Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753370AbbBYMvp (ORCPT ); Wed, 25 Feb 2015 07:51:45 -0500 Received: from rtits2.realtek.com ([60.250.210.242]:55809 "EHLO rtits2.realtek.com.tw" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752245AbbBYMvn (ORCPT ); Wed, 25 Feb 2015 07:51:43 -0500 Authenticated-By: X-SpamFilter-By: BOX Solutions SpamTrap 5.52 with qID t1PCpL2N014515, This message is accepted by code: ctloc85258 From: Roger Tseng To: Josh Boyer CC: Wolfram Sang , Lee Jones , "Linux-Kernel@Vger. Kernel. Org" , Wei_wang , Micky Ching Subject: Re: DMA-API backtrace from rtsx_usb_ms driver Thread-Topic: DMA-API backtrace from rtsx_usb_ms driver Thread-Index: AQHQTGVTctynPE+E2kOtwrYPS/mqWZ0A1JoA Date: Wed, 25 Feb 2015 12:51:21 +0000 Message-ID: <1424868680.11407.16.camel@debian-rtk5880> References: In-Reply-To: Accept-Language: en-US, zh-TW Content-Language: zh-TW X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [172.21.81.121] Content-Type: text/plain; charset="utf-8" Content-ID: <00D98C8DCFAA014B93F23304F5191869@realtek.com> MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from base64 to 8bit by nfs id t1PCpoHH026510 Content-Length: 4700 Lines: 101 On Thu, 2015-02-19 at 11:58 -0500, Josh Boyer wrote: > Hi All, > > We've had a few bug reports with the stack trace below. It looks like > the ms_read_bytes and ms_write_bytes functions in > drivers/memstick/host/rtsx_usb_mc.c are using a stack variable when > calling rtsx_usb_ep0_read_register. That eventually gets to the > DMA-API debugging checks, which throws the warning backtrace. > > A typical fix is to replace: > > u8 val; > > rtsx_usb_ep0_read_register(ucr, MS_TRANS_CFG, &val); > dev_dbg(ms_dev(host), "MS_TRANS_CFG: 0x%02x\n", val); > > with something like: > > u8 val = kzalloc(sizeof(u8), GFP_KERNEL); > if (!val) return -ENOMEM; > > rtsx_usb_ep0_read_register(ucr, MS_TRANS_CFG, &val); > dev_dbg(ms_dev(host), "MS_TRANS_CFG: 0x%02x\n", val); > > <....> > kfree(val); > > However, I'm not familiar enough with this driver to know if this > function is called frequently in an IRQ handler, etc. If the above > pseudo code looks sufficient, I can come up with a patch. > Thanks for reporting this. rtsx_usb_ep0_read_register() is not called in any interrupt context. It is a high-priority(control pipe) but less used alternative to communicate with device. It is primarily for error handling. I'll fix it inside rtsx_usb_ep0_read_register() itself by a DMA'able double buffer because it could be called somewhere else(e.g. mmc side). > WARNING: CPU: 1 PID: 25 at lib/dma-debug.c:1166 check_for_stack+0x96/0xe0() > ehci-pci 0000:00:1a.0: DMA-API: device driver maps memory from stack > [addr=ffff8801199e3cef] > Modules linked in: rtsx_usb_ms arc4 memstick intel_rapl iosf_mbi > rtl8192ce snd_hda_codec_hdmi snd_hda_codec_realtek > snd_hda_codec_generic snd_hda_intel rtl_pci rtl8192c_common > snd_hda_controller x86_pkg_temp_thermal snd_hda_codec rtlwifi mac80211 > coretemp kvm_intel kvm iTCO_wdt snd_hwdep snd_seq snd_seq_device > crct10dif_pclmul iTCO_vendor_support sparse_keymap cfg80211 > crc32_pclmul snd_pcm crc32c_intel ghash_clmulni_intel rfkill i2c_i801 > snd_timer shpchp snd serio_raw mei_me lpc_ich soundcore mei tpm_tis > tpm wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc i915 > rtsx_usb_sdmmc mmc_core 8021q uas garp stp i2c_algo_bit llc mrp > drm_kms_helper usb_storage drm rtsx_usb mfd_core r8169 mii video > CPU: 1 PID: 25 Comm: kworker/1:2 Not tainted 3.20.0-0.rc0.git7.3.fc22.x86_64 #1 > Hardware name: WB WB-B06211/WB-B0621, BIOS EB062IWB V1.0 12/12/2013 > Workqueue: events rtsx_usb_ms_handle_req [rtsx_usb_ms] > 0000000000000000 000000003d188e66 ffff8801199e3808 ffffffff8187642b > 0000000000000000 ffff8801199e3860 ffff8801199e3848 ffffffff810ab39a > ffff8801199e3864 ffff8801199e3cef ffff880119b57098 ffff880119b37320 > Call Trace: > [] dump_stack+0x4c/0x65 > [] warn_slowpath_common+0x8a/0xc0 > [] warn_slowpath_fmt+0x55/0x70 > [] ? _raw_spin_unlock_irqrestore+0x36/0x70 > [] check_for_stack+0x96/0xe0 > [] debug_dma_map_page+0x104/0x150 > [] usb_hcd_map_urb_for_dma+0x646/0x790 > [] usb_hcd_submit_urb+0x1d5/0xa90 > [] ? mark_held_locks+0x7f/0xc0 > [] ? mark_held_locks+0x7f/0xc0 > [] ? lockdep_init_map+0x65/0x5d0 > [] usb_submit_urb+0x42e/0x5f0 > [] usb_start_wait_urb+0x77/0x190 > [] ? __kmalloc+0x205/0x2d0 > [] usb_control_msg+0xdc/0x130 > [] rtsx_usb_ep0_read_register+0x59/0x70 [rtsx_usb] > [] ? rtsx_usb_get_rsp+0x41/0x50 [rtsx_usb] > [] rtsx_usb_ms_handle_req+0x7ce/0x9c5 [rtsx_usb_ms] > [] ? process_one_work+0x19b/0x860 > [] process_one_work+0x232/0x860 > [] ? process_one_work+0x19b/0x860 > [] ? worker_thread+0xda/0x470 > [] worker_thread+0x53/0x470 > [] ? process_one_work+0x860/0x860 > [] kthread+0x104/0x120 > [] ? local_clock+0x25/0x30 > [] ? kthread_create_on_node+0x250/0x250 > [] ret_from_fork+0x7c/0xb0 > [] ? kthread_create_on_node+0x250/0x250 > > josh > > ------Please consider the environment before printing this e-mail. -- Best regards, Roger Tseng ????{.n?+???????+%?????ݶ??w??{.n?+????{??G?????{ay?ʇڙ?,j??f???h?????????z_??(?階?ݢj"???m??????G????????????&???~???iO???z??v?^?m???? ????????I?