @@ -2757,14 +2757,17 @@ static void uvc_ctrl_cleanup_mappings(struct uvc_device *dev, } } -void uvc_ctrl_cleanup_device(struct uvc_device *dev) +void uvc_ctrl_stop_device(struct uvc_device *dev) { - struct uvc_entity *entity; - unsigned int i; - /* Can be uninitialized if we are aborting on probe error. */ if (dev->async_ctrl.work.func) cancel_work_sync(&dev->async_ctrl.work); +} + +void uvc_ctrl_cleanup_device(struct uvc_device *dev) +{ + struct uvc_entity *entity; + unsigned int i; /* Free controls and control mappings for all entities. */ list_for_each_entry(entity, &dev->entities, list) { diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 7aefa76a42b3..4be6dfeaa295 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1893,6 +1893,7 @@ static void uvc_unregister_video(struct uvc_device *dev) } uvc_status_unregister(dev); + uvc_ctrl_stop_device(dev); if (dev->vdev.dev) v4l2_device_unregister(&dev->vdev); diff --git a/drivers/media/usb/uvc/uvcvideo.h b/drivers/media/usb/uvc/uvcvideo.h index 9a596c8d894a..50f171e7381b 100644 --- a/drivers/media/usb/uvc/uvcvideo.h +++ b/drivers/media/usb/uvc/uvcvideo.h @@ -760,6 +760,7 @@ int uvc_query_v4l2_menu(struct uvc_video_chain *chain, int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, const struct uvc_control_mapping *mapping); int uvc_ctrl_init_device(struct uvc_device *dev); +void uvc_ctrl_stop_device(struct uvc_device *dev); void uvc_ctrl_cleanup_device(struct uvc_device *dev); int uvc_ctrl_restore_values(struct uvc_device *dev); bool uvc_ctrl_status_event_async(struct urb *urb, struct uvc_video_chain *chain, From patchwork Thu Mar 9 14:44:06 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 66926 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp343389wrd; Thu, 9 Mar 2023 07:10:51 -0800 (PST) X-Google-Smtp-Source: AK7set8yq3IQ+zM0O0gTxCaspSnp89iWbCnoP1MGQdfaSmcYtnkbBOtfg4lY/WnLoG5OjQRB5ObI X-Received: by 2002:a05:6e02:20e6:b0:318:abd1:da42 with SMTP id q6-20020a056e0220e600b00318abd1da42mr17870740ilv.12.1678374650885; Thu, 09 Mar 2023 07:10:50 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678374650; cv=none; d=google.com; s=arc-20160816; b=bSU78SuGf8ezwYIDbKVP5luu9mfoUQiKZNwBN7JwbDOlZbBxW9ElkOSxMNJmbK5eka f5KMR0npKPbCSJfHdBdd/PgSTty3Q0+IhKabJNmY94JxGjvrrMNgb9O4gxd79mpIGfF8 ZHTONbkMwuvi1DH6Z+uGStEG1s6iXLFjcCillnbvp6nCHGC55fHOSRZ4PMyZBwdS+aru JdDqMcFCC+Su/P4TkKmbGFLkpGBAaC9vbIjkWYhUgQmcT+mRlPzJOQbsStN2+yosrHGG S1sIrJLCgwLsvxOLpQgUL8hh5APiKLDxUK1w10anA7Y1xJw9rKHccid2QvV6P7nx++PD jvMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:in-reply-to:references:message-id :content-transfer-encoding:mime-version:subject:date:from :dkim-signature; bh=cYea4xW1aPrNJdU0g9tC7HReHIPPT4JXF20GWjevROo=; b=qUnNNCT1/Z9XzfQCdOqI9DIAB8tzzvxErnkoy0hPaxXQGxQ/p09aHO88YpiH2hz/+N yFiS4r33lEcW96lsCDQlnX7c9UJGpaJ8xAM74FtZ+AV8l6FB15cQnKkbzOiq/3VJf0Qv +e3Y8zGauQ3MD3+v+6MByeeEmGgBxKlq8HzoWWEa/bPVCZwzxMjYxtfl9fqc679aDokm Xp7AURnmB2E/Um+KwKJgCDC9Rn+V+oSQc7oOVJ+9lvq9PyASJW9kdpWWfshXWpgGoyqs iXwsAU/dCx8BBhbQH7CWvXEwCV/fZSjr6s+kRfB1g6BqkUqDdVx/UX3m++dvia+1SrBd pXfw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=e2J3fuz4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p14-20020a056e0206ce00b0031402bfcb5esi12115734ils.3.2023.03.09.07.10.35; Thu, 09 Mar 2023 07:10:50 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=e2J3fuz4; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232075AbjCIOqD (ORCPT + 99 others); Thu, 9 Mar 2023 09:46:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232148AbjCIOpH (ORCPT ); Thu, 9 Mar 2023 09:45:07 -0500 Received: from mail-ed1-x52b.google.com (mail-ed1-x52b.google.com [IPv6:2a00:1450:4864:20::52b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A8E23FD298 for ; Thu, 9 Mar 2023 06:44:23 -0800 (PST) Received: by mail-ed1-x52b.google.com with SMTP id x3so7865855edb.10 for ; Thu, 09 Mar 2023 06:44:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1678373061; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=cYea4xW1aPrNJdU0g9tC7HReHIPPT4JXF20GWjevROo=; b=e2J3fuz4MSQcv+1Ux2A9YS7GC9jRDV1648YalOlit87Bbx+xDgC6Ydf/Q6DxpalZDm +IgSIWbWRfAYyl6D1/bzBVwM9X5DlpQ1w3qZRki4UKPxK84WngVxunKsV59rHV2TOc4Q PDw+KtHYBZUAUu10+BmcTDdr+3F6xwbPwXYbw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678373061; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=cYea4xW1aPrNJdU0g9tC7HReHIPPT4JXF20GWjevROo=; b=hiq5E8Y9Q8ajSGLE1TIuf+qNkfI+prPQaWehT/vDyb2mFLBBWRLj7usE85OHx1ilo4 HTsd5AdVqadB0m3es8AkeLVptO0tsG6U8kq6WG901vOVU6I3TVuFOBgih6FSOOjpAwjy 3ajdLJMtyZQKxoq+olJJQg9X/jzqGz4NzymjreTq68/P1t5aHplszi97wL4Smzb3B1TV OsxzFdQuin6OMUz0+ztIOGMLdkL1OydLninvCTPiLIfQ1xmHuEnw3J4QblmO971Lg5j4 FeossZu0dowVpd9cLw8n/+AnqCHfz1843Y4DnAOcvdOlWzhmgF3SvJ9lH6wL4AE/aN4t y5bw== X-Gm-Message-State: AO0yUKUci/XRakxbxQD7Dnhs3/41dKwWrae/FVyvD2oN7Y5gFIqSJUC5 usKNKg5tFh6tACja9XrIVXaQq9sAExirz++pQGn+Lw== X-Received: by 2002:a05:6402:699:b0:4ad:66b:84a8 with SMTP id f25-20020a056402069900b004ad066b84a8mr22649239edy.6.1678373061519; Thu, 09 Mar 2023 06:44:21 -0800 (PST) Received: from alco.roam.corp.google.com ([2620:0:1059:10:1645:7aa4:a765:1966]) by smtp.gmail.com with ESMTPSA id l6-20020a50d6c6000000b004bdcc480c41sm9708931edj.96.2023.03.09.06.44.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Mar 2023 06:44:21 -0800 (PST) From: Ricardo Ribalda Date: Thu, 09 Mar 2023 15:44:06 +0100 Subject: [PATCH v2 2/3] media: uvcvideo: Lock video streams and queues while unregistering MIME-Version: 1.0 Message-Id: <20230309-guenter-mini-v2-2-e6410d590d43@chromium.org> References: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> In-Reply-To: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> To: Mauro Carvalho Chehab Cc: Ricardo Ribalda , Laurent Pinchart , Max Staudt , Alan Stern , Sakari Ailus , Guenter Roeck , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Sean Paul , Tomasz Figa , Hans Verkuil X-Mailer: b4 0.11.0-dev-696ae X-Developer-Signature: v=1; a=openpgp-sha256; l=4440; i=ribalda@chromium.org; h=from:subject:message-id; bh=fcE+GDS+VWNQt6cIEy1PE6o89MbggJy7V6rzfGUAWoA=; b=owEBbQKS/ZANAwAKAdE30T7POsSIAcsmYgBkCfDAE0zosgxin8UX0Wbq1VMzdLe9WPvKboLwoVCA IfyOwT2JAjMEAAEKAB0WIQREDzjr+/4oCDLSsx7RN9E+zzrEiAUCZAnwwAAKCRDRN9E+zzrEiLEvEA CPi1bgGf5PkApsj56wCjFkv3C6N/AVhrjtC8z6XF/JZhEEBcu+1O5WBLqx1V1OV1R6NYUawEbT+FpP ne44cuo0HtM7aFITUbWJIPlfi1pLVZJ2kupbOBiq+fAfjlkh//MQ9EnWFi/3bGHAysDbjR6HbvFAvf IUaebHeeb3DclWFXbCJ+u/oYWm8QdU/BqKAUX+IlmLaRoqnl94s6UDeXHcfBHtZ6QIf+hoSCpJyI4k 6vqY5zvDprq9hRGpD0kTjPd7GD/nX+XacrfN0e6Q6EaZwGLvJ5XkDRK/RgNunjUJ2rOtRxs99IB0/g D6174lfISc+VVYc9WHI0kpuRUd6UwTl71OHrAarCVRdiK3JrCkFokOVag9h4b8pxueQWmNO/2mjyMN b3/I0IZDr7+1RkIKdbxw9q49cdpH5j/8/ctREZf6l+SW/tigFk0OxNUqS74wrDY2mzf0G8flY818kP mLzfOA2fS9v3h6PJjeaDr09dgpc2s/QxhPo6AG+6N01Ej1HUBLDdBeAtYwsBbPnTS/FlO1yaUM5aGL lP9VlgpzrQWxi1E6IexRg0orD2ekETMLvg7XMtOpbML8UAkJnjI9jJ+lZR+PCzBQm0FCfANvgNKHns OoNgJJzDEtQIc9PygewTJMOop0FJkttIGKPzkgsgvv3Ya42TTyQbe/IMSiKg== X-Developer-Key: i=ribalda@chromium.org; a=openpgp; fpr=9EC3BB66E2FC129A6F90B39556A0D81F9F782DA9 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759903377389921566?= X-GMAIL-MSGID: =?utf-8?q?1759903377389921566?= From: Guenter Roeck The call to uvc_disconnect() is not protected by any mutex. This means it can and will be called while other accesses to the video device are in progress. This can cause all kinds of race conditions, including crashes such as the following. usb 1-4: USB disconnect, device number 3 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 5633 Comm: V4L2CaptureThre Not tainted 4.19.113-08536-g5d29ca36db06 #1 Hardware name: GOOGLE Edgar, BIOS Google_Edgar.7287.167.156 03/25/2019 RIP: 0010:usb_ifnum_to_if+0x29/0x40 Code: <...> RSP: 0018:ffffa46f42a47a80 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff904a396c9000 RDX: ffff904a39641320 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffa46f42a47a80 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000000009975 R11: 0000000000000009 R12: 0000000000000000 R13: ffff904a396b3800 R14: ffff904a39e88000 R15: 0000000000000000 FS: 00007f396448e700(0000) GS:ffff904a3ba00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 000000016cb46000 CR4: 00000000001006f0 Call Trace: usb_hcd_alloc_bandwidth+0x1ee/0x30f usb_set_interface+0x1a3/0x2b7 uvc_video_start_transfer+0x29b/0x4b8 [uvcvideo] uvc_video_start_streaming+0x91/0xdd [uvcvideo] uvc_start_streaming+0x28/0x5d [uvcvideo] vb2_start_streaming+0x61/0x143 [videobuf2_common] vb2_core_streamon+0xf7/0x10f [videobuf2_common] uvc_queue_streamon+0x2e/0x41 [uvcvideo] uvc_ioctl_streamon+0x42/0x5c [uvcvideo] __video_do_ioctl+0x33d/0x42a video_usercopy+0x34e/0x5ff ? video_ioctl2+0x16/0x16 v4l2_ioctl+0x46/0x53 do_vfs_ioctl+0x50a/0x76f ksys_ioctl+0x58/0x83 __x64_sys_ioctl+0x1a/0x1e do_syscall_64+0x54/0xde usb_set_interface() should not be called after the USB device has been unregistered. However, in the above case the disconnect happened after v4l2_ioctl() was called, but before the call to usb_ifnum_to_if(). Acquire various mutexes in uvc_unregister_video() to fix the majority (maybe all) of the observed race conditions. The uvc_device lock prevents races against suspend and resume calls and the poll function. The uvc_streaming lock prevents races against stream related functions; for the most part, those are ioctls. This lock also requires other functions using this lock to check if a video device is still registered after acquiring it. For example, it was observed that the video device was already unregistered by the time the stream lock was acquired in uvc_ioctl_streamon(). The uvc_queue lock prevents races against queue functions, Most of those are already protected by the uvc_streaming lock, but some are called directly. This is done as added protection; an actual race was not (yet) observed. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Reviewed-by: Tomasz Figa Reviewed-by: Sean Paul Signed-off-by: Guenter Roeck Signed-off-by: Ricardo Ribalda --- drivers/media/usb/uvc/uvc_driver.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 4be6dfeaa295..9fda863ec446 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1882,14 +1882,22 @@ static void uvc_unregister_video(struct uvc_device *dev) { struct uvc_streaming *stream; + mutex_lock(&dev->lock); + list_for_each_entry(stream, &dev->streams, list) { if (!video_is_registered(&stream->vdev)) continue; + mutex_lock(&stream->mutex); + mutex_lock(&stream->queue.mutex); + video_unregister_device(&stream->vdev); video_unregister_device(&stream->meta.vdev); uvc_debugfs_cleanup_stream(stream); + + mutex_unlock(&stream->queue.mutex); + mutex_unlock(&stream->mutex); } uvc_status_unregister(dev); @@ -1901,6 +1909,7 @@ static void uvc_unregister_video(struct uvc_device *dev) if (media_devnode_is_registered(dev->mdev.devnode)) media_device_unregister(&dev->mdev); #endif + mutex_unlock(&dev->lock); } int uvc_register_video_device(struct uvc_device *dev, From patchwork Thu Mar 9 14:44:07 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ricardo Ribalda X-Patchwork-Id: 66905 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:5915:0:0:0:0:0 with SMTP id v21csp340072wrd; Thu, 9 Mar 2023 07:06:00 -0800 (PST) X-Google-Smtp-Source: AK7set8g2EkgLDRHUHSkb5pBjdRkeREhcTQ/cf8MYYpDZJiF2jQpFFA/en+CQcUb6qttOBRt/p8w X-Received: by 2002:a05:6122:88f:b0:40f:2eec:1dd8 with