From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: Line6 podstudio UX1 - driver crash on usb_hcd_map_urb_for_dma From: Greg Kroah-Hartman Message-Id: <20190427180728.GA3200@kroah.com> Date: Sat, 27 Apr 2019 20:07:28 +0200 To: Alan Stern Cc: Christo Gouws , linux-usb@vger.kernel.org List-ID: T24gU2F0LCBBcHIgMjcsIDIwMTkgYXQgMTE6MzQ6MDNBTSAtMDQwMCwgQWxhbiBTdGVybiB3cm90 ZToKPiBPbiBTYXQsIDI3IEFwciAyMDE5LCBHcmVnIEtIIHdyb3RlOgo+IAo+ID4gT24gRnJpLCBB cHIgMjYsIDIwMTkgYXQgMTE6NTA6MTRBTSArMDIwMCwgQ2hyaXN0byBHb3V3cyB3cm90ZToKPiA+ ID4gSGksCj4gPiA+IAo+ID4gPiBJIGhhdmUgYSBMaW5lNiBQb2QgU3R1ZGlvIFVYMSBjYXJkLCBi dXQgZWFjaCB0aW1lIEkgcGx1ZyBpdCBpbiwgSSBnZXQKPiA+ID4gdGhlIGZvbGxvd2luZyBjcmFz aCBpbiBkbWVzZyBvbiBVYnVudHUgMTguMDQKPiA+ID4gTGludXggbXktcGMgNC4yMC44LTA0MjAw OC1nZW5lcmljICMyMDE5MDIxMjE1NDQgU01QIFR1ZSBGZWIgMTIKPiA+ID4gMjA6NDY6NTAgVVRD IDIwMTkgeDg2XzY0IHg4Nl82NCB4ODZfNjQgR05VL0xpbnV4Cj4gPiA+IAo+ID4gPiBJJ3ZlIGFs c28gdGVzdGVkIHRoaXMgd2l0aCBhIEZlZG9yYSAzMCB2NS4wLjYtMzAwIGtlcm5lbCwgYnV0IHN0 aWxsCj4gPiA+IHNlZW1zIHRvIGhhcHBlbiAodXNpbmcgbGl2ZUNEKS4KPiA+ID4gCj4gPiA+IAo+ ID4gPiBUaGUgb3V0cHV0IG9uIHRoZSBjYXJkIHNlZW1zIHRvIHdvcmssIGJ1dCBub25lIG9mIHRo ZSBpbnB1dHMgd29yay4KPiA+ID4gCj4gPiA+IEkndmUgYWxzbyBub3cgdGVzdGVkIHdpdGggbGF0 ZXN0IGtlcm5lbCBhdmFpbGFibGUgb24gQXJjaCBMaW51eAo+ID4gPiBMaW51eCBteS1wYyA1LjAu OS1hcmNoMS0xLUFSQ0ggIzEgU01QIFBSRUVNUFQgU2F0IEFwciAyMCAxNTowMDo0NiBVVEMKPiA+ ID4gMjAxOSB4ODZfNjQgR05VL0xpbnV4Cj4gPiA+IAo+ID4gPiBBZnRlciBzb21lIGZ1cnRoZXIg dGVzdGluZywgSSBmb3VuZCB0aGF0IHRoaXMgaXNzdWUgY3JvcHBlZCBpbiBiZXdlZW4KPiA+ID4g djQuOC4xNyBhbmQgdjQuOS1yYzEuCj4gPiA+IAo+ID4gPiB2NC44LjE3ICAgLSBXb3JrcyBmaW5l Lgo+ID4gPiB2NC45LXJjMSsgIC0gUHJvZHVjZXMgY3Jhc2gKPiA+IAo+ID4gQW55IGNoYW5jZSB5 b3UgY2FuIHVzZSAnZ2l0IGJpc2VjdCcgdG8gZmluZCB0aGUgZXhhY3QgY29tbWl0IHRoYXQgY2F1 c2VkCj4gPiB0aGUgZmFpbHVyZT8KPiAKPiBObyBuZWVkLiAgVGhlIGJ1ZyBpcyBpbiBsaW5lNl9y ZWFkX2RhdGEoKSBpbiBzb3VuZC91c2IvbGluZTYvZHJpdmVyLmMuICAKPiBUaGF0IHJvdXRpbmUg cGFzc2VzIGFuIGludmFsaWQgYnVmZmVyIHRvIHVzYl9jb250cm9sX21lc3NhZ2UoKS4gIAo+IElu c3RlYWQgaXQgc2hvdWxkIGFsbG9jYXRlIGl0cyBvd24gYnVmZmVyIGZvciB0aGUgVVNCIHRyYW5z ZmVyIGFuZCB0aGVuCj4gY29weSB0aGUgdmFsdWUgdG8gdGhlIGNhbGxlcidzIGJ1ZmZlci4KPiAK PiBUaGVyZSBpcyBhIHNpbWlsYXIgcHJvYmxlbSBpbiBsaW5lNl93cml0ZV9kYXRhKCkuICBGdXJ0 aGVybW9yZSwgYm90aAo+IHJvdXRpbmVzIGRvIERNQSB0by9mcm9tIGEgYnVmZmVyIG9uIHRoZSBz dGFjay4KCkkgaGF2ZSBhbiBvbGQgcGF0Y2ggaW4gbXkgbG9jYWwgdHJlZSBmb3IgdGhlIGRtYSBi dWZmZXIgb24gdGhlIHN0YWNrCmlzc3VlLCBpdCdzIGJlbG93LiAgSSBzaG91bGQgY2xlYW4gaXQg