stk1160 / ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]

stk1160 / ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]

[Sander Eikelenboom]

Hi,

I'm hitting this warning on boot with a syntek usb video grabber, it's not clear 
to me if it's a driver issue of the stk1160 or a generic ehci issue.

This is with a 3.15-mergewindow kernel (pull of Linus his tree of today). 

--
Sander

[    5.587759] ------------[ cut here ]------------
[    5.591210] WARNING: CPU: 0 PID: 1376 at lib/dma-debug.c:1153 check_for_stack+0xa0/0x100()
[    5.596612] ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]
[    5.602548] Modules linked in:
[    5.605380] CPU: 0 PID: 1376 Comm: khubd Not tainted 3.14.0-security-20140413-v4lall+ #1
[    5.611042] Hardware name: Xen HVM domU, BIOS 4.5-unstable 04/10/2014
[    5.615314]  0000000000000009 ffff88003d0b5348 ffffffff81c516fe ffff88003d0b5390
[    5.622147]  ffff88003d0b5380 ffffffff810e4aa3 ffff88003ceae898 ffff88003cf14070
[    5.628926]  ffff88003d0b56bf ffff88003ceae898 ffffffff8241ab40 ffff88003d0b53e0
[    5.635536] Call Trace:
[    5.638001]  [<ffffffff81c516fe>] dump_stack+0x45/0x56
[    5.641633]  [<ffffffff810e4aa3>] warn_slowpath_common+0x73/0x90
[    5.645688]  [<ffffffff810e4b07>] warn_slowpath_fmt+0x47/0x50
[    5.649843]  [<ffffffff81468820>] check_for_stack+0xa0/0x100
[    5.652420] systemd-udevd[2143]: starting version 204
[    5.657709]  [<ffffffff814699fc>] debug_dma_map_page+0xfc/0x150
[    5.661836]  [<ffffffff8172109c>] usb_hcd_map_urb_for_dma+0x5fc/0x710
[    5.666132]  [<ffffffff817214c5>] usb_hcd_submit_urb+0x315/0xa30
[    5.670247]  [<ffffffff810ef85a>] ? del_timer_sync+0x4a/0x60
[    5.674072]  [<ffffffff81c6291d>] ? schedule_timeout+0x14d/0x1f0
[    5.678083]  [<ffffffff810ef2a0>] ? migrate_timer_list+0x60/0x60
[    5.682167]  [<ffffffff81722fac>] usb_submit_urb+0x30c/0x580
[    5.685989]  [<ffffffff81c63f4b>] ? wait_for_common+0x16b/0x240
[    5.689919]  [<ffffffff817236fa>] usb_start_wait_urb+0x5a/0xe0
[    5.693830]  [<ffffffff811b0000>] ? mpol_rebind_policy+0x30/0xa0
[    5.697638]  [<ffffffff81723838>] usb_control_msg+0xb8/0x100
[    5.701468]  [<ffffffff81984ab2>] stk1160_read_reg+0x52/0x80
[    5.705358]  [<ffffffff8198690c>] stk1160_i2c_busy_wait+0x6c/0x90
[    5.709656]  [<ffffffff81986afb>] stk1160_i2c_xfer+0x1cb/0x440
[    5.713647]  [<ffffffff81126052>] ? irq_to_desc+0x12/0x20
[    5.717515]  [<ffffffff81129329>] ? irq_get_irq_data+0x9/0x10
[    5.721432]  [<ffffffff8178a1ac>] __i2c_transfer+0x5c/0x80
[    5.725783]  [<ffffffff8178b48b>] i2c_transfer+0x5b/0x90
