Hi Chenyuan, On 30/01/2024 15:35, Hans Verkuil wrote: > On 29/01/2024 04:03, Yang, Chenyuan wrote: >> Hi Hans, >> >> Thanks a lot for this new patch! >> >> After applying this new patch in the latest kernel (hash: ecb1b8288dc7ccbdcb3b9df005fa1c0e0c0388a7) and fuzzing with Syzkaller, it seems that the hang still exists. >> To help you better debug it, I attached the covered lines for the fuzz testing and the output of `git diff`. Hope this could help you. >> >> By the way, the syscall descriptions for CEC have been merged into the Syzkaller mainstream: https://github.com/google/syzkaller/blob/master/sys/linux/dev_cec.txt. >> >> Let me know if you need further information. >> >> Best, >> Chenyuan > > Here is another patch. This now time outs on all wait_for_completion calls > and reports a WARN_ON and shows additional info. Hopefully this will give me > better insight into what is going on. > > Unfortunately I was unable to reproduce this issue on my VM, so I have to > rely on you to run the test. Did you have time to run the test with this patch? It would be very useful to see the results. Regards, Hans > > Regards, > > Hans > > [PATCH] Test > > Signed-off-by: Hans Verkuil <hverkuil-cisco@xxxxxxxxx> > --- > diff --git a/drivers/media/cec/core/cec-adap.c b/drivers/media/cec/core/cec-adap.c > index 5741adf09a2e..b1951eb7f5bd 100644 > --- a/drivers/media/cec/core/cec-adap.c > +++ b/drivers/media/cec/core/cec-adap.c > @@ -935,9 +935,12 @@ int cec_transmit_msg_fh(struct cec_adapter *adap, struct cec_msg *msg, > * Release the lock and wait, retake the lock afterwards. > */ > mutex_unlock(&adap->lock); > - wait_for_completion_killable(&data->c); > - if (!data->completed) > - cancel_delayed_work_sync(&data->work); > + if (WARN_ON(wait_for_completion_killable_timeout(&data->c, msecs_to_jiffies(adap->xfer_timeout_ms + 1000)) <= 0)) { > + dprintk(0, "wfc1: %px %d%d%d%d %x\n", adap->kthread_config, > + adap->is_configuring, adap->is_configured, > + adap->is_enabled, adap->must_reconfigure, adap->phys_addr); > + } > + cancel_delayed_work_sync(&data->work); > mutex_lock(&adap->lock); > > /* Cancel the transmit if it was interrupted */ > @@ -1563,10 +1566,12 @@ static int cec_config_thread_func(void *arg) > cec_transmit_msg_fh(adap, &msg, NULL, false); > } > } > + mutex_unlock(&adap->lock); > + call_void_op(adap, configured); > + mutex_lock(&adap->lock); > adap->kthread_config = NULL; > complete(&adap->config_completion); > mutex_unlock(&adap->lock); > - call_void_op(adap, configured); > return 0; > > unconfigure: > @@ -1592,6 +1597,17 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) > if (WARN_ON(adap->is_configuring || adap->is_configured)) > return; > > + if (adap->kthread_config) { > + mutex_unlock(&adap->lock); > +// wait_for_completion(&adap->config_completion); > + if (WARN_ON(wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) { > + dprintk(0, "wfc2: %px %d%d%d%d %x\n", adap->kthread_config, > + adap->is_configuring, adap->is_configured, > + adap->is_enabled, adap->must_reconfigure, adap->phys_addr); > + } > + mutex_lock(&adap->lock); > + } > + > init_completion(&adap->config_completion); > > /* Ready to kick off the thread */ > @@ -1599,11 +1615,17 @@ static void cec_claim_log_addrs(struct cec_adapter *adap, bool block) > adap->kthread_config = kthread_run(cec_config_thread_func, adap, > "ceccfg-%s", adap->name); > if (IS_ERR(adap->kthread_config)) { > - adap->kthread_config = NULL; > adap->is_configuring = false; > + adap->kthread_config = NULL; > } else if (block) { > mutex_unlock(&adap->lock); > - wait_for_completion(&adap->config_completion); > + //wait_for_completion(&adap->config_completion); > + if (WARN_ON(wait_for_completion_killable_timeout(&adap->config_completion, msecs_to_jiffies(10000)) <= 0)) { > + dprintk(0, "wfc3: %px %d%d%d%d %x\n", adap->kthread_config, > + adap->is_configuring, adap->is_configured, > + adap->is_enabled, adap->must_reconfigure, adap->phys_addr); > + > + } > mutex_lock(&adap->lock); > } > } > diff --git a/drivers/media/cec/core/cec-api.c b/drivers/media/cec/core/cec-api.c > index 67dc79ef1705..d64bb716f9c6 100644 > --- a/drivers/media/cec/core/cec-api.c > +++ b/drivers/media/cec/core/cec-api.c > @@ -664,6 +664,8 @@ static int cec_release(struct inode *inode, struct file *filp) > list_del_init(&data->xfer_list); > } > mutex_unlock(&adap->lock); > + > + mutex_lock(&fh->lock); > while (!list_empty(&fh->msgs)) { > struct cec_msg_entry *entry = > list_first_entry(&fh->msgs, struct cec_msg_entry, list); > @@ -681,6 +683,7 @@ static int cec_release(struct inode *inode, struct file *filp) > kfree(entry); > } > } > + mutex_unlock(&fh->lock); > kfree(fh); > > cec_put_device(devnode); >