dXAgYW5kIHNlbmQgaXQgY29ycmVjdGx5IG9uZSBvZgp0aGVzZSBkYXlzIDopCgpGcm9tIGUyYzc0 M2QxZjkwMDEzNWMzZTU2MGNkOWVhMTY0N2U0YTFlYmNlN2EgTW9uIFNlcCAxNyAwMDowMDowMCAy MDAxCkZyb206IEdyZWcgS3JvYWgtSGFydG1hbiA8Z3JlZ2toQGxpbnV4Zm91bmRhdGlvbi5vcmc+ CkRhdGU6IFdlZCwgMjMgSmFuIDIwMTkgMTE6MDE6NDYgKzAxMDAKU3ViamVjdDogW1BBVENIIDMv M10gdG9uZXBvcnQgZml4ZXMKLS0tCiBzb3VuZC91c2IvbGluZTYvdG9uZXBvcnQuYyB8ICAgMjMg KysrKysrKysrKysrKysrKystLS0tLS0KIDEgZmlsZSBjaGFuZ2VkLCAxNyBpbnNlcnRpb25zKCsp LCA2IGRlbGV0aW9ucygtKQoKLS0tIGEvc291bmQvdXNiL2xpbmU2L3RvbmVwb3J0LmMKKysrIGIv c291bmQvdXNiL2xpbmU2L3RvbmVwb3J0LmMKQEAgLTM2NSwxNiArMzY1LDIxIEBAIHN0YXRpYyBi b29sIHRvbmVwb3J0X2hhc19zb3VyY2Vfc2VsZWN0KHMKIC8qCiAJU2V0dXAgVG9uZXBvcnQgZGV2 aWNlLgogKi8KLXN0YXRpYyB2b2lkIHRvbmVwb3J0X3NldHVwKHN0cnVjdCB1c2JfbGluZTZfdG9u ZXBvcnQgKnRvbmVwb3J0KQorc3RhdGljIGludCB0b25lcG9ydF9zZXR1cChzdHJ1Y3QgdXNiX2xp bmU2X3RvbmVwb3J0ICp0b25lcG9ydCkKIHsKLQl1MzIgdGlja3M7CisJdTMyICp0aWNrczsKIAlz dHJ1Y3QgdXNiX2xpbmU2ICpsaW5lNiA9ICZ0b25lcG9ydC0+bGluZTY7CiAJc3RydWN0IHVzYl9k ZXZpY2UgKnVzYmRldiA9IGxpbmU2LT51c2JkZXY7CiAKKwl0aWNrcyA9IGttYWxsb2Moc2l6ZW9m KCp0aWNrcyksIEdGUF9LRVJORUwpOworCWlmICghdGlja3MpCisJCXJldHVybiAtRU5PTUVNOwor CiAJLyogc3luYyB0aW1lIG9uIGRldmljZSB3aXRoIGhvc3Q6ICovCiAJLyogbm90ZTogMzItYml0 IHRpbWVzdGFtcHMgb3ZlcmZsb3cgaW4geWVhciAyMTA2ICovCi0JdGlja3MgPSAodTMyKWt0aW1l X2dldF9yZWFsX3NlY29uZHMoKTsKLQlsaW5lNl93cml0ZV9kYXRhKGxpbmU2LCAweDgwYzYsICZ0 aWNrcywgNCk7CisJKnRpY2tzID0gKHUzMilrdGltZV9nZXRfcmVhbF9zZWNvbmRzKCk7CisJbGlu ZTZfd3JpdGVfZGF0YShsaW5lNiwgMHg4MGM2LCB0aWNrcywgNCk7CisJa2ZyZWUodGlja3MpOwog CiAJLyogZW5hYmxlIGRldmljZTogKi8KIAl0b25lcG9ydF9zZW5kX2NtZCh1c2JkZXYsIDB4MDMw MSwgMHgwMDAwKTsKQEAgLTQ1MSw3ICs0NTYsOSBAQCBzdGF0aWMgaW50IHRvbmVwb3J0X2luaXQo c3RydWN0IHVzYl9saW5lCiAJCQlyZXR1cm4gZXJyOwogCX0KIAotCXRvbmVwb3J0X3NldHVwKHRv bmVwb3J0KTsKKwllcnIgPSB0b25lcG9ydF9zZXR1cCh0b25lcG9ydCk7CisJaWYgKGVycikKKwkJ cmV0dXJuIGVycjsKIAogCS8qIHJlZ2lzdGVyIGF1ZGlvIHN5c3RlbTogKi8KIAlyZXR1cm4gc25k X2NhcmRfcmVnaXN0ZXIobGluZTYtPmNhcmQpOwpAQCAtNDYzLDcgKzQ3MCwxMSBAQCBzdGF0aWMg aW50IHRvbmVwb3J0X2luaXQoc3RydWN0IHVzYl9saW5lCiAqLwogc3RhdGljIGludCB0b25lcG9y dF9yZXNldF9yZXN1bWUoc3RydWN0IHVzYl9pbnRlcmZhY2UgKmludGVyZmFjZSkKIHsKLQl0b25l cG9ydF9zZXR1cCh1c2JfZ2V0X2ludGZkYXRhKGludGVyZmFjZSkpOworCWludCBlcnI7CisKKwll cnIgPSB0b25lcG9ydF9zZXR1cCh1c2JfZ2V0X2ludGZkYXRhKGludGVyZmFjZSkpOworCWlmIChl cnIpCisJCXJldHVybiBlcnI7CiAJcmV0dXJuIGxpbmU2X3Jlc3VtZShpbnRlcmZhY2UpOwogfQog I2VuZGlmCg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS,T_DKIMWL_WL_HIGH, URIBL_BLOCKED,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7874FC43218 for ; Sat, 27 Apr 2019 18:07:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4242A206BF for ; Sat, 27 Apr 2019 18:07:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556388453; bh=wClMBZ3YcjMa7u5TTZCzmTCkx8cl63LWF/q0oiGWg3Y=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=13IDb7ROgdWLu+Sj56KwkYQge3r+aT99QX6ivhP9T9Jy3vD0XtURda+8I3J5wou/s t990r7/ULb5KLEyj54iq2UDOrdVBA2+dojv47AndmyrAuK9mWqlbmeRgW82uh/FP00 waWdVf0kdHoQ6DI6oM3cZPC7ra0D99w4eJnUh8XE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726005AbfD0SHc (ORCPT ); Sat, 27 Apr 2019 14:07:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:42818 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725942AbfD0SHc (ORCPT ); Sat, 27 Apr 2019 14:07:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E7F79206BF; Sat, 27 Apr 2019 18:07:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556388451; bh=wClMBZ3YcjMa7u5TTZCzmTCkx8cl63LWF/q0oiGWg3Y=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=17OCUoiuQCgKQNeL6e7cOeCZNW53K2zrNZ5niv+3PrZEoWS5AoKvtymbp+Yt3Gomf +DnhHbHWVVz45SWfEcQvHPvFHjG627780nynMN/Y3LV7K+lMV8pF8rBHzP6CJ+5llF cs4Se1iKcW4Pa0jdq+OTGhP3hWGCxCqJM4p8rbl0= Date: Sat, 27 Apr 2019 20:07:28 +0200 From: Greg KH To: Alan Stern Cc: Christo Gouws , linux-usb@vger.kernel.org Subject: Re: Line6 podstudio UX1 - driver crash on usb_hcd_map_urb_for_dma Message-ID: <20190427180728.GA3200@kroah.com> References: <20190427070136.GE28250@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.4 (2019-03-13) Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Message-ID: <20190427180728.VPyWmSZmHLGScpVlr97lSk-trwGUVxGQrUIXcD-kpDY@z> On Sat, Apr 27, 2019 at 11:34:03AM -0400, Alan Stern wrote: > On Sat, 27 Apr 2019, Greg KH wrote: > > > On Fri, Apr 26, 2019 at 11:50:14AM +0200, Christo Gouws wrote: > > > Hi, > > > > > > I have a Line6 Pod Studio UX1 card, but each time I plug it in, I get > > > the following crash in dmesg on Ubuntu 18.04 > > > Linux my-pc 4.20.8-042008-generic #201902121544 SMP Tue Feb 12 > > > 20:46:50 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux > > > > > > I've also tested this with a Fedora 30 v5.0.6-300 kernel, but still > > > seems to happen (using liveCD). > > > > > > > > > The output on the card seems to work, but none of the inputs work. > > > > > > I've also now tested with latest kernel available on Arch Linux > > > Linux my-pc 5.0.9-arch1-1-ARCH #1 SMP PREEMPT