Message-ID: <CAAJw_ZtppNqC9XA=-WVQDr+vaAS=di7jo15CzSqONeX48H75MA@mail.gmail.com>
Date: Sat, 14 Dec 2024 03:39:20 +0800
From: Jeff Chua <jeff.chua.linux@...il.com>
To: lkml <linux-kernel@...r.kernel.org>
Subject: linux 6.12.0-rc6+ hangs on mkfs.ext4 on USB microSD

I tried to run 'mkfs.ext4  /dev/sda2' (usb microSD) and it hung the
whole system.

# dmesg
sd 0:0:0:0: [sda] Attached SCSI removable disk
BUG: unable to handle page fault for address: 00000004145cf5ce
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 7 UID: 0 PID: 15287 Comm: usb-storage Tainted: G     U
 6.12.0-rc6+ #26
Tainted: [U]=USER
Hardware name: LENOVO 21FWS6UK00/21FWS6UK00, BIOS N3ZET33W (1.20 ) 02/29/2024
RIP: 0010:xhci_ring_expansion+0xf3/0x340
Code: c2 48 83 c0 10 83 4a 0c 01 48 3d 00 10 00 00 75 ea 48 8b 49 08
48 3b 0b 74 05 48 85 c9 75 da 48 8b 53 08 48 8b 85 78 ff ff ff <48> 8b
7e 08 44 8b 4d b8 48 85 d2 48 89 c1 0f 84 34 01 00 00 48 85
RSP: 0018:ffffc90000787978 EFLAGS: 00010006
RAX: ffff8881089056c0 RBX: ffff88810484b780 RCX: ffff888139b2d000
RDX: ffff888104845680 RSI: 00000004145cf5c6 RDI: 0000000000000000
RBP: ffffc90000787a10 R08: 0000000000000002 R09: ffff8881458bd000
R10: 0000000000000100 R11: ffff8881088ce228 R12: ffff888102cd7250
R13: 0000000000000820 R14: 0000000000000000 R15: ffff88810484b780
FS:  0000000000000000(0000) GS:ffff8897ff3c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000004145cf5ce CR3: 0000000002a2a000 CR4: 0000000000750ef0
PKRU: 55555554
Call Trace:
 <TASK>
 ? show_regs+0x5f/0x70
 ? __die+0x1f/0x70
 ? page_fault_oops+0x15a/0x450
 ? apic_smt_update+0x10/0x50
 ? exc_page_fault+0x2d4/0x500
 ? asm_exc_page_fault+0x27/0x30
 ? xhci_ring_expansion+0xf3/0x340
 ? xhci_ring_expansion+0x6a/0x340
 ? ktime_get+0x35/0xd0
 ? xhci_dbg_trace+0x55/0x80
 prepare_ring+0x11b/0x2e0
 prepare_transfer+0x82/0x150
 xhci_queue_bulk_tx+0x11c/0xa30
 ? dma_direct_map_sg+0x9a/0x290
 ? psi_group_change+0x138/0x360
 xhci_urb_enqueue+0x251/0x290
 usb_hcd_submit_urb+0xb8/0xa90
 ? schedule+0x22/0xe0
 ? schedule_timeout+0xda/0xf0
 ? sched_clock_cpu+0x10/0x1a0
usb_submit_urb+0x24c/0x5c0
 ? usb_alloc_urb+0x34/0x80
 usb_sg_wait+0x7c/0x170
 usb_stor_bulk_transfer_sglist+0x7c/0x120 [usb_storage]
 usb_stor_Bulk_transport+0x215/0x3e0 [usb_storage]
 usb_stor_invoke_transport+0x39/0x4f0 [usb_storage]
 ? schedule_timeout+0xda/0xf0
 ? wait_for_completion_interruptible+0x17f/0x1a0
 usb_stor_transparent_scsi_command+0x9/0x10 [usb_storage]
 usb_stor_control_thread+0x1e4/0x2b0 [usb_storage]
 ? __pfx_usb_stor_control_thread+0x10/0x10 [usb_storage]
 kthread+0xdc/0x110
 ? __pfx_kthread+0x10/0x10
 ret_from_fork+0x35/0x60
 ? __pfx_kthread+0x10/0x10
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Modules linked in: uas usb_storage snd_ctl_led bnep
