| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Fri, 19 Sep 2014 21:01:49 +0200
From: Frank Schäfer <fschaefer.oss@...glemail.com>
To: Fengguang Wu <fengguang.wu@...el.com>
CC: Mauro Carvalho Chehab <m.chehab@...sung.com>,
linux-media@...r.kernel.org, Jet Chen <jet.chen@...el.com>,
Su Tao <tao.su@...el.com>, Yuanhan Liu <yuanhan.liu@...el.com>,
LKP <lkp@...org>, linux-kernel@...r.kernel.org
Subject: Re: [media/em28xx] BUG: unable to handle kernel
Hi Fengguang,
thank you for reporting this issue.
Am 19.09.2014 um 03:41 schrieb Fengguang Wu:
> Greetings,
>
> 0day kernel testing robot got the below dmesg and the first bad commit is
>
> git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
>
> commit a5c075cfd2386a4f3ab4f8ed2830ebee557d4b3f
> Author: Frank Schaefer <fschaefer.oss@...glemail.com>
> AuthorDate: Mon Mar 24 16:33:25 2014 -0300
> Commit: Mauro Carvalho Chehab <m.chehab@...sung.com>
> CommitDate: Fri May 23 13:44:42 2014 -0300
>
> [media] em28xx: move fields wq_trigger and streaming_started from struct em28xx to struct em28xx_audio
>
> Both wq_trigger and stream_started are used only to control the em28xx
> alsa streaming. They don't belong to em28xx common struct.
>
> Signed-off-by: Frank Schäfer <fschaefer.oss@...glemail.com>
> Signed-off-by: Hans Verkuil <hans.verkuil@...co.com>
> Signed-off-by: Mauro Carvalho Chehab <m.chehab@...sung.com>
This patch affects the em28xx-alsa module (em28xx-audio.c) only.
Now take a look at your kernel config:
...
#
# Webcam, TV (analog/digital) USB devices
#
CONFIG_VIDEO_EM28XX=y
CONFIG_VIDEO_EM28XX_V4L2=y
# CONFIG_VIDEO_EM28XX_ALSA is not set
CONFIG_VIDEO_EM28XX_DVB=y
CONFIG_VIDEO_EM28XX_RC=y
...
The em28xx-alsa module is disabled.
> Attached dmesg for the parent commit, too. It looks like the parent is
> actually clean, just that the rcu-tortuture tests take too long time.
>
> +------------------------------------------+------------+------------+---------------+
> | | 3319e6f839 | a5c075cfd2 | next-20140917 |
> +------------------------------------------+------------+------------+---------------+
> | boot_successes | 0 | 0 | 0 |
> | boot_failures | 80 | 20 | 11 |
> | BUG:kernel_boot_hang | 80 | 1 | 1 |
> | BUG:unable_to_handle_kernel | 0 | 19 | 10 |
> | Oops | 0 | 19 | 10 |
> | EIP_is_at_af9005_usb_module_init | 0 | 19 | 10 |
> | Kernel_panic-not_syncing:Fatal_exception | 0 | 19 | 10 |
> | backtrace:af9005_usb_module_init | 0 | 19 | 10 |
> | backtrace:kernel_init_freeable | 0 | 19 | 10 |
> | backtrace:_usb_module_init | 0 | 19 | 10 |
> +------------------------------------------+------------+------------+---------------+
>
> [ 8.528015] usbcore: registered new interface driver dvb_usb_ttusb2
> [ 8.529751] usbcore: registered new interface driver dvb_usb_af9005
> [ 8.529751] usbcore: registered new interface driver dvb_usb_af9005
> [ 8.531584] BUG: unable to handle kernel
> [ 8.531584] BUG: unable to handle kernel paging requestpaging request at 02e00000
> at 02e00000
> [ 8.533385] IP:
> [ 8.533385] IP: [<7d9d67c6>] af9005_usb_module_init+0x6b/0x9d
> [<7d9d67c6>] af9005_usb_module_init+0x6b/0x9d
And this tells us what is going wrong:
(gdb) list *(af9005_usb_module_init+0x83)
0x2d11 is in af9005_usb_module_init
(drivers/media/usb/dvb-usb/af9005.c:1092).