Sat Apr 20 15:00:46 UTC > > > 2019 x86_64 GNU/Linux > > > > > > After some further testing, I found that this issue cropped in beween > > > v4.8.17 and v4.9-rc1. > > > > > > v4.8.17 - Works fine. > > > v4.9-rc1+ - Produces crash > > > > Any chance you can use 'git bisect' to find the exact commit that caused > > the failure? > > No need. The bug is in line6_read_data() in sound/usb/line6/driver.c. > That routine passes an invalid buffer to usb_control_message(). > Instead it should allocate its own buffer for the USB transfer and then > copy the value to the caller's buffer. > > There is a similar problem in line6_write_data(). Furthermore, both > routines do DMA to/from a buffer on the stack. I have an old patch in my local tree for the dma buffer on the stack issue, it's below. I should clean it up and send it correctly one of these days :) >From e2c743d1f900135c3e560cd9ea1647e4a1ebce7a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 23 Jan 2019 11:01:46 +0100 Subject: [PATCH 3/3] toneport fixes --- sound/usb/line6/toneport.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) --- a/sound/usb/line6/toneport.c +++ b/sound/usb/line6/toneport.c @@ -365,16 +365,21 @@ static bool toneport_has_source_select(s /* Setup Toneport device. */ -static void toneport_setup(struct usb_line6_toneport *toneport) +static int toneport_setup(struct usb_line6_toneport *toneport) { - u32 ticks; + u32 *ticks; struct usb_line6 *line6 = &toneport->line6; struct usb_device *usbdev = line6->usbdev; + ticks = kmalloc(sizeof(*ticks), GFP_KERNEL); + if (!ticks) + return -ENOMEM; + /* sync time on device with host: */ /* note: 32-bit timestamps overflow in year 2106 */ - ticks = (u32)ktime_get_real_seconds(); - line6_write_data(line6, 0x80c6, &ticks, 4); + *ticks = (u32)ktime_get_real_seconds(); + line6_write_data(line6, 0x80c6, ticks, 4); + kfree(ticks); /* enable device: */ toneport_send_cmd(usbdev, 0x0301, 0x0000); @@ -451,7 +456,9 @@ static int toneport_init(struct usb_line return err; } - toneport_setup(toneport); + err = toneport_setup(toneport); + if (err) + return err; /* register audio system: */ return snd_card_register(line6->card); @@ -463,7 +470,11 @@ static int toneport_init(struct usb_line */ static int toneport_reset_resume(struct usb_interface *interface) { - toneport_setup(usb_get_intfdata(interface)); + int err; + + err = toneport_setup(usb_get_intfdata(interface)); + if (err) + return err; return line6_resume(interface); } #endif