[    5.730187]  [<ffffffff8178b676>] i2c_smbus_xfer_emulated+0x116/0x570
[    5.735194]  [<ffffffff8110f8ce>] ? wake_up_process+0x1e/0x40
[    5.739631]  [<ffffffff81c63f4b>] ? wait_for_common+0x16b/0x240
[    5.744338]  [<ffffffff8111da6f>] ? __wake_up+0x3f/0x50
[    5.748997]  [<ffffffff8178bbc2>] i2c_smbus_xfer+0xf2/0x140
[    5.753538]  [<ffffffff8178bcd3>] i2c_default_probe+0xc3/0x100
[    5.758173]  [<ffffffff8178a586>] ? i2c_check_addr_busy+0x36/0x60
[    5.763227]  [<ffffffff8178a892>] i2c_new_probed_device+0x92/0xe0
[    5.768736]  [<ffffffff8178bc10>] ? i2c_smbus_xfer+0x140/0x140
[    5.774035]  [<ffffffff81844bdf>] v4l2_i2c_new_subdev_board+0x4f/0x100
[    5.779495]  [<ffffffff81844ce8>] v4l2_i2c_new_subdev+0x58/0x70
[    5.784638]  [<ffffffff81984fdf>] stk1160_probe+0x3df/0x4e0
[    5.789553]  [<ffffffff81726dda>] usb_probe_interface+0xca/0x1d0
[    5.794659]  [<ffffffff816408d6>] really_probe+0x56/0x1e0
[    5.799231]  [<ffffffff81640a60>] ? really_probe+0x1e0/0x1e0
[    5.804225]  [<ffffffff81640aa8>] __device_attach+0x48/0x50
[    5.809514]  [<ffffffff8163ecf3>] bus_for_each_drv+0x53/0x90
[    5.814602]  [<ffffffff81640868>] device_attach+0x88/0xa0
[    5.819487]  [<ffffffff8163fe08>] bus_probe_device+0x98/0xc0
[    5.824337]  [<ffffffff8163dfbc>] device_add+0x4bc/0x5c0
[    5.829267]  [<ffffffff81725a15>] usb_set_configuration+0x495/0x7a0
[    5.834590]  [<ffffffff8172eff9>] generic_probe+0x29/0xa0
[    5.839419]  [<ffffffff81725db5>] usb_probe_device+0x15/0x20
[    5.844594]  [<ffffffff816408d6>] really_probe+0x56/0x1e0
[    5.849538]  [<ffffffff81640a60>] ? really_probe+0x1e0/0x1e0
[    5.854444]  [<ffffffff81640aa8>] __device_attach+0x48/0x50
[    5.859393]  [<ffffffff8163ecf3>] bus_for_each_drv+0x53/0x90
[    5.864390]  [<ffffffff81640868>] device_attach+0x88/0xa0
[    5.869408]  [<ffffffff8163fe08>] bus_probe_device+0x98/0xc0
[    5.874652]  [<ffffffff8163dfbc>] device_add+0x4bc/0x5c0
[    5.879185]  [<ffffffff8171aec8>] usb_new_device+0x228/0x390
[    5.884283]  [<ffffffff8171da60>] hub_thread+0xdb0/0x14e0
[    5.888638]  [<ffffffff8110f6f0>] ? try_to_wake_up+0x100/0x2c0
[    5.892802]  [<ffffffff8111dec0>] ? abort_exclusive_wait+0xa0/0xa0
[    5.896554]  [<ffffffff8171ccb0>] ? usb_reset_device+0x180/0x180
[    5.900309]  [<ffffffff81103e3d>] kthread+0xcd/0xf0
[    5.903619]  [<ffffffff81103d70>] ? kthread_create_on_node+0x170/0x170
[    5.908064]  [<ffffffff81c6754c>] ret_from_fork+0x7c/0xb0
[    5.912017]  [<ffffffff81103d70>] ? kthread_create_on_node+0x170/0x170
[    5.916654] ---[ end trace 18f58175dc2f3152 ]---