1087 if (rc_decode == NULL || rc_keys == NULL || rc_keys_size
== NULL) {
1088 err("af9005_rc_decode function not found,
disabling remote");
1089 af9005_properties.rc.legacy.rc_query = NULL;
1090 } else {
1091 af9005_properties.rc.legacy.rc_map_table = rc_keys;
1092 af9005_properties.rc.legacy.rc_map_size =
*rc_keys_size;
1093 }
1094
1095 return 0;
1096 }
So it happens in line 1092 when rc_keys_size is accessed.
According to your kernel config you have
CONFIG_MODULES disabled
CONFIG_DVB_USB_AF9005 enabled
CONFIG_DVB_USB_AF9005_REMOTE disabled
So af9005 is compiled in without remote control support.
Thus we should have hit the "if"-path, which also prints a message about
the missing remote control support.
Instead, we have hit the "else" path, which means that rc_decode,
rc_keys and rc_keys_size are all != NULL, although they should be NULL.
You can verify this by enabling CONFIG_DVB_USB_AF9005_REMOTE.
That makes the issue disappear.
Now let's go a few lines up to see where these pointers come from:
1084 rc_decode = symbol_request(af9005_rc_decode);
1085 rc_keys = symbol_request(rc_map_af9005_table);
1086 rc_keys_size = symbol_request(rc_map_af9005_table_size);
So symbol_request() returns pointers.!= NULL
A closer look at the definition of symbol_request() shows, that it does
nothing if CONFIG_MODULES is disabled (it just returns its argument).
One possibility to fix this bug would be to embrace these three lines with
#ifdef CONFIG_DVB_USB_AF9005_REMOTE
...
#endif
> [ 8.535613] *pde = 00000000
> [ 8.535613] *pde = 00000000
>
> [ 8.536416] Oops: 0000 [#1]
> [ 8.536416] Oops: 0000 [#1] PREEMPT PREEMPT DEBUG_PAGEALLOCDEBUG_PAGEALLOC
>
> [ 8.537863] CPU: 0 PID: 1 Comm: swapper Not tainted 3.15.0-rc6-00151-ga5c075c #1
> [ 8.537863] CPU: 0 PID: 1 Comm: swapper Not tainted 3.15.0-rc6-00151-ga5c075c #1
> [ 8.539827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
> [ 8.539827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
> [ 8.541519] task: 89c9a670 ti: 89c9c000 task.ti: 89c9c000
> [ 8.541519] task: 89c9a670 ti: 89c9c000 task.ti: 89c9c000
> [ 8.541519] EIP: 0060:[<7d9d67c6>] EFLAGS: 00010206 CPU: 0
> [ 8.541519] EIP: 0060:[<7d9d67c6>] EFLAGS: 00010206 CPU: 0
> [ 8.541519] EIP is at af9005_usb_module_init+0x6b/0x9d
> [ 8.541519] EIP is at af9005_usb_module_init+0x6b/0x9d
> [ 8.541519] EAX: 02e00000 EBX: 00000000 ECX: 00000006 EDX: 00000000
> [ 8.541519] EAX: 02e00000 EBX: 00000000 ECX: 00000006 EDX: 00000000
> [ 8.541519] ESI: 00000000 EDI: 7da33ec8 EBP: 89c9df30 ESP: 89c9df2c
> [ 8.541519] ESI: 00000000 EDI: 7da33ec8 EBP: 89c9df30 ESP: 89c9df2c
> [ 8.541519] DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
> [ 8.541519] DS: 007b ES: 007b FS: 0000 GS: 00e0 SS: 0068
> [ 8.541519] CR0: 8005003b CR2: 02e00000 CR3: 05a54000 CR4: 00000690
> [ 8.541519] CR0: 8005003b CR2: 02e00000 CR3: 05a54000 CR4: 00000690
> [ 8.541519] Stack:
> [ 8.541519] Stack:
> [ 8.541519] 7d9d675b
> [ 8.541519] 7d9d675b 89c9df90 89c9df90 7d992a49 7d992a49 7d7d5914 7d7d5914 89c9df4c 89c9df4c 7be3a800 7be3a800 7d08c58c 7d08c58c 8a4c3968 8a4c3968
