linux-kernel - [usb] kernel BUG at arch/x86/mm/physaddr.c:15

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 02 Dec 2011 11:28:47 +0000
From:	"Wouter M. Koolen" <W.M.Koolen-Wijkstra@....nl>
To:	gregkh@...e.de
CC:	linux-usb@...r.kernel.org,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: [usb] kernel BUG at arch/x86/mm/physaddr.c:15

Hi Greg,

(get_maintainer.pl points to you, but that may be too general. Please 
forward as necessary)

I am hitting this one every once in a while during boot:

kernel BUG at arch/x86/mm/physaddr.c:15!
invalid opcode: 0000 [#1] SMP
CPU 0
Modules linked in: isight_firmware(+) usbhid hid snd_hda_codec_realtek 
snd_hda_intel snd_hda_codec snd_hwde
p arc4 snd_pcm_oss snd_mixer_oss sr_mod b43 snd_pcm cdrom mac80211 
cfg80211 rfkill rng_core snd_seq uhci_hcd ehci_hcd ssb firewire_ohci snd_
timer snd_seq_device firewire_core mmc_core snd soundcore applesmc 
input_polldev crc_itu_t usbcore sky2 snd_page_alloc i2c_i801 pcspkr ac pr
ocessor evdev battery power_supply apple_bl ext4 mbcache jbd2 crc16 
sd_mod crc_t10dif ata_piix libata scsi_mod

Pid: 454, comm: modprobe Not tainted 3.1.4.debug+ #38 Apple Inc. 
MacBook4,1/Mac-F22788A9
RIP: 0010:[<ffffffff81027112>]  [<ffffffff81027112>] __phys_addr+0x62/0x70
RSP: 0018:ffff88006f425ab8  EFLAGS: 00010212
RAX: 000000002022b02e RBX: ffff88006f510740 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 000000006f4e6c77 RDI: ffffffffa022b02e
RBP: ffff88006f425ab8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff880070ec14b8
R13: ffff88007addd090 R14: 0000000000000001 R15: ffffffffa022b02e
FS:  00007f6463aca700(0000) GS:ffff88007da00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00007f9e0066a520 CR3: 000000006f422000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process modprobe (pid: 454, threadinfo ffff88006f424000, task 
ffff880070f5a100)
Stack:
ffff88006f425b18 ffffffffa017c7f5 ffff88006f425af8 0000000000000001
ffffffffa0194e48 ffffffff81008470 ffffffff8108cabe ffff88006f510740
000000000000012c ffff880070ec14b8 0000000000000010 0000000000000001
Call Trace:
[<ffffffffa017c7f5>] usb_hcd_map_urb_for_dma+0x3d5/0x480 [usbcore]
[<ffffffff81008470>] ? nommu_map_sg+0xf0/0xf0
[<ffffffff8108cabe>] ? is_module_address+0x1e/0x30
[<ffffffffa017c9cd>] usb_hcd_submit_urb+0x12d/0x680 [usbcore]
[<ffffffffa017d99c>] usb_submit_urb+0xec/0x300 [usbcore]
[<ffffffffa017ee06>] usb_start_wait_urb+0x76/0x110 [usbcore]
[<ffffffffa017f105>] usb_control_msg+0xd5/0x110 [usbcore]
[<ffffffffa022a0c5>] isight_firmware_load+0xb5/0x2d8 [isight_firmware]
[<ffffffffa01821c6>] usb_probe_interface+0xd6/0x1f0 [usbcore]
[<ffffffff812f72c9>] driver_probe_device+0x79/0x1a0
[<ffffffff812f7493>] __driver_attach+0xa3/0xb0
[<ffffffff812f73f0>] ? driver_probe_device+0x1a0/0x1a0
[<ffffffff812f73f0>] ? driver_probe_device+0x1a0/0x1a0
[<ffffffff812f62ec>] bus_for_each_dev+0x5c/0x90
[<ffffffff812f6f79>] driver_attach+0x19/0x20
[<ffffffff812f6c00>] bus_add_driver+0x1a0/0x260
[<ffffffff812f79d1>] driver_register+0x71/0x140
[<ffffffff811db318>] ? __raw_spin_lock_init+0x38/0x70
[<ffffffffa0181070>] usb_register_driver+0xc0/0x1b0 [usbcore]
[<ffffffffa003e000>] ? 0xffffffffa003dfff
[<ffffffffa003e01e>] isight_firmware_init+0x1e/0x1000 [isight_firmware]
[<ffffffff810001cb>] do_one_initcall+0x3b/0x170
[<ffffffff8108c28b>] sys_init_module+0xbb/0x230
[<ffffffff8141bebb>] system_call_fastpath+0x16/0x1b
Code: 87 ff ff 48 39 c7 76 21 0f b6 0d d3 85 84 00 48 b8 00 00 00 00 00 
78 00 00 48 01 f8 48 89 c2 48 d3 ea 48 85 d2 74 cc 0f 0b 0f 0b <0f> 0b 
90 90 90 90 90 90 90 90 90 90 90 90 49 ba ff 0f 00 00 00
RIP  [<ffffffff81027112>] __phys_addr+0x62/0x70
RSP <ffff88006f425ab8>
---[ end trace f3191ac82c28c0c3 ]---

I am running 3.1.4  x86_64 on a Macbook 4,1. The isight camera firmware 
loading that seems to trigger this is trying to initialise
Bus 002 Device 003: ID 05ac:8501 Apple, Inc. Built-in iSight [Micron]
(lsusb -v attached)

I am quite confident I did not see this with 3.0. Unfortunately it does 
not happen reliably, so it would take me a while to bisect. I hope the 
splat already points to the problem, but let me know if a bisection 
would be appreciated. Or if you need any other information of course.

With kind regards,

Wouter Koolen

View attachment "dmesg" of type "text/plain" (76609 bytes)

View attachment "config-3.1.4.debug+" of type "text/plain" (73159 bytes)

View attachment "lsusb-isight" of type "text/plain" (8875 bytes)