linux/drivers/usb
Peter Chen 174c27583b usb: dwc3: core: fix kernel panic when do reboot
commit 4bf584a03e upstream.

When do system reboot, it calls dwc3_shutdown and the whole debugfs
for dwc3 has removed first, when the gadget tries to do deinit, and
remove debugfs for its endpoints, it meets NULL pointer dereference
issue when call debugfs_lookup. Fix it by removing the whole dwc3
debugfs later than dwc3_drd_exit.

[ 2924.958838] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000002
....
[ 2925.030994] pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
[ 2925.037005] pc : inode_permission+0x2c/0x198
[ 2925.041281] lr : lookup_one_len_common+0xb0/0xf8
[ 2925.045903] sp : ffff80001276ba70
[ 2925.049218] x29: ffff80001276ba70 x28: ffff0000c01f0000 x27: 0000000000000000
[ 2925.056364] x26: ffff800011791e70 x25: 0000000000000008 x24: dead000000000100
[ 2925.063510] x23: dead000000000122 x22: 0000000000000000 x21: 0000000000000001
[ 2925.070652] x20: ffff8000122c6188 x19: 0000000000000000 x18: 0000000000000000
[ 2925.077797] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000004
[ 2925.084943] x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000030
[ 2925.092087] x11: 0101010101010101 x10: 7f7f7f7f7f7f7f7f x9 : ffff8000102b2420
[ 2925.099232] x8 : 7f7f7f7f7f7f7f7f x7 : feff73746e2f6f64 x6 : 0000000000008080
[ 2925.106378] x5 : 61c8864680b583eb x4 : 209e6ec2d263dbb7 x3 : 000074756f307065
[ 2925.113523] x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffff8000122c6188
[ 2925.120671] Call trace:
[ 2925.123119]  inode_permission+0x2c/0x198
[ 2925.127042]  lookup_one_len_common+0xb0/0xf8
[ 2925.131315]  lookup_one_len_unlocked+0x34/0xb0
[ 2925.135764]  lookup_positive_unlocked+0x14/0x50
[ 2925.140296]  debugfs_lookup+0x68/0xa0
[ 2925.143964]  dwc3_gadget_free_endpoints+0x84/0xb0
[ 2925.148675]  dwc3_gadget_exit+0x28/0x78
[ 2925.152518]  dwc3_drd_exit+0x100/0x1f8
[ 2925.156267]  dwc3_remove+0x11c/0x120
[ 2925.159851]  dwc3_shutdown+0x14/0x20
[ 2925.163432]  platform_shutdown+0x28/0x38
[ 2925.167360]  device_shutdown+0x15c/0x378
[ 2925.171291]  kernel_restart_prepare+0x3c/0x48
[ 2925.175650]  kernel_restart+0x1c/0x68
[ 2925.179316]  __do_sys_reboot+0x218/0x240
[ 2925.183247]  __arm64_sys_reboot+0x28/0x30
[ 2925.187262]  invoke_syscall+0x48/0x100
[ 2925.191017]  el0_svc_common.constprop.0+0x48/0xc8
[ 2925.195726]  do_el0_svc+0x28/0x88
[ 2925.199045]  el0_svc+0x20/0x30
[ 2925.202104]  el0_sync_handler+0xa8/0xb0
[ 2925.205942]  el0_sync+0x148/0x180
[ 2925.209270] Code: a9025bf5 2a0203f5 121f0056 370802b5 (79400660)
[ 2925.215372] ---[ end trace 124254d8e485a58b ]---
[ 2925.220012] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
[ 2925.227676] Kernel Offset: disabled
[ 2925.231164] CPU features: 0x00001001,20000846
[ 2925.235521] Memory Limit: none
[ 2925.238580] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]---

Fixes: 8d396bb0a5 ("usb: dwc3: debugfs: Add and remove endpoint dirs dynamically")
Cc: Jack Pham <jackp@codeaurora.org>
Tested-by: Jack Pham <jackp@codeaurora.org>
Signed-off-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20210608105656.10795-1-peter.chen@kernel.org
(cherry picked from commit 2a04276781)
Link: https://lore.kernel.org/r/20210615080847.GA10432@jackp-linux.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-06-23 14:42:54 +02:00
..
atm
c67x00
cdns3 usb: cdns3: Fix runtime PM imbalance on error 2021-06-16 12:01:35 +02:00
chipidea usb: chipidea: imx: Fix Battery Charger 1.2 CDP detection 2021-06-23 14:42:50 +02:00
class cdc-wdm: untangle a circular dependency between callback and softint 2021-05-19 10:13:16 +02:00
common
core usb: core: hub: Disable autosuspend for Cypress CY7C65632 2021-06-23 14:42:50 +02:00
dwc2 usb: dwc2: Fix build in periphal-only mode 2021-06-10 13:39:26 +02:00
dwc3 usb: dwc3: core: fix kernel panic when do reboot 2021-06-23 14:42:54 +02:00
early usb: early: ehci-dbgp: convert to readl_poll_timeout_atomic() 2020-09-25 16:29:09 +02:00
gadget usb: fix various gadget panics on 10gbps cabling 2021-06-16 12:01:43 +02:00
host usb: sl811-hcd: improve misleading indentation 2021-05-22 11:40:51 +02:00
image
isp1760 usb: isp1760-hcd: convert to readl_poll_timeout_atomic() 2020-09-25 16:30:05 +02:00
misc USB: trancevibrator: fix control-request direction 2021-06-03 09:00:34 +02:00
mon
mtu3 usb: mtu3: fix memory corruption in mtu3_debugfs_regset() 2020-12-26 16:02:38 +01:00
musb usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling 2021-06-16 12:01:41 +02:00
phy usb: phy: phy-ab8500-usb: fix spello of "function" 2020-10-02 09:57:41 +03:00
renesas_usbhs usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM 2021-03-17 17:06:29 +01:00
roles usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() 2021-05-14 09:49:55 +02:00
serial USB: serial: cp210x: fix alternate function for CP2102N QFN20 2021-06-16 12:01:42 +02:00
storage usb-storage: Add quirk to defeat Kindle's automatic unload 2021-03-25 09:04:14 +01:00
typec usb: typec: mux: Fix copy-paste mistake in typec_mux_match 2021-06-16 12:01:44 +02:00
usbip usbip: vudc: fix missing unlock on error in usbip_sockfd_store() 2021-05-14 09:50:19 +02:00
Kconfig
Makefile
usb-skeleton.c