>
> [ 8.541519] 89c9df80
> [ 8.541519] 89c9df80 7be3a966 7be3a966 00000192 00000192 00000006 00000006 00000006 00000006 7d7d3ff4 7d7d3ff4 8a4c397a 8a4c397a 00000200 00000200
>
> [ 8.541519] 7d6b1280
> [ 8.541519] 7d6b1280 8a4c3979 8a4c3979 00000006 00000006 000009a6 000009a6 7da32db8 7da32db8 b13eec81 b13eec81 00000006 00000006 000009a6 000009a6
>
> [ 8.541519] Call Trace:
> [ 8.541519] Call Trace:
> [ 8.541519] [<7d9d675b>] ? ttusb2_driver_init+0x16/0x16
> [ 8.541519] [<7d9d675b>] ? ttusb2_driver_init+0x16/0x16
> [ 8.541519] [<7d992a49>] do_one_initcall+0x77/0x106
> [ 8.541519] [<7d992a49>] do_one_initcall+0x77/0x106
> [ 8.541519] [<7be3a800>] ? parameqn+0x2/0x35
> [ 8.541519] [<7be3a800>] ? parameqn+0x2/0x35
> [ 8.541519] [<7be3a966>] ? parse_args+0x113/0x25c
> [ 8.541519] [<7be3a966>] ? parse_args+0x113/0x25c
> [ 8.541519] [<7d992bc2>] kernel_init_freeable+0xea/0x167
> [ 8.541519] [<7d992bc2>] kernel_init_freeable+0xea/0x167
> [ 8.541519] [<7cf01070>] kernel_init+0x8/0xb8
> [ 8.541519] [<7cf01070>] kernel_init+0x8/0xb8
> [ 8.541519] [<7cf27ec0>] ret_from_kernel_thread+0x20/0x30
> [ 8.541519] [<7cf27ec0>] ret_from_kernel_thread+0x20/0x30
> [ 8.541519] [<7cf01068>] ? rest_init+0x10c/0x10c
> [ 8.541519] [<7cf01068>] ? rest_init+0x10c/0x10c
> [ 8.541519] Code:
> [ 8.541519] Code: 08 08 c2 c2 c7 c7 05 05 44 44 ed ed f9 f9 7d 7d 00 00 00 00 e0 e0 02 02 c7 c7 05 05 40 40 ed ed f9 f9 7d 7d 00 00 00 00 e0 e0 02 02 c7 c7 05 05 3c 3c ed ed f9 f9 7d 7d 00 00 00 00 e0 e0 02 02 75 75 1f 1f b8 b8 00 00 00 00 e0 e0 02 02 85 85 c0 c0 74 74 16 16 <a1> <a1> 00 00 00 00 e0 e0 02 02 c7 c7 05 05 54 54 84 84 8e 8e 7d 7d 00 00 00 00 e0 e0 02 02 a3 a3 58 58 84 84 8e 8e 7d 7d eb eb
>
> [ 8.541519] EIP: [<7d9d67c6>]
> [ 8.541519] EIP: [<7d9d67c6>] af9005_usb_module_init+0x6b/0x9daf9005_usb_module_init+0x6b/0x9d SS:ESP 0068:89c9df2c
> SS:ESP 0068:89c9df2c
> [ 8.541519] CR2: 0000000002e00000
> [ 8.541519] CR2: 0000000002e00000
> [ 8.541519] ---[ end trace 768b6faf51370fc7 ]---
> [ 8.541519] ---[ end trace 768b6faf51370fc7 ]---
>
> git bisect start v3.16 v3.15 --
> git bisect bad 5170a3b24a9141e2349a3420448743b7c68f2223 # 22:58 0- 1 Merge branch 'akpm' (patches from Andrew Morton)
> git bisect bad 1ad96bb0a20fa26b952b2250e89d14b6397bf618 # 23:04 0- 1 Merge tag 'gpio-v3.16-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio
> git bisect bad 412dd3a6daf0cadce1b2d6a34fa3713f40255579 # 23:16 0- 1 Merge tag 'xfs-for-linus-3.16-rc1' of git://oss.sgi.com/xfs/xfs
> git bisect bad b1cce8032f6abe900b078d24f3c3938726528f97 # 23:23 0- 2 Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
> git bisect bad da85d191f58a44e149a7c07dbae78b3042909798 # 23:29 0- 19 Merge branch 'for-3.16' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq
> git bisect bad f8409abdc592e13cefbe4e4a24a84b3d5741e85f # 23:38 0- 6 Merge tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4
> git bisect bad ed81e780a7dd5698a986f246fad6a1d8d0b6f9ce # 23:44 0- 20 Merge branch 'x86-vdso-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
