linux-kernel - Re: OHCI unplug kernel crash in kernel 4.3 and 4.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1452780074.30336.27.camel@suse.com>
Date:	Thu, 14 Jan 2016 15:01:14 +0100
From:	Oliver Neukum <oneukum@...e.com>
To:	Stefani Seibold <stefani@...bold.net>
Cc:	linux-usb <linux-usb@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Greg KH <greg@...ah.com>,
	Alan Stern <stern@...land.harvard.edu>, jroedel@...e.com
Subject: Re: OHCI unplug kernel crash in kernel 4.3 and 4.4

On Thu, 2016-01-14 at 13:50 +0100, Stefani Seibold wrote:
> A unplug of an USB 1.0 OHCI controller express card will result in a
> kernel crash. The express card is attached via thunderbolt and a sonnet
> express card to thunderbolt adapter. The computer hangs after the
> unplug, only a power fix the situation.
> 
> This is the kernel log of a kernel 4.4 via netconsole:
> 
> pciehp 0000:06:03.0:pcie24: Card not present on Slot(3)
> pciehp 0000:06:03.0:pcie24: slot(3): Link Down event
> pciehp 0000:06:03.0:pcie24: Link Down event ignored on slot(3): already powering off
> ehci-pci 0000:0b:00.2: HC died; cleaning up
> ehci-pci 0000:0b:00.2: remove, state 4
> usb usb5: USB disconnect, device number 1
> pciehp 0000:00:1c.4:pcie04: Card not present on Slot(4)
> pciehp 0000:00:1c.4:pcie04: slot(4): Link Down event
> ehci-pci 0000:0b:00.2: USB bus 5 deregistered
> ohci-pci 0000:0b:00.1: HC died; cleaning up
> ohci-pci 0000:0b:00.1: remove, state 4
> usb usb7: USB disconnect, device number 1
> pciehp 0000:00:1c.4:pcie04: Link Down event ignored on slot(4): already powering off
> ohci-pci 0000:0b:00.1: USB bus 7 deregistered
> ohci-pci 0000:0b:00.0: HC died; cleaning up
> ohci-pci 0000:0b:00.0: remove, state 4
> usb usb6: USB disconnect, device number 1
> ------------[ cut here ]------------
> kernel BUG at drivers/iommu/intel-iommu.c:3592!

This is likely the crucial information. The IOMMU is unhappy.

> invalid opcode: 0000 [#1] PREEMPT SMP 
> Modules linked in: ohci_pci ohci_hcd binfmt_misc netconsole configfs bbswitch(O) iwlmvm iwlwifi vboxnetadp(O) vboxnetflt(O) vboxdrv(O) nvidia(PO) vhost_net tun vhost kvm_intel kvm irqbypass dell_smm_hwmon [last unloaded: netconsole]
> CPU: 0 PID: 4857 Comm: kworker/0:3 Tainted: P           O    4.4.0-gentoo #1
> Hardware name: Dell Inc. XPS 2720/05R2TK  , BIOS A12 09/21/2015
> Workqueue: pciehp-3 pciehp_power_thread
> task: ffff8804070a2300 ti: ffff8803e4658000 task.ti: ffff8803e4658000
> RIP: 0010:[<ffffffff8061edf4>]  [<ffffffff8061edf4>] intel_unmap+0x1c4/0x1d0
> RSP: 0018:ffff8803e465bb98  EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff8804225fb098 RCX: 00000000ffffc000
> RDX: 0000000000000000 RSI: 00000000ffffc000 RDI: ffff8804225fb098
> RBP: ffff8803e465bbd0 R08: 0000000000000000 R09: 0000000000000000
> R10: ffff88046cc000c0 R11: 0000000000000000 R12: 00000000ffffffff
> R13: 00000000ffffc000 R14: ffff880468caa400 R15: ffffe8ffffc13800
> FS:  0000000000000000(0000) GS:ffff88047f200000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f2515680324 CR3: 000000000120a000 CR4: 00000000001406f0
> Stack:
>  ffff8804101e4a78 ffff8803e465bbf0 ffffea000f915840 00000000ffffffff
>  ffffffff812a3ec0 ffff880468caa400 ffffe8ffffc13800 ffff8803e465bbf0
>  ffffffff8061ee8a ffff88045e68f000 ffff8804225fb098 ffff8803e465bc28
> Call Trace:
>  [<ffffffff8061ee8a>] intel_free_coherent+0x5a/0xa0
>  [<ffffffffa0ad4d04>] ohci_stop+0x144/0x1c0 [ohci_hcd]
>  [<ffffffff807e1fb4>] usb_remove_hcd+0xe4/0x1a0
>  [<ffffffff807f2203>] usb_hcd_pci_remove+0x63/0x130
>  [<ffffffff80573e79>] pci_device_remove+0x39/0xc0
>  [<ffffffff80714f46>] __device_release_driver+0x96/0x130
>  [<ffffffff80715003>] device_release_driver+0x23/0x30
>  [<ffffffff8056d84a>] pci_stop_bus_device+0x8a/0xa0
>  [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
>  [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
>  [<ffffffff8056d7f1>] pci_stop_bus_device+0x31/0xa0
>  [<ffffffff8056d962>] pci_stop_and_remove_bus_device+0x12/0x20
>  [<ffffffff80585f0b>] pciehp_unconfigure_device+0x9b/0x180
>  [<ffffffff80585a23>] pciehp_disable_slot+0x43/0xb0
>  [<ffffffff80585b1d>] pciehp_power_thread+0x8d/0xb0

It is asked to do something to a mapping for a device going away.
Taking Joerg into CC.

	Regards
		Oliver