Re: [BUG/PATCH] drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue

From: Vladimir Murzin

Date: Wed Sep 09 2026 - 06:40:58 EST

On 9/8/26 19:08, Paul E. McKenney wrote:
> On Mon, Sep 07, 2026 at 02:28:47PM +0100, Vladimir Murzin wrote:
>> On 9/4/26 00:59, Paul E. McKenney wrote:
>>> This is more bug report than patch, but this patch does suppress the
>>> splat, so there is that. ;-)
>>>
>>> Kernels built with either KASAN or KCSAN produce this splat:
>>>
>> I see it on kernel w/o KASAN or KCSAN. IIUC, this is new check introduced
>> by b5cc230af5e5 ("tracing: Warn when an event dereferences a pointer in TP_printk()")
>> so adding Steven :)
>>
>>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
>>> [ 0.000000] ------------[ cut here ]------------
>>> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
>>> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
>>> [ 0.000000] Modules linked in:
>>> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
>>> [ 0.000000] Hardware name: linux,dummy-virt (DT)
>>> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
>>> [ 0.000000] pc : test_double_dereference+0x144/0x14c
>>> [ 0.000000] lr : test_double_dereference+0x144/0x14c
>>> [ 0.000000] sp : ffffc80aa7633bf0
>>> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
>>> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
>>> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
>>> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
>>> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
>>> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
>>> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
>>> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
>>> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
>>> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
>>> [ 0.000000] Call trace:
>>> [ 0.000000] test_double_dereference+0x144/0x14c (P)
>>> [ 0.000000] trace_event_raw_init+0x37c/0x5d8
>>> [ 0.000000] event_init+0x34/0xc0
>>> [ 0.000000] trace_event_init+0xec/0x588
>>> [ 0.000000] trace_init+0x24/0x6e0
>>> [ 0.000000] start_kernel+0x4a0/0x8ec
>>> [ 0.000000] __primary_switched+0x88/0x90
>>> [ 0.000000] irq event stamp: 0
>>> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
>>> [ 0.000000] ---[ end trace 0000000000000000 ]---
>>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
>>> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
>>>
>>> Apparently, the code should instead create another entry in
>>> TP_STRUCT__entry(), and do the double-indirection TP_fast_assign() instead
>>> of TP_printk(). But simply removing the offending double indirection
>>> in TP_printk() gets this splat out of the way of other debugging.
>> Indeed, splat has gone after applying the patch.
>>
>> Thanks
>> Vladimir
> Does this less hacky patch do the trick?
>

Not quite :(

> Thanx, Paul
>
> ------------------------------------------------------------------------
>
> commit afda2321e6e93a5bcc28bfb4717fbc3a1768446c
> Author: Paul E. McKenney <paulmck@xxxxxxxxxx>
> Date: Thu Sep 3 16:48:09 2026 -0700
>
> EXP drivers/usb/mtu3: Work around mtu3_log_ep double-indirection issue

What is EXP?

>
> Kernels built with either KASAN or KCSAN produce this splat:
>

Like I said in my other reply I hit the splat with neither KASAN or KCSAN are enabled.

> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] ------------[ cut here ]------------
> [ 0.000000] Event mtu3_gadget_ep_set_halt has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] WARNING: kernel/trace/trace_events.c:420 at test_double_dereference+0x144/0x14c, CPU#0: swapper/0/0
> [ 0.000000] Modules linked in:
> [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1 #15247 PREEMPT
> [ 0.000000] Hardware name: linux,dummy-virt (DT)
> [ 0.000000] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> [ 0.000000] pc : test_double_dereference+0x144/0x14c
> [ 0.000000] lr : test_double_dereference+0x144/0x14c
> [ 0.000000] sp : ffffc80aa7633bf0
> [ 0.000000] x29: ffffc80aa7633bf0 x28: ffffc80aa7c0f047 x27: 000508b58019388f
> [ 0.000000] x26: 0000000000000003 x25: 0000000000000007 x24: ffffc80aa5fceff8
> [ 0.000000] x23: ffffc80aa7c0f05a x22: ffffc80aa64edfe8 x21: ffffc80aa7c0fce8
> [ 0.000000] x20: ffffc80aa7c0f047 x19: 0000000000000013 x18: 0000000000000001
> [ 0.000000] x17: 6572656420656c62 x16: 756f642073616820 x15: 746c61685f746573
> [ 0.000000] x14: 0000000000000000 x13: ffff000139d90000 x12: 0000000000000045
> [ 0.000000] x11: 00000000000000cf x10: ffff00013f546428 x9 : ffff000139d90000
> [ 0.000000] x8 : 3fffffffffffc000 x7 : 0000000000000001 x6 : 0000000000000001
> [ 0.000000] x5 : ffff00013f4e6440 x4 : 0000000000000000 x3 : 0000000000000000
> [ 0.000000] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffffc80aa764a700
> [ 0.000000] Call trace:
> [ 0.000000] test_double_dereference+0x144/0x14c (P)
> [ 0.000000] trace_event_raw_init+0x37c/0x5d8
> [ 0.000000] event_init+0x34/0xc0
> [ 0.000000] trace_event_init+0xec/0x588
> [ 0.000000] trace_init+0x24/0x6e0
> [ 0.000000] start_kernel+0x4a0/0x8ec
> [ 0.000000] __primary_switched+0x88/0x90
> [ 0.000000] irq event stamp: 0
> [ 0.000000] hardirqs last enabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] hardirqs last disabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] softirqs last enabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] softirqs last disabled at (0): [<0000000000000000>] 0x0
> [ 0.000000] ---[ end trace 0000000000000000 ]---
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_disable has double dereference in TP_printk: &REC->gpd_ring->dma
> [ 0.000000] TRACE EVENT ERROR: Event mtu3_gadget_ep_enable has double dereference in TP_printk: &REC->gpd_ring->dma
>
> Therefore, work around this restriction by creating another entry in
> TP_STRUCT__entry(), and do the double-indirection TP_fast_assign()
> instead of TP_printk().
>
> Signed-off-by: Paul E. McKenney <paulmck@xxxxxxxxxx>
> Cc: Chunfeng Yun <chunfeng.yun@xxxxxxxxxxxx>
> Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Cc: <linux-usb@xxxxxxxxxxxxxxx>
> Cc: <linux-arm-kernel@xxxxxxxxxxxxxxxxxxx>
> Cc: <linux-mediatek@xxxxxxxxxxxxxxxxxxx>
>
> diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
> index 89870175d63561..6477ad3ddc66f6 100644
> --- a/drivers/usb/mtu3/mtu3_trace.h
> +++ b/drivers/usb/mtu3/mtu3_trace.h
> @@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __field(unsigned int, flags)
> __field(unsigned int, direction)
> __field(struct mtu3_gpd_ring *, gpd_ring)
> + __field(dma_addr_t *, gpd_ring_dma)
> ),
> TP_fast_assign(
> __assign_str(name);
> @@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
> __entry->flags = mep->flags;
> __entry->direction = mep->is_in;
> __entry->gpd_ring = &mep->gpd_ring;
> + __entry->gpd_ring_dma = &mep->gpd_ring->dma;

This doesn't build for me

./drivers/usb/mtu3/./mtu3_trace.h:239:55: error: invalid type argument of ‘->’ (have ‘struct mtu3_gpd_ring’)
239 | __entry->gpd_ring_dma = &mep->gpd_ring->dma;
| ^~

> ),
> TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
> __get_str(name), usb_ep_type_string(__entry->type),
> __entry->maxp, __entry->slot,
> __entry->mult, __entry->maxburst,
> - __entry->gpd_ring, &__entry->gpd_ring->dma,
> + __entry->gpd_ring, __entry->gpd_ring_dma,
> __entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
> __entry->flags & MTU3_EP_STALL ? 'S' : 's',
> __entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',
>

I've done a little bit massaging and here is what worked for me

diff --git a/drivers/usb/mtu3/mtu3_trace.h b/drivers/usb/mtu3/mtu3_trace.h
index 89870175d635..4d4bae25fa1f 100644
--- a/drivers/usb/mtu3/mtu3_trace.h
+++ b/drivers/usb/mtu3/mtu3_trace.h
@@ -224,6 +224,7 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__field(unsigned int, flags)
__field(unsigned int, direction)
__field(struct mtu3_gpd_ring *, gpd_ring)
+ __field(dma_addr_t, gpd_ring_dma)
),
TP_fast_assign(
__assign_str(name);
@@ -235,12 +236,13 @@ DECLARE_EVENT_CLASS(mtu3_log_ep,
__entry->flags = mep->flags;
__entry->direction = mep->is_in;
__entry->gpd_ring = &mep->gpd_ring;
+ __entry->gpd_ring_dma = mep->gpd_ring.dma;
),
TP_printk("%s: type %s maxp %d slot %d mult %d burst %d ring %p/%pad flags %c:%c%c%c:%c",
__get_str(name), usb_ep_type_string(__entry->type),
__entry->maxp, __entry->slot,
__entry->mult, __entry->maxburst,
- __entry->gpd_ring, &__entry->gpd_ring->dma,
+ __entry->gpd_ring, &__entry->gpd_ring_dma,
__entry->flags & MTU3_EP_ENABLED ? 'E' : 'e',
__entry->flags & MTU3_EP_STALL ? 'S' : 's',
__entry->flags & MTU3_EP_WEDGE ? 'W' : 'w',

Cheers
Vladimir