> git bisect bad 3f17ea6dea8ba5668873afa54628a91aaa3fb1c0 # 23:55 1- 19 Merge branch 'next' (accumulated 3.16 merge window patches) into master
> git bisect good 49eb7b0750d9483c74e9c14ae6ea1e9d62481c3c # 00:38 20+ 20 Merge tag 'tty-3.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty into next
> git bisect bad 535ec214e23adaf72c775938e9e9c6c1cf6fc5b9 # 07:40 0- 2 [media] mt9p031: Fix BLC configuration restore when disabling test pattern
> git bisect good 2c52a2fce0f00479548a076d900d1a2ddd001c27 # 21:01 20+ 20 [media] em28xx: move struct v4l2_clk *clk from struct em28xx to struct v4l2
> git bisect bad a5c075cfd2386a4f3ab4f8ed2830ebee557d4b3f # 22:07 0- 9 [media] em28xx: move fields wq_trigger and streaming_started from struct em28xx to struct em28xx_audio
> git bisect good 58159171c7f201e5d6ea2666c7b3857e782a2861 # 22:52 20+ 20 [media] em28xx: move progressive/interlaced fields from struct em28xx to struct v4l2
> git bisect good 3854b0d847d558bdc820b93ae8a93c0923d0211d # 23:31 20+ 20 [media] em28xx: move tuner frequency field from struct em28xx to struct v4l2
> git bisect good 3319e6f839cf94e33fbad27a21fc4c64f6cec74f # 00:14 20+ 20 [media] em28xx: remove field tuner_addr from struct em28xx
> # first bad commit: [a5c075cfd2386a4f3ab4f8ed2830ebee557d4b3f] [media] em28xx: move fields wq_trigger and streaming_started from struct em28xx to struct em28xx_audio
> git bisect good 3319e6f839cf94e33fbad27a21fc4c64f6cec74f # 00:55 60+ 80 [media] em28xx: remove field tuner_addr from struct em28xx
> git bisect bad 76c2c6dc46fbb5bdd73571ebd0897696c5ab4d73 # 00:58 0- 11 Add linux-next specific files for 20140917
> git bisect bad 4d046e96046faac456f4f5c94c152c52a9c51a3a # 01:09 2- 57 Add linux-next specific files for 20140918
Something went wrong during your bisection.
I can reproduce this issue with kernel v3.15, too, which doesn't have
the above commit yet.
Regards,
Frank Schäfer
> This script may reproduce the error.
>
> ----------------------------------------------------------------------------
> #!/bin/bash
>
> kernel=$1
> initrd=quantal-core-i386.cgz
>
> wget --no-clobber https://github.com/fengguang/reproduce-kernel-bug/raw/master/initrd/$initrd
>
> kvm=(
> qemu-system-x86_64
> -cpu kvm64
> -enable-kvm
> -kernel $kernel
> -initrd $initrd
> -m 320
> -smp 2
> -net nic,vlan=1,model=e1000
> -net user,vlan=1
> -boot order=nc
> -no-reboot
> -watchdog i6300esb
> -rtc base=localtime
> -serial stdio
> -display none
> -monitor null
> )
>
> append=(
> hung_task_panic=1
> earlyprintk=ttyS0,115200
> debug
> apic=debug
> sysrq_always_enabled
> rcupdate.rcu_cpu_stall_timeout=100
> panic=-1
> softlockup_panic=1
> nmi_watchdog=panic
> oops=panic
> load_ramdisk=2
> prompt_ramdisk=0
> console=ttyS0,115200
> console=tty0
> vga=normal
> root=/dev/ram0
> rw
> drbd.minor_count=8
> )
>
> "${kvm[@]}" --append "${append[*]}"
> ----------------------------------------------------------------------------
>
> Thanks,
> Fengguang
>
>
> _______________________________________________
> LKP mailing list
> LKP@...ux.intel.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists