** Description changed: + SRU Justification + + Impact: dma badness with cdc-wdm, regression introduced by commit + cafbe85 upstream. + + Fix: Adjust usb_free_coherent calls. + + Test case: it is reported the problem happens on suspend/resume with + cdc-wdm, bad dma messages reported on dmesg + + -------------------------------------------------------------------------------------- + When going into suspend-to-RAM or suspend-to-disk, I regularly get error messages like this one in the system log and on the console: - [167511.661550] ehci_hcd 0000:00:1d.0: dma_pool_free buffer-128, ffff880036442000/36442000 (bad dma) + [167511.661550] ehci_hcd 0000:00:1d.0: dma_pool_free buffer-128, ffff880036442000/36442000 (bad dma) There is no crash, just this error message. I did some debugging of this thing myself by diving into the kernel sources, and ended up with drivers/usb/class/cdc-wdm.c as the likely source of the problem: Allocation and deallocation of DMA buffer space differ on size. Here is the allocation: - desc->inbuf = usb_alloc_coherent(interface_to_usbdev(intf), - desc->wMaxCommand, - GFP_KERNEL, - &desc->response->transfer_dma); + desc->inbuf = usb_alloc_coherent(interface_to_usbdev(intf), + desc->wMaxCommand, + GFP_KERNEL, + &desc->response->transfer_dma); and here is the corresponding deallocation (is in the code twize): - usb_free_coherent(interface_to_usbdev(desc->intf), - desc->bMaxPacketSize0, - desc->inbuf, - desc->response->transfer_dma); + usb_free_coherent(interface_to_usbdev(desc->intf), + desc->bMaxPacketSize0, + desc->inbuf, + desc->response->transfer_dma); - usb_free_coherent(interface_to_usbdev(desc->intf), - desc->bMaxPacketSize0, - desc->inbuf, - desc->response->transfer_dma); + usb_free_coherent(interface_to_usbdev(desc->intf), + desc->bMaxPacketSize0, + desc->inbuf, + desc->response->transfer_dma); Note, that desc->wMaxCommand is used as the size for allocation, and desc->bMaxPacketSize0 is used as the size for deallocation/free. This should both be the same number. To find out, whether this should read desc->bMaxPacketSize0 in all three places, or desc->wMaxCommand in all three places is beyond my scope, though I'd assume, it is desc->bMaxPacketSize0. - The device in question is reported by "lsusb" as: - Bus 002 Device 024: ID 0bdb:1911 Ericsson Business Mobile Networks BV + Bus 002 Device 024: ID 0bdb:1911 Ericsson Business Mobile Networks BV ProblemType: Bug DistroRelease: Ubuntu 12.04 Package: linux-image-3.2.0-32-generic 3.2.0-32.51 ProcVersionSignature: Ubuntu 3.2.0-32.51-generic 3.2.30 Uname: Linux 3.2.0-32-generic x86_64 AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24. ApportVersion: 2.0.1-0ubuntu14 Architecture: amd64 ArecordDevices: - **** List of CAPTURE Hardware Devices **** - card 0: PCH [HDA Intel PCH], device 0: CONEXANT Analog [CONEXANT Analog] - Subdevices: 1/1 - Subdevice #0: subdevice #0 + **** List of CAPTURE Hardware Devices **** + card 0: PCH [HDA Intel PCH], device 0: CONEXANT Analog [CONEXANT Analog] + Subdevices: 1/1 + Subdevice #0: subdevice #0 AudioDevicesInUse: - USER PID ACCESS COMMAND - /dev/snd/controlC0: kai 1795 F.... pulseaudio + USER PID ACCESS COMMAND + /dev/snd/controlC0: kai 1795 F.... pulseaudio Card0.Amixer.info: - Card hw:0 'PCH'/'HDA Intel PCH at 0xd1600000 irq 43' - Mixer name : 'Intel CougarPoint HDMI' - Components : 'HDA:14f1506e,17aa21ed,00100002 HDA:80862805,80860101,00100000' - Controls : 14 - Simple ctrls : 6 + Card hw:0 'PCH'/'HDA Intel PCH at 0xd1600000 irq 43' + Mixer name : 'Intel CougarPoint HDMI' + Components : 'HDA:14f1506e,17aa21ed,00100002 HDA:80862805,80860101,00100000' + Controls : 14 + Simple ctrls : 6 Card29.Amixer.info: - Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30, fw unknown' - Mixer name : 'ThinkPad EC (unknown)' - Components : '' - Controls : 1 - Simple ctrls : 1 + Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30, fw unknown' + Mixer name : 'ThinkPad EC (unknown)' + Components : '' + Controls : 1 + Simple ctrls : 1 Card29.Amixer.values: - Simple mixer control 'Console',0 - Capabilities: pswitch pswitch-joined penum - Playback channels: Mono - Mono: Playback [on] + Simple mixer control 'Console',0 + Capabilities: pswitch pswitch-joined penum + Playback channels: Mono + Mono: Playback [on] Date: Thu Nov 1 22:20:00 2012 HibernationDevice: RESUME=UUID=81618807-56b1-407c-97f3-937b647ae1d3 InstallationMedia: Kubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120423) MachineType: LENOVO 3045A64 ProcEnviron: - LANGUAGE= - TERM=xterm - PATH=(custom, user) - LANG=de_DE.UTF-8 - SHELL=/bin/bash + LANGUAGE= + TERM=xterm + PATH=(custom, user) + LANG=de_DE.UTF-8 + SHELL=/bin/bash ProcFB: 0 inteldrmfb ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.2.0-32-generic root=UUID=ee9e4d1f-4cd6-40b1-8e46-2ccb3bdca2b6 ro quiet splash vt.handoff=7 RelatedPackageVersions: - linux-restricted-modules-3.2.0-32-generic N/A - linux-backports-modules-3.2.0-32-generic N/A - linux-firmware 1.79.1 + linux-restricted-modules-3.2.0-32-generic N/A + linux-backports-modules-3.2.0-32-generic N/A + linux-firmware 1.79.1 SourcePackage: linux StagingDrivers: rts_pstor mei UpgradeStatus: No upgrade log present (probably fresh install) dmi.bios.date: 01/11/2012 dmi.bios.vendor: LENOVO dmi.bios.version: 8QET54WW (1.15 ) dmi.board.asset.tag: Not Available dmi.board.name: 3045A64 dmi.board.vendor: LENOVO dmi.board.version: Not Available dmi.chassis.asset.tag: No Asset Information dmi.chassis.type: 10 dmi.chassis.vendor: LENOVO dmi.chassis.version: Not Available dmi.modalias: dmi:bvnLENOVO:bvr8QET54WW(1.15):bd01/11/2012:svnLENOVO:pn3045A64:pvrThinkPadX121e:rvnLENOVO:rn3045A64:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable: dmi.product.name: 3045A64 dmi.product.version: ThinkPad X121e dmi.sys.vendor: LENOVO
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1074157 Title: Wrong memory allocation (or deallocation) in WWAN driver cdc-wdm.c To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1074157/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
