Re: [PATCH] usb: xhci: check Null pointer in segment alloc

[Michal Pecio <michal.pecio@gmail.com>]

On Wed, 29 Apr 2026 02:50:43 +0000, 胡连勤 wrote:
> Hello  Greg, Mathias Nyman:
> 
> Even after updating the kernel, the issue persists during the wake-up process
> after the device has been put into sleep mode when connected to digital headphones.
> 
> The error message is as follows:
> 
> [465214.519817][T17247] msm-dwc3 a600000.ssusb: [2026-04-26 07:38:16.871288]vusb dbg: [2026-04-26 07:38:16.871288]DWC3 in low power mode
> [465221.257099][T24488] check_valid_request: card#:0 dev#:0 dir:0 en:1 fmt:2 rate:48000 #ch:2
> [465221.259370][T24488] msm-dwc3 a600000.ssusb: [2026-04-26 07:38:23.610842]vusb dbg: [2026-04-26 07:38:23.610842]DWC3 exited from low power mode
> [465221.690852][T24488] usb 1-1: 1:1: cannot get freq at ep 0x3
> [465221.690947][T24488] uaudio_iommu_map: type:0 map pa:0x000000089a6ae000 to iova:0x00001000 size:4096
> [465221.690956][T24488] uaudio_get_iova: exact size: 4096 found
> [465221.690959][T24488] uaudio_get_iova: va:0x00022000 curr_iova:0x00024000 curr_iova_size:4186112
> [465221.690962][T24488] uaudio_iommu_map: type:1 map pa:0x000000091c537000 to iova:0x00022000 size:4096
> [465221.690994][T24488] uaudio_get_iova: exact size: 32768 found
> [465221.690996][T24488] uaudio_get_iova: va:0x00422000 curr_iova:0x00432000 curr_iova_size:4290592768
> [465221.691001][T24488] uaudio_iommu_map: type:2 map pa:0x0000000974e5c000 to iova:0x00422000 len:4096 offset:0
> [465221.691004][T24488] uaudio_iommu_map: type:2 map pa:0x000000092ff0b000 to iova:0x00423000 len:4096 offset:0
> [465221.691008][T24488] uaudio_iommu_map: type:2 map pa:0x00000009086d4000 to iova:0x00424000 len:4096 offset:0
> [465221.691011][T24488] uaudio_iommu_map: type:2 map pa:0x0000000903d42000 to iova:0x00425000 len:4096 offset:0
> [465221.691014][T24488] uaudio_iommu_map: type:2 map pa:0x0000000899f40000 to iova:0x00426000 len:4096 offset:0
> [465221.691017][T24488] uaudio_iommu_map: type:2 map pa:0x000000091c491000 to iova:0x00427000 len:4096 offset:0
> [465221.691020][T24488] uaudio_iommu_map: type:2 map pa:0x0000000899269000 to iova:0x00428000 len:4096 offset:0
> [465221.691023][T24488] uaudio_iommu_map: type:2 map pa:0x000000093b4d3000 to iova:0x00429000 len:4096 offset:0
> [465221.691052][T24488] handle_uaudio_stream_req: ret 0: qmi response latency 433 ms
> [465223.771840][T24494] handle_uaudio_stream_req: sq_node:5 sq_port:207 sq_family:2a
> [465223.771858][T24494] check_valid_request: card#:0 dev#:0 dir:0 en:0 fmt:2 rate:48000 #ch:2
> [465223.827409][T24494] uaudio_put_iova: curr_iova_size 4190208
> [465223.827414][T24494] uaudio_iommu_unmap: type 1: unmap iova 0x00022000 size 4096
> [465223.827425][T24494] uaudio_put_iova: curr_iova_size 4290625536
> [465223.827429][T24494] uaudio_iommu_unmap: type 2: unmap iova 0x00422000 size 32768
> [465223.827463][T24494] handle_uaudio_stream_req: release resources: intf# 1 card# 0
> [465223.827467][T24494] uaudio_dev_release: for dev 0000000000000000
> [465223.827472][T24494] uaudio_iommu_unmap: type 0: unmap iova 0x00001000 size 4096
> [465223.827517][T24494] uaudio_event_ring_cleanup_free: all audio devices disconnected
> [465223.827561][T24494] handle_uaudio_stream_req: ret 0: qmi response latency 55 ms
> [465227.360186][ T3223] android time 2026-04-27 06:38:29.711646
