search

klogg / fl2000_drm

Linux kernel FL2000DX/IT66121FN dongle DRM driver
GNU General Public License v2.0
113 stars 30 forks source link

Fix streaming work cancellation races #22

Closed klogg closed 4 years ago

klogg commented 4 years ago

Example:

[  323.292062] usb 2-1.1: it66121_bridge_disable
[  323.319057] ------------[ cut here ]------------
[  323.321130] WARNING: CPU: 0 PID: 7 at kernel/workqueue.c:620 __cancel_work_timer+0x116/0x190
[  323.324672] Modules linked in: it66121(OE) fl2000(OE) drm_kms_helper fb_sys_fops syscopyarea sysfillrect sysimgblt drm usbmon intel_rapl_msr intel_rapl_common kvm_intel kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper input_leds psmouse i2c_i801 ahci lpc_ich libahci serio_raw e1000 qemu_fw_cfg mac_hid 9pnet_virtio 9p 9pnet fscache
[  323.338414] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G           OE     5.4.0-31-generic #35-Ubuntu
[  323.341671] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1 04/01/2014
[  323.344096] Workqueue: events drm_mode_rmfb_work_fn [drm]
[  323.345565] RIP: 0010:__cancel_work_timer+0x116/0x190
[  323.346657] Code: 00 00 0f 85 8e 00 00 00 48 83 c4 40 5b 41 5c 41 5d 41 5e 5d c3 be 01 00 00 00 4c 89 e7 e8 c2 fb ff ff 49 8b 04 24 a8 01 75 8a <0f> 0b eb 86 48 8d 45 c0 ba 02 00 00 00 48 8d 75 a8 48 c7 c7 a0 df
[  323.350567] RSP: 0018:ffffbfe3c0047c08 EFLAGS: 00010246
[  323.351490] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[  323.352674] RDX: ffffbfe3c0047bb0 RSI: 0000000000000000 RDI: ffffbfe3c0047ba8
[  323.353854] RBP: ffffbfe3c0047c68 R08: 0000000000000006 R09: 000000000028be9b
[  323.355032] R10: 0000000000000a33 R11: 0000000000000000 R12: ffff9865b68a25a0
[  323.356090] R13: 0000000000000000 R14: ffff9865bb1e6000 R15: ffff9865b75b9e00
[  323.357083] FS:  0000000000000000(0000) GS:ffff9865bba00000(0000) knlGS:0000000000000000
[  323.358203] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  323.359002] CR2: 00007f5734b56e6c CR3: 000000017a20a002 CR4: 0000000000360ef0
[  323.359991] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  323.360926] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  323.361776] Call Trace:
[  323.362090]  ? devres_find+0x9e/0xc0
[  323.362545]  cancel_work_sync+0x10/0x20
[  323.363013]  fl2000_stream_disable+0x35/0x50 [fl2000]
[  323.363623]  fl2000_display_disable+0x1a/0x30 [fl2000]
[  323.364249]  drm_simple_kms_crtc_disable+0x23/0x30 [drm_kms_helper]
[  323.365021]  drm_atomic_helper_commit_modeset_disables+0x37a/0x470 [drm_kms_helper]
[  323.365876]  ? wait_for_completion_interruptible+0x37/0x160
[  323.366496]  drm_atomic_helper_commit_tail+0x1f/0x70 [drm_kms_helper]
[  323.367176]  commit_tail+0xd7/0x110 [drm_kms_helper]
[  323.367703]  drm_atomic_helper_commit+0x118/0x120 [drm_kms_helper]
[  323.368368]  drm_atomic_commit+0x4a/0x50 [drm]
[  323.368847]  drm_framebuffer_remove+0x392/0x3f0 [drm]
[  323.369387]  drm_mode_rmfb_work_fn+0x41/0x50 [drm]
[  323.369893]  process_one_work+0x1eb/0x3b0
[  323.370319]  worker_thread+0x4d/0x400
[  323.370682]  kthread+0x104/0x140
[  323.370990]  ? process_one_work+0x3b0/0x3b0
[  323.371385]  ? kthread_park+0x90/0x90
[  323.371732]  ret_from_fork+0x35/0x40
[  323.372071] ---[ end trace 556acee6e6632c7a ]---
[  323.372658] usb 2-1.1: Mode requested:  "800x480": 66 32000 800 840 888 928 480 493 496 525 0x48 0xa
[  323.373501] usb 2-1.1: Mode configured: "800x480": 66 32000 800 840 888 928 480 493 496 525 0x48 0xa
[  323.400767] usb 2-1.1: Setting AVI infoframe for mode: "800x480": 66 32000 800 840 888 928 480 493 496 525 0x48 0xa