SMTP id 15-20020a056122088f00b0040f2eec1dd8mr14910993vkf.14.1678374360109; Thu, 09 Mar 2023 07:06:00 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1678374360; cv=none; d=google.com; s=arc-20160816; b=XY66ejOrhpJxC0p/sIzVDxK5ei0VhtGcoH1CTR19qaqM4Xo780zm3paOvB560oUXJZ tRpBkCusGupA8Jf43gV2nwP8Z5vq38WlOI476bpO0LyOXYHF77NYKnlvqjO08bhZkNd5 TDpaUvCJevOaudNWm/JVvJhgoj2lobYF/I2JA6Y5zh1iNgzhCoQi66DzLL3s9mn+TdNk +8M8QzwfYxwoPPEc6BsJfHkAZwBE422pn3+YnlQOO4fHsVxtCkt33toG1IahD3Jbrk02 Sh+LB9olzItBXYfU0YsPHUf9Gd4BU7yi/iUO3tm4cwk+k6HrWRQWlIkjWOALZJa4g+Kn zqkQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:in-reply-to:references:message-id :content-transfer-encoding:mime-version:subject:date:from :dkim-signature; bh=RGloBNHxOua9Iw1+mH1830UlqyJSA0ubuVXGPR5VpVE=; b=T10XyvTQJ0ESKhd+aNWG+G90Ux32B/LzCbS7oE9F+zsZoyA/DUzLxd/zC60QyJl6RZ tyMA3EfvrVaZZZpH8cPKdpv3rzuKkj20gZz6/fYH7es3eOgGYVAPlUpQvE7hJMfWNDoc w8tEhErteZTaiSbS5RZAzqNaqvN0a3h2QFwTK9PiruODMt0BhJdVIZ0ZIUX0hxmg60Ms LoJAU4yYIr3tbaqotsHQ3cvo07lm/vzZySB3ooXwrtHCckayN8kYpqkU6qLaCUTuEbns o9hPBuNdJ/1PHbEt0g4Ib4HN0qoNCKSOt2SRLSI6Y3MN9HBaOn3UFhIK+7lVBiXcCWUC n9ng== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=Bf5APZdq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id m12-20020a056102052c00b00411a448550bsi6198560vsa.46.2023.03.09.07.05.44; Thu, 09 Mar 2023 07:06:00 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=Bf5APZdq; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230147AbjCIOqK (ORCPT + 99 others); Thu, 9 Mar 2023 09:46:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51574 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232160AbjCIOpJ (ORCPT ); Thu, 9 Mar 2023 09:45:09 -0500 Received: from mail-ed1-x52d.google.com (mail-ed1-x52d.google.com [IPv6:2a00:1450:4864:20::52d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFBECFD2A5 for ; Thu, 9 Mar 2023 06:44:23 -0800 (PST) Received: by mail-ed1-x52d.google.com with SMTP id cy23so7836620edb.12 for ; Thu, 09 Mar 2023 06:44:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1678373062; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=RGloBNHxOua9Iw1+mH1830UlqyJSA0ubuVXGPR5VpVE=; b=Bf5APZdqT3K6VVDk4+ybnR0BxTte+I0bAOPPNfDGeIlJ3IUIoKDg0Z2QNBneKc+yR3 sxRjPLLStzOPLh8F3CjUTPmckywHqjgwWG/pzBIEkMvblzkmXWglK19wRZ+EIWlfySkz A6opliPI5NIXQP1M/HGCVsKowTNSqaOcuJPUE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; t=1678373062; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=RGloBNHxOua9Iw1+mH1830UlqyJSA0ubuVXGPR5VpVE=; b=TSEg3zDEwKdYNe8DWExawOmuoRBgISE0Hg6anrtxWzWS0+QimzvcTtnhNwnGmdYO+J n2UAN3VoxK3Nyt/4jOdj2Zw12EUI4m5IlmENwmEOXS6jke7GzjYbwtipaxhajlgr27/w 3y47KwRVDA1rCXSeFQStxuvkL2HlXm+qnehGkuzXpDjwEyqADtYXjoWKS5GSbHdSoV9M 2LuyTxe7sU3A5fPgxWWWMaSYxNIoRVBGPIKOg6NT9xYzNP4eOFNfq4gdFg1nrXudEy3T iQEG7ysoyX2u/zkcLp4d4ogd1oHqQmRqQCmSaZ7n6QHJLNr1Y/VU7dFNA1Sae2xQFKr1 