linux-kernel - [bug report] [PATCH v6] net: usb: Convert tasklet API to new bottom half workqueue mechanism

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aGgD_Lp0i-ZU2xkt@pengutronix.de>
Date: Fri, 4 Jul 2025 18:40:28 +0200
From: Oleksij Rempel <o.rempel@...gutronix.de>
To: Jun Miao <jun.miao@...el.com>
Cc: sbhatta@...vell.com, kuba@...nel.org, oneukum@...e.com,
	netdev@...r.kernel.org, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org, qiang.zhang@...ux.dev
Subject: [bug report] [PATCH v6] net: usb: Convert tasklet API to new bottom
 half workqueue mechanism

Hi Jun,

On Wed, Jun 18, 2025 at 01:39:23PM -0400, Jun Miao wrote:
> Migrate tasklet APIs to the new bottom half workqueue mechanism. It
> replaces all occurrences of tasklet usage with the appropriate workqueue
> APIs throughout the usbnet driver. This transition ensures compatibility
> with the latest design and enhances performance.

After applying this patch, the smsc95xx driver fails after one down/up
cycle.
Here is how I can reproduce the issue:

nmcli device set enu1u1 managed no
ip a a 10.10.10.1/24 dev enu1u1
ping -c 4 10.10.10.3
ip l s dev enu1u1 down
ip l s dev enu1u1 up
ping -c 4 10.10.10.3

The second ping does not reach the host. Networking also fails on other
interfaces.

After some delay, the following trace appears:
[  846.838527] INFO: task kworker/u16:1:308 blocked for more than 120 seconds.
[  846.838596]       Not tainted 6.16.0-rc3-00963-g4fcedea9cdf2-dirty #32
[  846.838666] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  846.838697] task:kworker/u16:1   state:D stack:0     pid:308 tgid:308   ppid:2
               task_flags:0x4208060 flags:0x00000010
[  846.838776] Workqueue: events_unbound linkwatch_event
[  846.838851] Call trace:
[  846.838880]  __switch_to+0x1d0/0x330 (T)
[  846.838933]  __schedule+0xa88/0x2a90
[  846.838980]  schedule+0x114/0x428
[  846.839010]  schedule_preempt_disabled+0x80/0x118
[  846.839036]  __mutex_lock+0x764/0xba8
[  846.839060]  mutex_lock_nested+0x28/0x38
[  846.839084]  rtnl_lock+0x20/0x30
[  846.839115]  linkwatch_event+0x18/0x70
[  846.839141]  process_one_work+0x760/0x17b0
[  846.839175]  worker_thread+0x768/0xce8
[  846.839208]  kthread+0x3bc/0x690
[  846.839237]  ret_from_fork+0x10/0x20
[  846.839359] INFO: task kworker/u16:1:308 is blocked on a mutex likely
owned by task ip:899.
[  846.839381] task:ip              state:D stack:0     pid:899
tgid:899   ppid:1      task_flags:0x400100 flags:0x00000019
[  846.839419] Call trace:
[  846.839432]  __switch_to+0x1d0/0x330 (T)
[  846.839466]  __schedule+0xa88/0x2a90
[  846.839495]  schedule+0x114/0x428
[  846.839524]  schedule_timeout+0xec/0x220
[  846.839551]  wait_skb_queue_empty+0xa0/0x168
[  846.839581]  usbnet_terminate_urbs+0x150/0x2c8
[  846.839609]  usbnet_stop+0x41c/0x608
[  846.839636]  __dev_close_many+0x1fc/0x4b8
[  846.839668]  __dev_change_flags+0x33c/0x500
[  846.839694]  netif_change_flags+0x7c/0x158
[  846.839718]  do_setlink.isra.0+0x2040/0x2eb8
[  846.839745]  rtnl_newlink+0xd88/0x16c8
[  846.839770]  rtnetlink_rcv_msg+0x654/0x8c8
[  846.839795]  netlink_rcv_skb+0x19c/0x350
[  846.839823]  rtnetlink_rcv+0x1c/0x30
[  846.839848]  netlink_unicast+0x3c4/0x668
[  846.839873]  netlink_sendmsg+0x620/0xa10
[  846.839899]  ____sys_sendmsg+0x2f8/0x788
[  846.839924]  ___sys_sendmsg+0xf0/0x178
[  846.839950]  __sys_sendmsg+0x104/0x198
[  846.839975]  __arm64_sys_sendmsg+0x74/0xa8
[  846.840000]  el0_svc_common.constprop.0+0xe4/0x338
[  846.840033]  do_el0_svc+0x44/0x60
[  846.840061]  el0_svc+0x3c/0xb0
[  846.840089]  el0t_64_sync_handler+0x104/0x130
[  846.840117]  el0t_64_sync+0x154/0x158
[  846.840164]
[  846.840164] Showing all locks held in the system:
[  846.840199] 1 lock held by khungtaskd/41:
[  846.840216]  #0: ffffffc08424ede0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x14/0x1b0
[  846.840309] 3 locks held by kworker/u16:2/47:
[  846.840325]  #0: ffffff800926a148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x698/0x17b0
[  846.840406]  #1: ffffffc0860f7c00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x6bc/0x17b0
[  846.840484]  #2: ffffffc084924408 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x30
[  846.840568] 2 locks held by pr/ttymxc1/60:
[  846.840595] 5 locks held by sugov:0/84:
[  846.840618] 2 locks held by systemd-journal/124:
[  846.840639] 3 locks held by kworker/u16:1/308:
[  846.840655]  #0: ffffff8005d00148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x698/0x17b0
[  846.840733]  #1: ffffffc087307c00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x6bc/0x17b0
[  846.840810]  #2: ffffffc084924408 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x30
[  846.840894] 1 lock held by ip/899:
[  846.840910]  #0: ffffffc084924408 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5e8/0x16c8
[  846.840982] 2 locks held by sshd/901:
[  846.840998]  #0: ffffff800aee06b0 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0x100/0x800
[  846.841073]  #1: ffffffc084924408 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x128/0x1a8
[  846.841149] 2 locks held by sshd/903:
[  846.841165]  #0: ffffff800b1c76b0 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0x100/0x800
[  846.841237]  #1: ffffffc084924408 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x128/0x1a8

Reverting this patch recovers smsc95xx functionality.

Best Regards,
Oleksij