> [465232.791611][T24493] handle_uaudio_stream_req: sq_node:5 sq_port:207 sq_family:2a
> [465232.791615][T24493] check_valid_request: card#:0 dev#:0 dir:0 en:1 fmt:2 rate:48000 #ch:2
> [465233.213670][T24493] uaudio_iommu_map: type:0 map pa:0x000000091094f000 to iova:0x00001000 size:4096
> [465233.213683][T24493] uaudio_get_iova: exact size: 4096 found
> [465233.213686][T24493] uaudio_get_iova: va:0x00022000 curr_iova:0x00024000 curr_iova_size:4186112
> [465233.213689][T24493] uaudio_iommu_map: type:1 map pa:0x000000089a6ae000 to iova:0x00022000 size:4096
> [465233.213712][T24493] uaudio_get_iova: exact size: 32768 found
> [465233.213715][T24493] uaudio_get_iova: va:0x00422000 curr_iova:0x00432000 curr_iova_size:4290592768
> [465233.213720][T24493] uaudio_iommu_map: type:2 map pa:0x0000000968e5f000 to iova:0x00422000 len:4096 offset:0
> [465233.213723][T24493] uaudio_iommu_map: type:2 map pa:0x0000000968e5e000 to iova:0x00423000 len:4096 offset:0
> [465233.213727][T24493] uaudio_iommu_map: type:2 map pa:0x00000008caa58000 to iova:0x00424000 len:4096 offset:0
> [465233.213730][T24493] uaudio_iommu_map: type:2 map pa:0x0000000a91af0000 to iova:0x00425000 len:4096 offset:0
> [465233.213734][T24493] uaudio_iommu_map: type:2 map pa:0x00000009d38c1000 to iova:0x00426000 len:4096 offset:0
> [465233.213737][T24493] uaudio_iommu_map: type:2 map pa:0x00000009e1e05000 to iova:0x00427000 len:4096 offset:0
> [465233.213740][T24493] uaudio_iommu_map: type:2 map pa:0x00000009f8ea4000 to iova:0x00428000 len:4096 offset:0
> [465233.213743][T24493] uaudio_iommu_map: type:2 map pa:0x00000000a7519000 to iova:0x00429000 len:4096 offset:0
> [465233.213791][T24493] handle_uaudio_stream_req: ret 0: qmi response latency 422 ms
> [465248.503579][T24411] usb 1-1: reset full-speed USB device number 2 using xhci-hcd
> [465248.641732][T24411] Unable to handle kernel paging request at virtual address 00000000ef808000
> [...]
> [465248.643670][T24411] Call trace:
> [465248.643673][T24411]  dma_pool_alloc+0x38/0x2a4
> [465248.643684][T24411]  xhci_segment_alloc+0x9c/0x1c4
> [465248.643692][T24411]  xhci_alloc_segments_for_ring+0xbc/0x170
> [465248.643699][T24411]  xhci_ring_alloc+0xb4/0x1f0
> [465248.643705][T24411]  xhci_endpoint_init+0x3b0/0x4bc
> [465248.643711][T24411]  xhci_add_endpoint+0x1a4/0x29c
> [465248.643723][T24411]  usb_hcd_alloc_bandwidth+0x230/0x3d4
> [465248.643729][T24411]  usb_reset_and_verify_device+0x1e0/0x744
> [465248.643741][T24411]  usb_reset_device+0x154/0x23c
> [465248.643756][T24411]  __usb_queue_reset_device+0x3c/0x64
> [465248.643764][T24411]  process_scheduled_works+0x200/0x9d8
> [465248.643772][T24411]  worker_thread+0x154/0x3b4
> [465248.643780][T24411]  kthread+0x11c/0x1a0
> [465248.643791][T24411]  ret_from_fork+0x10/0x20
> [465248.643807][T24411] Code: 942f5097 f9400e76 aa0003e9 b40002f6 (f94002c8) 
> [465248.643812][T24411] ---[ end trace 0000000000000000 ]---

Looks like this time somebody tried to reset a USB device while
the segment pool is destroyed, not created yet or corrupted.

Again, xhci_hcd dynamic debug would show what led to this and
whether the pool was supposed to be ready at that time or not.
The pool should always be ready except during xhci_resume() and
after xhci_stop(), so it's unclear how this happened.

Again, chances are that something is trying to resume USB device
concurrently with its parent host controller.

Regards,
Michal