Re: stk1160 / ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]

[Alan Stern]

On Sun, 13 Apr 2014, Sander Eikelenboom wrote:

> Hi,
> 
> I'm hitting this warning on boot with a syntek usb video grabber, it's not clear 
> to me if it's a driver issue of the stk1160 or a generic ehci issue.

It is a bug in the stk1160 driver.

> This is with a 3.15-mergewindow kernel (pull of Linus his tree of today). 
> 
> --
> Sander
> 
> [    5.587759] ------------[ cut here ]------------
> [    5.591210] WARNING: CPU: 0 PID: 1376 at lib/dma-debug.c:1153 check_for_stack+0xa0/0x100()
> [    5.596612] ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]
> [    5.602548] Modules linked in:
> [    5.605380] CPU: 0 PID: 1376 Comm: khubd Not tainted 3.14.0-security-20140413-v4lall+ #1
> [    5.611042] Hardware name: Xen HVM domU, BIOS 4.5-unstable 04/10/2014
> [    5.615314]  0000000000000009 ffff88003d0b5348 ffffffff81c516fe ffff88003d0b5390
> [    5.622147]  ffff88003d0b5380 ffffffff810e4aa3 ffff88003ceae898 ffff88003cf14070
> [    5.628926]  ffff88003d0b56bf ffff88003ceae898 ffffffff8241ab40 ffff88003d0b53e0
> [    5.635536] Call Trace:
> [    5.638001]  [<ffffffff81c516fe>] dump_stack+0x45/0x56
> [    5.641633]  [<ffffffff810e4aa3>] warn_slowpath_common+0x73/0x90
> [    5.645688]  [<ffffffff810e4b07>] warn_slowpath_fmt+0x47/0x50
> [    5.649843]  [<ffffffff81468820>] check_for_stack+0xa0/0x100
> [    5.652420] systemd-udevd[2143]: starting version 204
> [    5.657709]  [<ffffffff814699fc>] debug_dma_map_page+0xfc/0x150
> [    5.661836]  [<ffffffff8172109c>] usb_hcd_map_urb_for_dma+0x5fc/0x710
> [    5.666132]  [<ffffffff817214c5>] usb_hcd_submit_urb+0x315/0xa30
> [    5.670247]  [<ffffffff810ef85a>] ? del_timer_sync+0x4a/0x60
> [    5.674072]  [<ffffffff81c6291d>] ? schedule_timeout+0x14d/0x1f0
> [    5.678083]  [<ffffffff810ef2a0>] ? migrate_timer_list+0x60/0x60
> [    5.682167]  [<ffffffff81722fac>] usb_submit_urb+0x30c/0x580
> [    5.685989]  [<ffffffff81c63f4b>] ? wait_for_common+0x16b/0x240
> [    5.689919]  [<ffffffff817236fa>] usb_start_wait_urb+0x5a/0xe0
> [    5.693830]  [<ffffffff811b0000>] ? mpol_rebind_policy+0x30/0xa0
> [    5.697638]  [<ffffffff81723838>] usb_control_msg+0xb8/0x100
> [    5.701468]  [<ffffffff81984ab2>] stk1160_read_reg+0x52/0x80
> [    5.705358]  [<ffffffff8198690c>] stk1160_i2c_busy_wait+0x6c/0x90

The bug is here.  stk1160_i2c_busy_wait() passes the address of a   
variable on the stack to stk1160_read_reg(), and that routine passes
the address to usb_control_msg().  But usb_control_msg() requires the
buffer to be allocated by kmalloc, not on the stack.

Alan Stern

Re: stk1160 / ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]

[Ezequiel Garcia]

On Apr 13, Alan Stern wrote:
> On Sun, 13 Apr 2014, Sander Eikelenboom wrote:
> 
> > Hi,
> > 
> > I'm hitting this warning on boot with a syntek usb video grabber, it's not clear 
> > to me if it's a driver issue of the stk1160 or a generic ehci issue.
> 
> It is a bug in the stk1160 driver.
> 

Thanks for pointing this out, I'm on it.
-- 
Ezequiel García, Free Electrons
Embedded Linux, Kernel and Android Engineering
http://free-electrons.com

Re: stk1160 / ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]

[Ezequiel Garcia]

On Apr 13, Sander Eikelenboom wrote:
> 
> I'm hitting this warning on boot with a syntek usb video grabber, it's not clear 
> to me if it's a driver issue of the stk1160 or a generic ehci issue.
> 

Can't reproduce the same warning easily here. Could you test the following patch?

diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c
index 34a26e0..304fdb3 100644
--- a/drivers/media/usb/stk1160/stk1160-core.c
+++ b/drivers/media/usb/stk1160/stk1160-core.c
@@ -71,13 +71,14 @@ int stk1160_read_reg(struct stk1160 *dev, u16 reg, u8 *value)
 	*value = 0;
 	ret = usb_control_msg(dev->udev, pipe, 0x00,
 			USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-			0x00, reg, value, sizeof(u8), HZ);
+			0x00, reg, dev->urb_buf, sizeof(u8), HZ);
 	if (ret < 0) {
 		stk1160_err("read failed on reg 0x%x (%d)\n",
 			reg, ret);
 		return ret;
 	}
 
+	*value = dev->urb_buf[0];
 	return 0;
 }
 
-- 
Ezequiel García, Free Electrons
Embedded Linux, Kernel and Android Engineering
http://free-electrons.com

Re: stk1160 / ehci-pci 0000:00:0a.0: DMA-API: device driver maps memory fromstack [addr=ffff88003d0b56bf]

[Ezequiel Garcia]

On Apr 14, Ezequiel Garcia wrote:
> On Apr 13, Sander Eikelenboom wrote:
> > 
> > I'm hitting this warning on boot with a syntek usb video grabber, it's not clear 
> > to me if it's a driver issue of the stk1160 or a generic ehci issue.
> > 
> 
> Can't reproduce the same warning easily here. Could you test the following patch?
> 

Nevermind, just reproduced the warning. I'll be pushing a fix now.
-- 
Ezequiel García, Free Electrons
Embedded Linux, Kernel and Android Engineering
http://free-electrons.com