releases/4.9.70/usb-gadget-ffs-forbid-usb_ep_alloc_request-from-sleeping.patch

   1 From 30bf90ccdec1da9c8198b161ecbff39ce4e5a9ba Mon Sep 17 00:00:00 2001
   2 From: Vincent Pelletier <plr.vincent@gmail.com>
   3 Date: Sun, 26 Nov 2017 06:52:53 +0000
   4 Subject: usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping
   5
   6 From: Vincent Pelletier <plr.vincent@gmail.com>
   7
   8 commit 30bf90ccdec1da9c8198b161ecbff39ce4e5a9ba upstream.
   9
  10 Found using DEBUG_ATOMIC_SLEEP while submitting an AIO read operation:
  11
  12 [  100.853642] BUG: sleeping function called from invalid context at mm/slab.h:421
  13 [  100.861148] in_atomic(): 1, irqs_disabled(): 1, pid: 1880, name: python
  14 [  100.867954] 2 locks held by python/1880:
  15 [  100.867961]  #0:  (&epfile->mutex){....}, at: [<f8188627>] ffs_mutex_lock+0x27/0x30 [usb_f_fs]
  16 [  100.868020]  #1:  (&(&ffs->eps_lock)->rlock){....}, at: [<f818ad4b>] ffs_epfile_io.isra.17+0x24b/0x590 [usb_f_fs]
  17 [  100.868076] CPU: 1 PID: 1880 Comm: python Not tainted 4.14.0-edison+ #118
  18 [  100.868085] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48
  19 [  100.868093] Call Trace:
  20 [  100.868122]  dump_stack+0x47/0x62
  21 [  100.868156]  ___might_sleep+0xfd/0x110
  22 [  100.868182]  __might_sleep+0x68/0x70
  23 [  100.868217]  kmem_cache_alloc_trace+0x4b/0x200
  24 [  100.868248]  ? dwc3_gadget_ep_alloc_request+0x24/0xe0 [dwc3]
  25 [  100.868302]  dwc3_gadget_ep_alloc_request+0x24/0xe0 [dwc3]
  26 [  100.868343]  usb_ep_alloc_request+0x16/0xc0 [udc_core]
  27 [  100.868386]  ffs_epfile_io.isra.17+0x444/0x590 [usb_f_fs]
  28 [  100.868424]  ? _raw_spin_unlock_irqrestore+0x27/0x40
  29 [  100.868457]  ? kiocb_set_cancel_fn+0x57/0x60
  30 [  100.868477]  ? ffs_ep0_poll+0xc0/0xc0 [usb_f_fs]
  31 [  100.868512]  ffs_epfile_read_iter+0xfe/0x157 [usb_f_fs]
  32 [  100.868551]  ? security_file_permission+0x9c/0xd0
  33 [  100.868587]  ? rw_verify_area+0xac/0x120
  34 [  100.868633]  aio_read+0x9d/0x100
  35 [  100.868692]  ? __fget+0xa2/0xd0
  36 [  100.868727]  ? __might_sleep+0x68/0x70
  37 [  100.868763]  SyS_io_submit+0x471/0x680
  38 [  100.868878]  do_int80_syscall_32+0x4e/0xd0
  39 [  100.868921]  entry_INT80_32+0x2a/0x2a
  40 [  100.868932] EIP: 0xb7fbb676
  41 [  100.868941] EFLAGS: 00000292 CPU: 1
  42 [  100.868951] EAX: ffffffda EBX: b7aa2000 ECX: 00000002 EDX: b7af8368
  43 [  100.868961] ESI: b7fbb660 EDI: b7aab000 EBP: bfb6c658 ESP: bfb6c638
  44 [  100.868973]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b
  45
  46 Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
  47 Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  48 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  49
  50 ---
  51  drivers/usb/gadget/function/f_fs.c |    2 +-
  52  1 file changed, 1 insertion(+), 1 deletion(-)
  53
  54 --- a/drivers/usb/gadget/function/f_fs.c
  55 +++ b/drivers/usb/gadget/function/f_fs.c
  56 @@ -1015,7 +1015,7 @@ static ssize_t ffs_epfile_io(struct file
  57                 else
  58                         ret = ep->status;
  59                 goto error_mutex;
  60 -       } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) {
  61 +       } else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
  62                 ret = -ENOMEM;
  63         } else {
  64                 req->buf      = data;