qCFw== X-Gm-Message-State: AO0yUKWNSyQj75fph2bsQz5FLldWdmCs0Ljf0XMLnfT3TbhokB8Zw9Jx quSqB9rWeSyF7FX4+oHd+gkbdg== X-Received: by 2002:a17:906:8145:b0:8f4:9ef9:27bd with SMTP id z5-20020a170906814500b008f49ef927bdmr25149983ejw.12.1678373062394; Thu, 09 Mar 2023 06:44:22 -0800 (PST) Received: from alco.roam.corp.google.com ([2620:0:1059:10:1645:7aa4:a765:1966]) by smtp.gmail.com with ESMTPSA id l6-20020a50d6c6000000b004bdcc480c41sm9708931edj.96.2023.03.09.06.44.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Mar 2023 06:44:22 -0800 (PST) From: Ricardo Ribalda Date: Thu, 09 Mar 2023 15:44:07 +0100 Subject: [PATCH v2 3/3] media: uvcvideo: Release stream queue when unregistering video device MIME-Version: 1.0 Message-Id: <20230309-guenter-mini-v2-3-e6410d590d43@chromium.org> References: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> In-Reply-To: <20230309-guenter-mini-v2-0-e6410d590d43@chromium.org> To: Mauro Carvalho Chehab Cc: Ricardo Ribalda , Laurent Pinchart , Max Staudt , Alan Stern , Sakari Ailus , Guenter Roeck , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, Sean Paul , Tomasz Figa , Hans Verkuil X-Mailer: b4 0.11.0-dev-696ae X-Developer-Signature: v=1; a=openpgp-sha256; l=3750; i=ribalda@chromium.org; h=from:subject:message-id; bh=BOH3IOWNxfqaNBRdefVmQLKOUCCvdngRMwRhJ9U9HtI=; b=owEBbQKS/ZANAwAKAdE30T7POsSIAcsmYgBkCfDBZZCAsDZoV+Uj3AcB7rPDnPOlhvem/gT0dPE9 2SpUApKJAjMEAAEKAB0WIQREDzjr+/4oCDLSsx7RN9E+zzrEiAUCZAnwwQAKCRDRN9E+zzrEiMT5D/ sFKGVLG1o4uVDZBkY8X9lWNriff4Ta2f7S0CWt4L9/JAAe98LBiZ7hq2HU4+hQnCSnAI6v8L0nY4vb Yuxpxfdslfvd7shxhsnQjkzVZGOCRMunmlGvInbhuraUzhD0Boyx6JUQtVhAx0LKflsHoTw3ASMWxJ nsxF/pnwRTb52pNpJzIM7kQGy4OjRhEgUEK2lAubcW71BtpxtVLIx8pSxuxEdqH9OuhuVGsEed5bpp SieEJKZBgxmG+293HdxXjOJ6zqvesWFEc8KF8p65fpFDTaDntRLwsTZ9sDoMO5KKTPpNeUoeQNMZrj ACzcLcfrmJ+F+0tMj0XjMXt9Pe0biHjiKtgYF0pTS7J8oolssixQo8XkDcX7hqLCK8gqonPbD8uEij g0YO4/AmSWNEDYjzUAuVzSphq97xzZbCv3LO2+jl91MpD6gTyQ+p0X/61R6laOiBg2mcRvyN0Wu/J9 k1pB7E72K0NUS4u332k8IQIHDthh3cL6U7prZrX24NIYhit8yKUOljIJjEJgNETD9qRICvHfMjTKne Zh09PpX3bz0Abk2vPU8QCAxNkPyolxWCyrFoFOwTGBhZa9shA3UOAg9LA0UQZoOrdjUKk8ZriLqT/s Kynw4i7b89LXM+U7HGaeAyhZHbZnKgQg+nGsFlAhVHArQAxqzkiNBCMwpmrA== X-Developer-Key: i=ribalda@chromium.org; a=openpgp; fpr=9EC3BB66E2FC129A6F90B39556A0D81F9F782DA9 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1759903073267843735?= X-GMAIL-MSGID: =?utf-8?q?1759903073267843735?= From: Guenter Roeck The following traceback was observed when stress testing the uvcvideo driver. config->interface[0] is NULL WARNING: CPU: 0 PID: 2757 at drivers/usb/core/usb.c:285 usb_ifnum_to_if+0x81/0x85 ^^^ added log message and WARN() to prevent crash Modules linked in: <...> CPU: 0 PID: 2757 Comm: inotify_reader Not tainted 4.19.139 #20 Hardware name: Google Phaser/Phaser, BIOS Google_Phaser.10952.0.0 08/09/2018 RIP: 0010:usb_ifnum_to_if+0x81/0x85 Code: <...