Releasing v4l device associated with a UVC gadget causes kernel panic I’ve set up a user-space process on an Android device to stream video frames to a host using the UVC gadget. During testing, I’ve encountered a kernel panic when trying to close the handle to the v4l device. To reproduce, disconnect the USB cable while the gadget is streaming, then when the UVC_EVENT_DISCONNECT event is received, close the v4l handle. Based on the stack trace it seems the kernel pulls the USB gadget down before the user-space code has a chance to close the v4l handle. I believe it’s a race condition as it will sometimes close without error (but that’s infrequent). Here is the trace from the pstore log: <6>[ 48.314715] Call trace: <6>[ 48.317240] usb_gadget_deactivate+0x10/0xfc <6>[ 48.321631] usb_function_deactivate+0x50/0x88 <6>[ 48.326200] uvc_function_disconnect+0x1c/0x44 <6>[ 48.330770] uvc_v4l2_release+0x28/0x80 <6>[ 48.345157] v4l2_release+0x38/0x88 <6>[ 48.348747] __fput+0xb8/0x1a0 <6>[ 48.351892] ____fput+0xc/0x14 <6>[ 48.355037] task_work_run+0x80/0xa0 <6>[ 48.358718] do_notify_resume+0xce0/0x1114 <6>[ 48.362931] work_pending+0x8/0x10 In that function, there is a conditional at the top checking gadget->deactivated and gadget happens to be NULL. I was also able to reproduce the same crash by disconnecting the cable while not streaming if I switch the order of shutting down the gadget and the v4l device. So explicitly pull down the gadget on disconnect, then close the v4l handle after. This results in the same panic and trace. Otherwise, if it closes the v4l handle before pulling the gadget down, everything cleans up without any errors. If anyone has any ideas, I’d appreciate any help. I’m happy to test any patches or provide any additional information that might be useful. Thanks, Nick