[  324.081679] usb 2-1.1: it66121_bridge_enable
root@(none):/home/klogg/workspace/fl2000_drm# 
root@(none):/home/klogg/workspace/fl2000_drm# [  325.005439] BUG: kernel NULL pointer dereference, address: 0000000000000008
[  325.008183] #PF: supervisor read access in kernel mode
[  325.008711] #PF: error_code(0x0000) - not-present page
[  325.009095] PGD 0 P4D 0 
[  325.009290] Oops: 0000 [#1] SMP PTI
[  325.009555] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G        W  OE     5.4.0-31-generic #35-Ubuntu
[  325.010224] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1 04/01/2014
[  325.010873] Workqueue:  0x0 (events)
[  325.011151] RIP: 0010:process_one_work+0x34/0x3b0
[  325.011496] Code: 57 49 89 ff 41 56 41 55 41 54 53 48 89 f3 48 83 ec 08 48 8b 06 4c 8b 67 40 49 89 c5 45 30 ed a8 04 b8 00 00 00 00 4c 0f 44 e8 <49> 8b 45 08 44 8b b0 00 01 00 00 41 83 e6 20 44 89 75 d4 41 f6 44
[  325.012866] RSP: 0018:ffffbfe3c0047e70 EFLAGS: 00010046
[  325.013247] RAX: 0000000000000000 RBX: ffffdfe3bfc03258 RCX: ffff9865bb1e6000
[  325.013777] RDX: 0000000100001855 RSI: ffffdfe3bfc03258 RDI: ffff9865bb15d0c0
[  325.014307] RBP: ffffbfe3c0047ea0 R08: 0000000000000000 R09: 0000000000000000
[  325.014911] R10: ffff9865bba17848 R11: 0000000000000000 R12: ffff9865bba2a680
[  325.015531] R13: 0000000000000000 R14: ffff9865bb15d0c0 R15: ffff9865bb15d0c0
[  325.016152] FS:  0000000000000000(0000) GS:ffff9865bba00000(0000) knlGS:0000000000000000
[  325.016862] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  325.017364] CR2: 00000000000000b0 CR3: 0000000176a4a005 CR4: 0000000000360ef0
[  325.017985] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  325.018600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  325.019198] Call Trace:
[  325.019413]  worker_thread+0x4d/0x400
[  325.019730]  kthread+0x104/0x140
[  325.020013]  ? process_one_work+0x3b0/0x3b0
[  325.020383]  ? kthread_park+0x90/0x90
[  325.020713]  ret_from_fork+0x35/0x40
[  325.021030] Modules linked in: it66121(OE) fl2000(OE) drm_kms_helper fb_sys_fops syscopyarea sysfillrect sysimgblt drm usbmon intel_rapl_msr intel_rapl_common kvm_intel kvm crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper input_leds psmouse i2c_i801 ahci lpc_ich libahci serio_raw e1000 qemu_fw_cfg mac_hid 9pnet_virtio 9p 9pnet fscache
[  325.023922] CR2: 0000000000000008
[  325.024218] ---[ end trace 556acee6e6632c7b ]---
[  325.024628] RIP: 0010:process_one_work+0x34/0x3b0
[  325.025044] Code: 57 49 89 ff 41 56 41 55 41 54 53 48 89 f3 48 83 ec 08 48 8b 06 4c 8b 67 40 49 89 c5 45 30 ed a8 04 b8 00 00 00 00 4c 0f 44 e8 <49> 8b 45 08 44 8b b0 00 01 00 00 41 83 e6 20 44 89 75 d4 41 f6 44
[  325.026664] RSP: 0018:ffffbfe3c0047e70 EFLAGS: 00010046
[  325.027114] RAX: 0000000000000000 RBX: ffffdfe3bfc03258 RCX: ffff9865bb1e6000
[  325.027641] RDX: 0000000100001855 RSI: ffffdfe3bfc03258 RDI: ffff9865bb15d0c0
[  325.028168] RBP: ffffbfe3c0047ea0 R08: 0000000000000000 R09: 0000000000000000
[  325.028699] R10: ffff9865bba17848 R11: 0000000000000000 R12: ffff9865bba2a680
[  325.029226] R13: 0000000000000000 R14: ffff9865bb15d0c0 R15: ffff9865bb15d0c0
[  325.029753] FS:  0000000000000000(0000) GS:ffff9865bba00000(0000) knlGS:0000000000000000
[  325.030348] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  325.030764] CR2: 00000000000000b0 CR3: 0000000176a4a005 CR4: 0000000000360ef0
[  325.031309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  325.031836] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
klogg commented 4 years ago