> RSP: 0018:ffff9ee20141fa58 EFLAGS: 00010246 RAX: 438a0e5a525f1800 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff975477a1de90 RSI: ffff975477a153d0 RDI: ffff975477a153d0 RBP: ffff9ee20141fa70 R08: 000000000000002c R09: 002daec189138d78 R10: 0000001000000000 R11: ffffffffa7da42e6 R12: ffff975459594800 R13: 0000000000000001 R14: 0000000000000001 R15: ffff975465376400 FS: 00007ddebffd6700(0000) GS:ffff975477a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000012c83000 CR3: 00000001bbaf8000 CR4: 0000000000340ef0 Call Trace: usb_set_interface+0x3b/0x2f3 uvc_video_stop_streaming+0x38/0x81 [uvcvideo] uvc_stop_streaming+0x21/0x49 [uvcvideo] __vb2_queue_cancel+0x33/0x249 [videobuf2_common] vb2_core_queue_release+0x1c/0x45 [videobuf2_common] uvc_queue_release+0x26/0x32 [uvcvideo] uvc_v4l2_release+0x41/0xdd [uvcvideo] v4l2_release+0x99/0xed __fput+0xf0/0x1ea task_work_run+0x7f/0xa7 do_exit+0x1d1/0x6eb do_group_exit+0x9d/0xac get_signal+0x135/0x482 do_signal+0x4a/0x63c exit_to_usermode_loop+0x86/0xa5 do_syscall_64+0x171/0x269 ? __do_page_fault+0x272/0x474 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7ddec156dc26 Code: Bad RIP value. RSP: 002b:00007ddebffd5c10 EFLAGS: 00000293 ORIG_RAX: 0000000000000017 RAX: fffffffffffffdfe RBX: 000000000000000a RCX: 00007ddec156dc26 RDX: 0000000000000000 RSI: 00007ddebffd5d28 RDI: 000000000000000a RBP: 00007ddebffd5c50 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 00007ddebffd5d28 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 When this was observed, a USB disconnect was in progress, uvc_disconnect() had returned, but usb_disable_device() was still running. Drivers are not supposed to call any USB functions after the driver disconnect function has been called. The uvcvideo driver does not follow that convention and tries to write to the disconnected USB interface anyway. This results in a variety of race conditions. To solve this specific problem, release the uvc queue from uvc_unregister_video() after the associated video devices have been unregistered. Since the function already holds the uvc queue mutex, bypass uvc_queue_release() and call vb2_queue_release() directly. Cc: Laurent Pinchart Cc: Alan Stern Cc: Hans Verkuil Reviewed-by: Tomasz Figa Reviewed-by: Sean Paul Signed-off-by: Guenter Roeck Signed-off-by: Ricardo Ribalda --- drivers/media/usb/uvc/uvc_driver.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c index 9fda863ec446..23d839f74ca5 100644 --- a/drivers/media/usb/uvc/uvc_driver.c +++ b/drivers/media/usb/uvc/uvc_driver.c @@ -1896,6 +1896,8 @@ static void uvc_unregister_video(struct uvc_device *dev) uvc_debugfs_cleanup_stream(stream); + vb2_queue_release(&stream->queue.queue); + mutex_unlock(&stream->queue.mutex); mutex_unlock(&stream->mutex); }