All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Christo Gouws <gouws.christo@gmail.com>, linux-usb@vger.kernel.org
Subject: Line6 podstudio UX1 - driver crash on usb_hcd_map_urb_for_dma
Date: Sat, 27 Apr 2019 20:24:32 +0200	[thread overview]
Message-ID: <20190427182432.GA5213@kroah.com> (raw)

On Sat, Apr 27, 2019 at 08:07:28PM +0200, Greg KH wrote:
> On Sat, Apr 27, 2019 at 11:34:03AM -0400, Alan Stern wrote:
> > On Sat, 27 Apr 2019, Greg KH wrote:
> > 
> > > On Fri, Apr 26, 2019 at 11:50:14AM +0200, Christo Gouws wrote:
> > > > Hi,
> > > > 
> > > > I have a Line6 Pod Studio UX1 card, but each time I plug it in, I get
> > > > the following crash in dmesg on Ubuntu 18.04
> > > > Linux my-pc 4.20.8-042008-generic #201902121544 SMP Tue Feb 12
> > > > 20:46:50 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
> > > > 
> > > > I've also tested this with a Fedora 30 v5.0.6-300 kernel, but still
> > > > seems to happen (using liveCD).
> > > > 
> > > > 
> > > > The output on the card seems to work, but none of the inputs work.
> > > > 
> > > > I've also now tested with latest kernel available on Arch Linux
> > > > Linux my-pc 5.0.9-arch1-1-ARCH #1 SMP PREEMPT Sat Apr 20 15:00:46 UTC
> > > > 2019 x86_64 GNU/Linux
> > > > 
> > > > After some further testing, I found that this issue cropped in beween
> > > > v4.8.17 and v4.9-rc1.
> > > > 
> > > > v4.8.17   - Works fine.
> > > > v4.9-rc1+  - Produces crash
> > > 
> > > Any chance you can use 'git bisect' to find the exact commit that caused
> > > the failure?
> > 
> > No need.  The bug is in line6_read_data() in sound/usb/line6/driver.c.  
> > That routine passes an invalid buffer to usb_control_message().  
> > Instead it should allocate its own buffer for the USB transfer and then
> > copy the value to the caller's buffer.
> > 
> > There is a similar problem in line6_write_data().  Furthermore, both
> > routines do DMA to/from a buffer on the stack.
> 
> I have an old patch in my local tree for the dma buffer on the stack
> issue, it's below.  I should clean it up and send it correctly one of
> these days :)

But, in reading your response, it doesn't fix the reported issue here.
Let me go audit the whole driver and fix it up and add it to my original
patch...

WARNING: multiple messages have this Message-ID (diff)
From: Greg KH <gregkh@linuxfoundation.org>
To: Alan Stern <stern@rowland.harvard.edu>
Cc: Christo Gouws <gouws.christo@gmail.com>, linux-usb@vger.kernel.org
Subject: Re: Line6 podstudio UX1 - driver crash on usb_hcd_map_urb_for_dma
Date: Sat, 27 Apr 2019 20:24:32 +0200	[thread overview]
Message-ID: <20190427182432.GA5213@kroah.com> (raw)
Message-ID: <20190427182432.nToR_dLFT5L6J6kZ-w1uulfSvAv31YFhCxsx79ySqRg@z> (raw)
In-Reply-To: <20190427180728.GA3200@kroah.com>

On Sat, Apr 27, 2019 at 08:07:28PM +0200, Greg KH wrote:
> On Sat, Apr 27, 2019 at 11:34:03AM -0400, Alan Stern wrote:
> > On Sat, 27 Apr 2019, Greg KH wrote:
> > 
> > > On Fri, Apr 26, 2019 at 11:50:14AM +0200, Christo Gouws wrote:
> > > > Hi,
> > > > 
> > > > I have a Line6 Pod Studio UX1 card, but each time I plug it in, I get
> > > > the following crash in dmesg on Ubuntu 18.04
> > > > Linux my-pc 4.20.8-042008-generic #201902121544 SMP Tue Feb 12
> > > > 20:46:50 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
> > > > 
> > > > I've also tested this with a Fedora 30 v5.0.6-300 kernel, but still
> > > > seems to happen (using liveCD).
> > > > 
> > > > 
> > > > The output on the card seems to work, but none of the inputs work.
> > > > 
> > > > I've also now tested with latest kernel available on Arch Linux
> > > > Linux my-pc 5.0.9-arch1-1-ARCH #1 SMP PREEMPT Sat Apr 20 15:00:46 UTC
> > > > 2019 x86_64 GNU/Linux
> > > > 
> > > > After some further testing, I found that this issue cropped in beween
> > > > v4.8.17 and v4.9-rc1.
> > > > 
> > > > v4.8.17   - Works fine.
> > > > v4.9-rc1+  - Produces crash
> > > 
> > > Any chance you can use 'git bisect' to find the exact commit that caused
> > > the failure?
> > 
> > No need.  The bug is in line6_read_data() in sound/usb/line6/driver.c.  
> > That routine passes an invalid buffer to usb_control_message().  
> > Instead it should allocate its own buffer for the USB transfer and then
> > copy the value to the caller's buffer.
> > 
> > There is a similar problem in line6_write_data().  Furthermore, both
> > routines do DMA to/from a buffer on the stack.
> 
> I have an old patch in my local tree for the dma buffer on the stack
> issue, it's below.  I should clean it up and send it correctly one of
> these days :)

But, in reading your response, it doesn't fix the reported issue here.
Let me go audit the whole driver and fix it up and add it to my original
patch...


             reply	other threads:[~2019-04-27 18:24 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-27 18:24 Greg Kroah-Hartman [this message]
2019-04-27 18:24 ` Line6 podstudio UX1 - driver crash on usb_hcd_map_urb_for_dma Greg KH
  -- strict thread matches above, loose matches on Subject: below --
2019-04-28 16:00 Greg Kroah-Hartman
2019-04-28 16:00 ` Greg KH
2019-04-28 10:50 Christo Gouws
2019-04-28 10:50 ` Christo Gouws
2019-04-27 18:42 Greg Kroah-Hartman
2019-04-27 18:42 ` Greg KH
2019-04-27 18:07 Greg Kroah-Hartman
2019-04-27 18:07 ` Greg KH
2019-04-26  9:50 Christo Gouws
2019-04-27  7:01 ` Greg KH
2019-04-27 15:34   ` Alan Stern

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190427182432.GA5213@kroah.com \
    --to=gregkh@linuxfoundation.org \
    --cc=gouws.christo@gmail.com \
    --cc=linux-usb@vger.kernel.org \
    --cc=stern@rowland.harvard.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.