also this

[  199.107933] ------------[ cut here ]------------
[  199.107939] WARNING: CPU: 7 PID: 903 at kernel/workqueue.c:620 __cancel_work_timer+0x116/0x190
[  199.107939] Modules linked in: it66121(OE) fl2000(OE) uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common snd_usb_audio videodev snd_usbmidi_lib mc hid_logitech_hidpp input_leds snd_hda_codec_hdmi intel_rapl_msr nvidia_uvm(OE) hid_logitech_dj mei_hdcp intel_rapl_common nls_iso8859_1 x86_pkg_temp_thermal intel_powerclamp nvidia_drm(POE) nvidia_modeset(POE) coretemp snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hda_core snd_hwdep snd_pcm kvm_intel nvidia(POE) kvm snd_seq_midi snd_seq_midi_event crct10dif_pclmul snd_rawmidi ghash_clmulni_intel snd_seq aesni_intel snd_seq_device snd_timer crypto_simd cryptd glue_helper snd rapl drm_kms_helper intel_cstate ipmi_devintf eeepc_wmi ipmi_msghandler asus_wmi fb_sys_fops mei_me syscopyarea sysfillrect joydev hid_multitouch sparse_keymap intel_wmi_thunderbolt serio_raw wmi_bmof mxm_wmi soundcore sysimgblt mei mac_hid acpi_pad sch_fq_codel parport_pc ppdev lp parport
[  199.107965]  drm ip_tables x_tables autofs4 hid_generic usbhid hid nvme crc32_pclmul psmouse e1000e i2c_i801 nvme_core ahci libahci wmi video
[  199.107972] CPU: 7 PID: 903 Comm: Xorg Tainted: P           OE     5.4.0-48-generic #52-Ubuntu
[  199.107973] Hardware name: System manufacturer System Product Name/MAXIMUS VIII HERO, BIOS 3802 03/15/2018
[  199.107975] RIP: 0010:__cancel_work_timer+0x116/0x190
[  199.107976] Code: 00 00 0f 85 8e 00 00 00 48 83 c4 40 5b 41 5c 41 5d 41 5e 5d c3 be 01 00 00 00 4c 89 e7 e8 c2 fb ff ff 49 8b 04 24 a8 01 75 8a <0f> 0b eb 86 48 8d 45 c0 ba 02 00 00 00 48 8d 75 a8 48 c7 c7 e0 de
[  199.107977] RSP: 0018:ffffad60c13bfa80 EFLAGS: 00010246
[  199.107978] RAX: 0000000000000080 RBX: 0000000000000000 RCX: 0000000000000000
[  199.107979] RDX: ffffad60c13bfa28 RSI: ffff9b4950340080 RDI: ffffad60c13bfa20
[  199.107979] RBP: ffffad60c13bfae0 R08: 0000000000000000 R09: 0000000000000000
[  199.107980] R10: 0000002e5b97e022 R11: 00000000001a3a8d R12: ffff9b49344f39a0
[  199.107980] R13: 0000000000000000 R14: ffff9b4939dedf00 R15: ffff9b48fad6ec00
[  199.107981] FS:  00007f7f91386a80(0000) GS:ffff9b495ebc0000(0000) knlGS:0000000000000000
[  199.107982] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  199.107983] CR2: 00005653371c0970 CR3: 00000008775f8005 CR4: 00000000003606e0
