Bug 203149

Summary:	Kernel oops when using multiple V4L cameras: 9600004f in dwc2_unmap_urb_for_dma+0x1c/0x28
Product:	Drivers	Reporter:	wayne
Component:	USB	Assignee:	Greg Kroah-Hartman (greg)
Status:	NEW ---
Severity:	normal	CC:	jan, wayne
Priority:	P1
Hardware:	ARM
OS:	Linux
Kernel Version:	5.0.5-meson64	Subsystem:
Regression:	No	Bisected commit-id:

Description wayne 2019-04-04 01:02:34 UTC

I have three USB H.264 cameras connected to an ODroid-C2 running a latest Armbian nightly build, with what appears to be kernel 5.0.5.

When trying to access these cameras via V4L, I immediately get a kernel oops and the device reboots.

It appears as though the problem occurs in dwc2_unmap_urb_for_dma+0x1c/0x28 which is in drivers/usb/dwc2.

I'm not a kernel developer so not sure what other information I can provide apart from the oops dump. I can provide other information if needed.



[  204.624452] Internal error: Oops: 9600004f [#1] PREEMPT SMP
[  204.635515] Modules linked in: snd_soc_hdmi_codec dw_hdmi_i2s_audio dw_hdmi_cec meson_vdec uvcvideo videobuf2_dma_contig videobuf2_vmalloc v4l2_mem2mem videobuf2_memops lz4hc videobuf2_v4l2 lz4hc_compress ao_cec videobuf2_common meson_dw_hdmi meson_rng meson_ir dw_hdmi meson_drm rng_core rc_core videodev drm_kms_helper cec snd_soc_meson_aiu_spdif snd_soc_meson_aiu_i2s drm media meson_canvas snd_soc_meson_audio_core meson_gxbb_wdt drm_panel_orientation_quirks zram snd_usb_audio snd_soc_simple_card snd_hwdep snd_usbmidi_lib snd_soc_simple_card_utils snd_soc_core snd_rawmidi snd_seq_device snd_pcm_dmaengine snd_pcm snd_timer snd scpi_hwmon soundcore ip_tables x_tables realtek
[  204.728202] CPU: 2 PID: 0 Comm: swapper/2 Tainted: G        W         5.0.5-meson64 #5.77.190401
[  204.745037] Hardware name: Hardkernel ODROID-C2 (DT)
[  204.758748] pstate: 80000005 (Nzcv daif -PAN -UAO)
[  204.772475] pc : __memcpy+0xa0/0x180
[  204.786168] lr : dwc2_free_dma_aligned_buffer+0x78/0x80
[  204.799988] sp : ffff000010013da0
[  204.813726] x29: ffff000010013da0 x28: 0000000000000000 
[  204.827504] x27: 0000000000000038 x26: ffff000010e960c0 
[  204.841198] x25: 0000000000000101 x24: 0000000000000020 
[  204.854820] x23: ffff000010e9d000 x22: ffff80006b378594 
[  204.868394] x21: 0000000000000000 x20: ffff80006a124f79 
[  204.881902] x19: ffff80007e6f1800 x18: 000000000098090c 
[  204.895494] x17: 0000000000000000 x16: 0000000000000000 
[  204.909050] x15: 000000000000014d x14: 0000000000000400 
[  204.922531] x13: 0000000000000000 x12: 0000000000000001 
[  204.935862] x11: 000000000047f7f9 x10: 0000000000000040 
[  204.948999] x9 : 0000000000000002 x8 : ffff000010eb82a0 
[  204.962085] x7 : 0000000000000002 x6 : ffff80006a124f79 
[  204.975122] x5 : 0000000000000000 x4 : 0000000000800200 
[  204.988041] x3 : 00000000000001f4 x2 : 0000000000000002 
[  205.000822] x1 : ffff80007edbf202 x0 : ffff80006a124f79 
[  205.013627] Process swapper/2 (pid: 0, stack limit = 0x0000000035e14788)
[  205.027581] Call trace:
[  205.040442]  __memcpy+0xa0/0x180
[  205.053332]  dwc2_unmap_urb_for_dma+0x1c/0x28
[  205.066319]  unmap_urb_for_dma+0x18/0x28
[  205.079213]  __usb_hcd_giveback_urb+0x38/0xe0
[  205.092009]  usb_giveback_urb_bh+0xac/0x108
[  205.104753]  tasklet_action_common.isra.2+0x7c/0x168
[  205.117479]  tasklet_action+0x24/0x30
[  205.130030]  __do_softirq+0x10c/0x220
[  205.142521]  irq_exit+0xac/0xc0
[  205.154950]  __handle_domain_irq+0x60/0xb0
[  205.167376]  gic_handle_irq+0x58/0xa8
[  205.179784]  el1_irq+0xb0/0x128
[  205.192121]  arch_cpu_idle+0x10/0x18
[  205.204478]  do_idle+0x1dc/0x2a0
[  205.216787]  cpu_startup_entry+0x24/0x28
[  205.229051]  secondary_start_kernel+0x19c/0x1d8
[  205.241263] Code: b8404423 b80044c3 36080062 78402423 (780024c3) 
[  205.253985] ---[ end trace 156b59abcb22f143 ]---
[  205.266298] Kernel panic - not syncing: Fatal exception in interrupt
[  205.279479] SMP: stopping secondary CPUs
[  205.291947] Kernel Offset: disabled
[  205.304384] CPU features: 0x002,24002004
[  205.316867] Memory Limit: none
[  205.329314] Rebooting in 10 seconds..

Comment 1 Greg Kroah-Hartman 2019-04-04 05:33:55 UTC

On Thu, Apr 04, 2019 at 01:02:34AM +0000, bugzilla-daemon@bugzilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=203149
> 
>             Bug ID: 203149
>            Summary: Kernel oops when using multiple V4L cameras: 9600004f
>                     in dwc2_unmap_urb_for_dma+0x1c/0x28
>            Product: Drivers
>            Version: 2.5
>     Kernel Version: 5.0.5-meson64

All USB bugs should be sent to the linux-usb@vger.kernel.org mailing
list, and not entered into bugzilla.  Please bring this issue up there,
if it is still a problem in the latest kernel release.

Comment 2 Jan Kratochvil 2019-05-09 13:36:55 UTC

https://marc.info/?l=linux-usb&m=155440243702650&w=2
But there is no help.  Also getting these dumps.

Raspberry Pi 3B+
https://www.jankratochvil.net/t/raspberry-camera.jpg

kernel-4.20.16                          it worked
kernel-5.0.13-300         .fc30.aarch64 crash
kernel-5.1.0 -0.rc7.git4.1.fc31.aarch64 also crash

Unfortunately netconsole does not work for me during the crash.
kdump locks up cycling crash messages.
https://www.jankratochvil.net/t/raspberry-kdump.jpg

Comment 3 Jan Kratochvil 2019-05-21 07:26:17 UTC

Still crashing + crashing on kdump on: kernel-5.2.0-0.rc0.git6.1.fc31.aarch64

Comment 4 Jan Kratochvil 2019-05-26 13:56:35 UTC

From: Stefan Wahren <wahrenst-at-gmx.net>
usb: dwc2: RODATA_FULL_DEFAULT_ENABLED causes kernel oops
Message-ID: <0ae6261e-96b3-cf8b-d523-a6b8851c951b@gmx.net>
https://marc.info/?l=linux-usb&m=155886551312676

Comment 5 Jan Kratochvil 2019-06-14 22:25:41 UTC

It is not yet accepted upstream
but it is now at least backported in Fedora 29: kernel-5.1.9-200.fc29
https://src.fedoraproject.org/rpms/kernel/blob/f29/f/usb-dwc2-Fix-DMA-cache-alignment-issues.patch
But I haven't tested it yet on my Raspberry Pi 3B+.

Comment 6 Jan Kratochvil 2019-06-21 20:38:50 UTC

It is fixed upstream by:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4a4863bf2e7932e584a3a462d3c6daf891142ddc

I cannot close this Bug myself.