snd_hda_codec_realtek snd_hda_codec_generic snd_hda_scodec_component
snd_hda_codec_hdmi snd_soc_dmic snd_hda_intel
snd_hda_scodec_cs35l41_i2c snd_hda_scodec_cs35l41 snd_hda_cs_dsp_ctls
snd_soc_cs_amp_lib cs_dsp snd_soc_cs35l41_lib serial_multi_instantiate
pinctrl_tigerlake snd_soc_skl_hda_dsp snd_soc_intel_sof_board_helpers
snd_soc_intel_hda_dsp_common snd_soc_acpi_intel_match snd_soc_acpi
snd_soc_core snd_compress snd_pcm_dmaengine snd_hda_codec snd_hda_core
ac97_bus snd_hwdep snd_pcm snd_timer snd soundcore snd_intel_dspcfg
snd_intel_sdw_acpi intel_lpss_pci intel_lpss idma64 iwlmvm iwlwifi
mac80211 cfg80211 ax88179_178a usbnet mii usbhid btusb btrtl btintel
btbcm bluetooth ecdh_generic ecc
CR2: 00000004145cf5ce
---[ end trace 0000000000000000 ]---
RIP: 0010:xhci_ring_expansion+0xf3/0x340
Code: c2 48 83 c0 10 83 4a 0c 01 48 3d 00 10 00 00 75 ea 48 8b 49 08
48 3b 0b 74 05 48 85 c9 75 da 48 8b 53 08 48 8b 85 78 ff ff ff <48> 8b
7e 08 44 8b 4d b8 48 85 d2 48 89 c1 0f 84 34 01 00 00 48 85
RSP: 0018:ffffc90000787978 EFLAGS: 00010006
RAX: ffff8881089056c0 RBX: ffff88810484b780 RCX: ffff888139b2d000
RDX: ffff888104845680 RSI: 00000004145cf5c6 RDI: 0000000000000000
RBP: ffffc90000787a10 R08: 0000000000000002 R09: ffff8881458bd000
R10: 0000000000000100 R11: ffff8881088ce228 R12: ffff888102cd7250
R13: 0000000000000820 R14: 0000000000000000 R15: ffff88810484b780
FS:  0000000000000000(0000) GS:ffff8897ff3c0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000004145cf5ce CR3: 0000000002a2a000 CR4: 0000000000750ef0
PKRU: 55555554
note: usb-storage[15287] exited with irqs disabled
note: usb-storage[15287] exited with preempt_count 1


# git bisect bad
fe688e5006133b2609c136f599e120a95cc450cb is the first bad commit
commit fe688e5006133b2609c136f599e120a95cc450cb (HEAD)
Author: Niklas Neronin <niklas.neronin@...ux.intel.com>
Date:   Wed Nov 6 12:14:40 2024 +0200

    usb: xhci: refactor xhci_link_rings() to use source and destination rings

    Refactor the xhci_link_rings() function to accept two rings: a source ring
    and a destination ring. Previously, the function accepted a ring and a
    segment list as arguments, now the function splices the source ring segment
    list into the destination ring. This new approach reduces the number of
    arguments and simplifies the code, making it easier to follow.

    Signed-off-by: Niklas Neronin <niklas.neronin@...ux.intel.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@...ux.intel.com>
    Link: https://lore.kernel.org/r/20241106101459.775897-15-mathias.nyman@linux.intel.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

 drivers/usb/host/xhci-mem.c | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)


Reverted the above and system worked ok.

My best.,
Jeff

Powered by blists - more mailing lists