From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: Line6 podstudio UX1 - driver crash on usb_hcd_map_urb_for_dma From: Greg Kroah-Hartman Message-Id: <20190427182432.GA5213@kroah.com> Date: Sat, 27 Apr 2019 20:24:32 +0200 To: Alan Stern Cc: Christo Gouws , linux-usb@vger.kernel.org List-ID: T24gU2F0LCBBcHIgMjcsIDIwMTkgYXQgMDg6MDc6MjhQTSArMDIwMCwgR3JlZyBLSCB3cm90ZToK PiBPbiBTYXQsIEFwciAyNywgMjAxOSBhdCAxMTozNDowM0FNIC0wNDAwLCBBbGFuIFN0ZXJuIHdy b3RlOgo+ID4gT24gU2F0LCAyNyBBcHIgMjAxOSwgR3JlZyBLSCB3cm90ZToKPiA+IAo+ID4gPiBP biBGcmksIEFwciAyNiwgMjAxOSBhdCAxMTo1MDoxNEFNICswMjAwLCBDaHJpc3RvIEdvdXdzIHdy b3RlOgo+ID4gPiA+IEhpLAo+ID4gPiA+IAo+ID4gPiA+IEkgaGF2ZSBhIExpbmU2IFBvZCBTdHVk aW8gVVgxIGNhcmQsIGJ1dCBlYWNoIHRpbWUgSSBwbHVnIGl0IGluLCBJIGdldAo+ID4gPiA+IHRo ZSBmb2xsb3dpbmcgY3Jhc2ggaW4gZG1lc2cgb24gVWJ1bnR1IDE4LjA0Cj4gPiA+ID4gTGludXgg bXktcGMgNC4yMC44LTA0MjAwOC1nZW5lcmljICMyMDE5MDIxMjE1NDQgU01QIFR1ZSBGZWIgMTIK PiA+ID4gPiAyMDo0Njo1MCBVVEMgMjAxOSB4ODZfNjQgeDg2XzY0IHg4Nl82NCBHTlUvTGludXgK PiA+ID4gPiAKPiA+ID4gPiBJJ3ZlIGFsc28gdGVzdGVkIHRoaXMgd2l0aCBhIEZlZG9yYSAzMCB2 NS4wLjYtMzAwIGtlcm5lbCwgYnV0IHN0aWxsCj4gPiA+ID4gc2VlbXMgdG8gaGFwcGVuICh1c2lu ZyBsaXZlQ0QpLgo+ID4gPiA+IAo+ID4gPiA+IAo+ID4gPiA+IFRoZSBvdXRwdXQgb24gdGhlIGNh cmQgc2VlbXMgdG8gd29yaywgYnV0IG5vbmUgb2YgdGhlIGlucHV0cyB3b3JrLgo+ID4gPiA+IAo+ ID4gPiA+IEkndmUgYWxzbyBub3cgdGVzdGVkIHdpdGggbGF0ZXN0IGtlcm5lbCBhdmFpbGFibGUg b24gQXJjaCBMaW51eAo+ID4gPiA+IExpbnV4IG15LXBjIDUuMC45LWFyY2gxLTEtQVJDSCAjMSBT TVAgUFJFRU1QVCBTYXQgQXByIDIwIDE1OjAwOjQ2IFVUQwo+ID4gPiA+IDIwMTkgeDg2XzY0IEdO VS9MaW51eAo+ID4gPiA+IAo+ID4gPiA+IEFmdGVyIHNvbWUgZnVydGhlciB0ZXN0aW5nLCBJIGZv dW5kIHRoYXQgdGhpcyBpc3N1ZSBjcm9wcGVkIGluIGJld2Vlbgo+ID4gPiA+IHY0LjguMTcgYW5k IHY0LjktcmMxLgo+ID4gPiA+IAo+ID4gPiA+IHY0LjguMTcgICAtIFdvcmtzIGZpbmUuCj4gPiA+ ID4gdjQuOS1yYzErICAtIFByb2R1Y2VzIGNyYXNoCj4gPiA+IAo+ID4gPiBBbnkgY2hhbmNlIHlv dSBjYW4gdXNlICdnaXQgYmlzZWN0JyB0byBmaW5kIHRoZSBleGFjdCBjb21taXQgdGhhdCBjYXVz ZWQKPiA+ID4gdGhlIGZhaWx1cmU/Cj4gPiAKPiA+IE5vIG5lZWQuICBUaGUgYnVnIGlzIGluIGxp bmU2X3JlYWRfZGF0YSgpIGluIHNvdW5kL3VzYi9saW5lNi9kcml2ZXIuYy4gIAo+ID4gVGhhdCBy b3V0aW5lIHBhc3NlcyBhbiBpbnZhbGlkIGJ1ZmZlciB0byB1c2JfY29udHJvbF9tZXNzYWdlKCku ICAKPiA+IEluc3RlYWQgaXQgc2hvdWxkIGFsbG9jYXRlIGl0cyBvd24gYnVmZmVyIGZvciB0aGUg VVNCIHRyYW5zZmVyIGFuZCB0aGVuCj4gPiBjb3B5IHRoZSB2YWx1ZSB0byB0aGUgY2FsbGVyJ3Mg YnVmZmVyLgo+ID4gCj4gPiBUaGVyZSBpcyBhIHNpbWlsYXIgcHJvYmxlbSBpbiBsaW5lNl93cml0 ZV9kYXRhKCkuICBGdXJ0aGVybW9yZSwgYm90aAo+ID4gcm91dGluZXMgZG8gRE1BIHRvL2Zyb20g YSBidWZmZXIgb24gdGhlIHN0YWNrLgo+IAo+IEkgaGF2ZSBhbiBvbGQgcGF0Y2ggaW4gbXkgbG9j YWwgdHJlZSBmb3IgdGhlIGRtYSBidWZmZXIgb24gdGhlIHN0YWNrCj4gaXNzdWUsIGl0J3MgYmVs b3cuICBJIHNob3VsZCBjbGVhbiBpdCB1cCBhbmQgc2VuZCBpdCBjb3JyZWN0bHkgb25lIG9mCj4g dGhlc2UgZGF5cyA6KQoKQnV0LCBpbiByZWFkaW5nIHlvdXIgcmVzcG9uc2UsIGl0IGRvZXNuJ3Qg Zml4IHRoZSByZXBvcnRlZCBpc3N1ZSBoZXJlLgpMZXQgbWUgZ28gYXVkaXQgdGhlIHdob2xlIGRy aXZlciBhbmQgZml4IGl0IHVwIGFuZCBhZGQgaXQgdG8gbXkgb3JpZ2luYWwKcGF0Y2guLi4K From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_PASS,T_DKIMWL_WL_HIGH, USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EE1EC43218 for ; Sat, 27 Apr 2019 18:24:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 19E9F208C2 for ; Sat, 27 Apr 2019 18:24:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556389476; bh=biI+8oUYlCQ0+sKZW1v8XuyCSqLFx0lNAfupWvrpOUY=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=1OiINYtnvcKSYRjD8XSnNUAOc3SFvUuLV544gmO3i79lfWoQQGuI4qlMx/Q3Z9Hbg /tiFlp12EYVuzFVliAlsvHdYT3bfSQoHpIBGOvd+IFHZgPo8GbXmYWMNGomzEwmg1M tJrYrUq2nNtUtrViSAVFGHEwsXimlEgnId2Pfgk4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726066AbfD0SYf (ORCPT ); Sat, 27 Apr 2019 14:24:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:45492 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725942AbfD0SYf (ORCPT ); Sat, 27 Apr 2019 14:24:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 784332087E; Sat, 27 Apr 2019 18:24:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1556389474; bh=biI+8oUYlCQ0+sKZW1v8XuyCSqLFx0lNAfupWvrpOUY=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=b/mmJwbUFeSurCSAO38uHmRk2pjs7pmFO1625IPAkRmh1kWJ+nH1aOuRKy4tY5biU zEHXuu1qB4vL8ENIry5vNk4cm0BMlFfM8L2k8MADmWGy/raxzzUkVS053WtlTegSzP zSYW3oSzA4RJHe3RU6XjKrGfAIt3dQksk8NAdo/0= Date: Sat, 27 Apr 2019 20:24:32 +0200 From: Greg KH To: Alan Stern Cc: Christo Gouws , linux-usb@vger.kernel.org Subject: Re: Line6 podstudio UX1 - driver crash on usb_hcd_map_urb_for_dma Message-ID: <20190427182432.GA5213@kroah.com> References: <20190427070136.GE28250@kroah.com> <20190427180728.GA3200@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline In-Reply-To: <20190427180728.GA3200@kroah.com> User-Agent: Mutt/1.11.4 (2019-03-13) Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org Message-ID: <20190427182432.nToR_dLFT5L6J6kZ-w1uulfSvAv31YFhCxsx79ySqRg@z> On Sat, Apr 27, 2019 at 08:07:28PM +0200, Greg KH wrote: > On Sat, Apr 27, 2019 at 11:34:03AM -0400, Alan Stern wrote: > > On Sat, 27 Apr 2019, Greg KH wrote: > > > > > On Fri, Apr 26, 2019 at 11:50:14AM +0200, Christo Gouws wrote: > > > > Hi, > > > > > > > > I have a Line6 Pod Studio UX1 card, but each time I plug it in, I get > > > > the following crash in dmesg on Ubuntu 18.04 > > > > Linux my-pc 4.20.8-042008-generic #201902121544 SMP Tue Feb 12 > > > > 20:46:50 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux > > > > > > > > I've also tested this with a Fedora 30 v5.0.6-300 kernel, but still > > > > seems to happen (using liveCD). > > > > > > > > > > > > The output on the card seems to work, but none of the inputs work. > > > > > > > > I've also now tested with latest kernel available on Arch Linux > > > > Linux my-pc 5.0.9-arch1-1-ARCH #1 SMP PREEMPT Sat Apr 20 15:00:46 UTC > > > > 2019 x86_64 GNU/Linux > > > > > > > > After some further testing, I found that this issue cropped in beween > > > > v4.8.17 and v4.9-rc1. > > > > > > > > v4.8.17 - Works fine. > > > > v4.9-rc1+ - Produces crash > > > > > > Any chance you can use 'git bisect' to find the exact commit that caused > > > the failure? > > > > No need. The bug is in line6_read_data() in sound/usb/line6/driver.c. > > That routine passes an invalid buffer to usb_control_message(). > > Instead it should allocate its own buffer for the USB transfer and then > > copy the value to the caller's buffer. > > > > There is a similar problem in line6_write_data(). Furthermore, both > > routines do DMA to/from a buffer on the stack. > > I have an old patch in my local tree for the dma buffer on the stack > issue, it's below. I should clean it up and send it correctly one of > these days :) But, in reading your response, it doesn't fix the reported issue here. Let me go audit the whole driver and fix it up and add it to my original patch...