Commit a9c85903 authored by Shen Jing's avatar Shen Jing Committed by Felipe Balbi
Browse files

Revert "usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers" 



This reverts commit b4194da3f9087dd38d91b40f9bec42d59ce589a8
since it causes list corruption followed by kernel panic:

Workqueue: adb ffs_aio_cancel_worker
RIP: 0010:__list_add_valid+0x4d/0x70
Call Trace:
insert_work+0x47/0xb0
__queue_work+0xf6/0x400
queue_work_on+0x65/0x70
dwc3_gadget_giveback+0x44/0x50 [dwc3]
dwc3_gadget_ep_dequeue+0x83/0x2d0 [dwc3]
? finish_wait+0x80/0x80
usb_ep_dequeue+0x1e/0x90
process_one_work+0x18c/0x3b0
worker_thread+0x3c/0x390
? process_one_work+0x3b0/0x3b0
kthread+0x11e/0x140
? kthread_create_worker_on_cpu+0x70/0x70
ret_from_fork+0x3a/0x50

This issue is seen with warm reboot stability testing.

Signed-off-by: default avatarShen Jing <jingx.shen@intel.com>
Signed-off-by: default avatarSaranya Gopal <saranya.gopal@intel.com>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
parent 3c135e89

drivers/usb/gadget/function/f_fs.c

+8 −18
Original line number Original line Diff line number Diff line
@@ -215,7 +215,6 @@ struct ffs_io_data { 




	struct mm_struct *mm;

	struct mm_struct *mm;

	struct work_struct work;

	struct work_struct work;

	struct work_struct cancellation_work;





	struct usb_ep *ep;

	struct usb_ep *ep;

	struct usb_request *req;

	struct usb_request *req;
@@ -1073,31 +1072,22 @@ ffs_epfile_open(struct inode *inode, struct file *file) 
	return 0;

	return 0;

}

}





static void ffs_aio_cancel_worker(struct work_struct *work)

{

	struct ffs_io_data *io_data = container_of(work, struct ffs_io_data,

						   cancellation_work);



	ENTER();



	usb_ep_dequeue(io_data->ep, io_data->req);

}



static int ffs_aio_cancel(struct kiocb *kiocb)

static int ffs_aio_cancel(struct kiocb *kiocb)

{

{

	struct ffs_io_data *io_data = kiocb->private;

	struct ffs_io_data *io_data = kiocb->private;

	struct ffs_data *ffs = io_data->ffs;

	struct ffs_epfile *epfile = kiocb->ki_filp->private_data;

	int value;

	int value;





	ENTER();

	ENTER();





	if (likely(io_data && io_data->ep && io_data->req)) {

	spin_lock_irq(&epfile->ffs->eps_lock);

		INIT_WORK(&io_data->cancellation_work, ffs_aio_cancel_worker);



		queue_work(ffs->io_completion_wq, &io_data->cancellation_work);

	if (likely(io_data && io_data->ep && io_data->req))

		value = -EINPROGRESS;

		value = usb_ep_dequeue(io_data->ep, io_data->req);

	} else {

	else

		value = -EINVAL;

		value = -EINVAL;

	}



	spin_unlock_irq(&epfile->ffs->eps_lock);





	return value;

	return value;

}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE