Bug 210015 - page allocation failure in usb_hub_wq hub_event when adding HID device
Summary: page allocation failure in usb_hub_wq hub_event when adding HID device
Status: NEW
Alias: None
Product: Drivers
Classification: Unclassified
Component: USB (show other bugs)
Hardware: x86-64 Linux
: P1 normal
Assignee: Default virtual assignee for Drivers/USB
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-11-03 08:39 UTC by Jonas Ådahl
Modified: 2020-11-09 22:00 UTC (History)
3 users (show)

See Also:
Kernel Version: 5.8.16-300.fc33.x86_64
Subsystem:
Regression: No
Bisected commit-id:


Attachments
journal -k during the error (12.17 KB, text/plain)
2020-11-03 08:39 UTC, Jonas Ådahl
Details

Description Jonas Ådahl 2020-11-03 08:39:54 UTC
Created attachment 293411 [details]
journal -k during the error

When docking my laptop (Lenovo T470s, to a traditional docking station), running 5.8.16-300.fc33.x86_64, sometimes (every other time or so), the kernel runs into a page allocation failure when adding one of the HID device associated with the USB keyboard attached to the docking station.

When this does *not* happen, three evdev devices appear for the keyboard:

/dev/input/event11:	TypeMatrix.com USB Keyboard
/dev/input/event12:	TypeMatrix.com USB Keyboard System Control
/dev/input/event13:	TypeMatrix.com USB Keyboard Consumer Control

The third device emits events such as Volume Up, Volume Down etc. The first emits events such as regular A-Z keys.

Available HID devices are 

/dev/hidraw3:	TypeMatrix.com USB Keyboard
/dev/hidraw4:	TypeMatrix.com USB Keyboard

The first emits A-Z keys etc, while the second emits Volume up/down etc.

When the page allocation failure happens, the raw HID devices remain the same and functioning, but the only evdev devices that appear are event11 and event12, missing event13, thus missing Volume up/down events.

Replugging the keyboard enough times will make it work correctly again, most of the times.

I'm attaching a journal -k for when it happens, containing the backtrace to the page allocation failure.
Comment 1 Michel Dänzer 2020-11-03 09:02:21 UTC
Unless the memory allocated by the hid driver needs to be physically contiguous, it should use kvmalloc(_array) instead of kmalloc(_array) (and kvfree instead of kfree) where it can be larger than a single page.
Comment 2 Benjamin Tissoires 2020-11-03 17:53:49 UTC
> Unless the memory allocated by the hid driver needs to be physically
> contiguous, it should use kvmalloc(_array) instead of kmalloc(_array) (and
> kvfree instead of kfree) where it can be larger than a single page.

hmm, that is a good lead. I'll have to double check but I don't think the allocated memory should be that big. I am worried that using kvmalloc would paper over an other problem and we'll eat up all the memory by just plugging a keyboard...
Comment 3 Michel Dänzer 2020-11-03 18:07:30 UTC
(In reply to Benjamin Tissoires from comment #2)
> I'll have to double check but I don't think the allocated memory should be
> that big.

order:5 means 32 physically contiguous pages.
Comment 4 Michel Dänzer 2020-11-04 08:34:21 UTC
... and allocating 32 physically contiguous pages can be difficult/expensive under any circumstances.

(I happen to be aware of this issue because DRM drivers keep hitting it as well :)
Comment 5 Dmitry Torokhov 2020-11-09 22:00:47 UTC
32 pages for a single field suggests that there is a garbage in the descriptor and blindly converting to kvmalloc_array() is indeed simply papering over the problem.

I suggest you post hid report descriptor and maybe instrument hid-core.c::hid_register_field() to see what number of usages and values it is being asjed to allocate.

Note You need to log in before you can comment on or make changes to this bug.