[  199.107983] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  199.107984] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  199.107984] Call Trace:
[  199.107990]  ? devres_find+0x9e/0xc0
[  199.107992]  cancel_work_sync+0x10/0x20
[  199.107996]  fl2000_stream_disable+0x35/0x50 [fl2000]
[  199.107998]  fl2000_display_disable+0x1a/0x30 [fl2000]
[  199.108007]  drm_simple_kms_crtc_disable+0x23/0x30 [drm_kms_helper]
[  199.108027]  drm_atomic_helper_commit_modeset_disables+0x37a/0x470 [drm_kms_helper]
[  199.108029]  ? wait_for_completion_interruptible+0x37/0x160
[  199.108034]  drm_atomic_helper_commit_tail+0x1f/0x70 [drm_kms_helper]
[  199.108039]  commit_tail+0xd7/0x110 [drm_kms_helper]
[  199.108043]  drm_atomic_helper_commit+0x118/0x120 [drm_kms_helper]
[  199.108057]  drm_atomic_commit+0x4a/0x50 [drm]
[  199.108066]  drm_atomic_connector_commit_dpms+0xdf/0x100 [drm]
[  199.108077]  drm_mode_obj_set_property_ioctl+0x156/0x2a0 [drm]
[  199.108088]  ? drm_connector_set_obj_prop+0x90/0x90 [drm]
[  199.108098]  drm_connector_property_set_ioctl+0x3b/0x60 [drm]
[  199.108106]  drm_ioctl_kernel+0xae/0xf0 [drm]
[  199.108114]  drm_ioctl+0x234/0x3d0 [drm]
[  199.108124]  ? drm_connector_set_obj_prop+0x90/0x90 [drm]
[  199.108126]  ? ___sys_recvmsg+0x88/0xc0
[  199.108128]  ? timerqueue_add+0x68/0xb0
[  199.108130]  ? enqueue_hrtimer+0x3d/0x90
[  199.108132]  do_vfs_ioctl+0x407/0x670
[  199.108133]  ? fput+0x13/0x15
[  199.108135]  ? __sys_recvmsg+0x88/0xa0
[  199.108136]  ksys_ioctl+0x67/0x90
[  199.108137]  __x64_sys_ioctl+0x1a/0x20
[  199.108139]  do_syscall_64+0x57/0x190
[  199.108141]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  199.108142] RIP: 0033:0x7f7f916e637b
[  199.108143] Code: 0f 1e fa 48 8b 05 15 3b 0d 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e5 3a 0d 00 f7 d8 64 89 01 48
[  199.108144] RSP: 002b:00007fff7195d078 EFLAGS: 00003246 ORIG_RAX: 0000000000000010
[  199.108145] RAX: ffffffffffffffda RBX: 00007fff7195d0b0 RCX: 00007f7f916e637b
[  199.108146] RDX: 00007fff7195d0b0 RSI: 00000000c01064ab RDI: 000000000000004e
[  199.108146] RBP: 00000000c01064ab R08: 000056196b903b10 R09: 0000000000000000
[  199.108147] R10: 0000000000000000 R11: 0000000000003246 R12: 000056196bb7e280
[  199.108147] R13: 000000000000004e R14: 000056196ba126a0 R15: 0000000000000000
[  199.108149] ---[ end trace 9d5e98f30f84da7a ]---
klogg commented 4 years ago

Fixed in 63ef248cccdd1004f8d1d7c6196213332825a163