evbug.c spams logs and causes high system loads

[Makoto]

This occurs only if you have a USB interface.

Whenever I've installed a new kernel (through updates only), something called evbug.c appears prevalently, and pretty much every picosecond that the system is up.

Here's what it looks like.

[ 177.005744] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 0, Code: 0, Value: 0
[ 177.017835] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 3, Code: 24, Value: 0
[ 177.017841] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 3, Code: 28, Value: 0
[ 177.017845] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 1, Code: 333, Value: 0
[ 177.017849] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 0, Code: 0, Value: 0
[ 177.031187] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 0, Code: 0, Value: 0
[ 177.041000] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 0, Code: 0, Value: 0
[ 177.055526] evbug.c: Event. Dev: isa0060/serio1/input0, Type: 0, Code: 0, Value: 0

------

Obviously truncated for various reasons.

I took a look at the logs (after unplugging my USB mouse), and noticed that it occurs roughly 249 times a second. In the seven seconds alone that I let this run, the log (using dmesg | grep -i evbug > evbug.txt) had become 123.2KB. *All* of that size is from *only* that message!

For me, this has caused my log files to swell to enormous sizes, before I knew a workaround existed. By the time I found it, my log file was about 3GB, and I had no other choice than to write what was in there to /dev/null.

Anyway, this is is a serious bug, which many people need to be made aware of, and it needs to be fixed immediately.

Here's the workaround I used from http://linux.derkeiler.com/Mailing-Lists/Debian/2004-01/5537.html :

1) sudo rmmod evbug
2) sudo rm /lib/modules/$(uname -r)/kernel/drivers/input/evbug.ko

...and the messages stop, until I install another kernel.

If I get the time, I can write an [ugly] patch in the form of a cron job that will check to see if evbug.ko exists, and then perform the commands.

[Dereck Wonnacott (dereck)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. I am changing the package to 'Linux' because evbug appears to be part of the kernel. Please include the following additional information, if you have not already done so, as required by the Ubuntu Kernel Team:

1. Please include the output of the command "uname -a" in your next response. It should be one, long line of text which includes the exact kernel version you're running, as well as the CPU architecture.
2. Please run the command "dmesg > dmesg.log" after a fresh boot and attach the resulting file "dmesg.log" to this bug report.
3. Please run the command "sudo lspci -vvnn > lspci-vvnn.log" and attach the resulting file "lspci-vvnn.log" to this bug report. (note "vv" not 'w")
4. Once the above information is attached, set the bug status to 'new' to signify that it is ready for triage or review.

For your reference, the full description of procedures for kernel-related bug reports is available at [WWW] https://wiki.ubuntu.com/KernelTeamBugPolicies Thanks in advance!

[Makoto (makotothedragon)]

Result of uname -a: Linux LATLON-Callisto 2.6.24-19-generic #1 SMP Wed Jun 4 16:35:01 UTC 2008 i686 GNU/Linux

[Makoto (makotothedragon)]

Here's the bash script that I wrote. It does the job pretty nicely (had the chance to test it recently). Unfortunately, I haven't had the chance to use it as an actual *cron*, but it will accomplish the same thing when run as root.

[Leann Ogasawara (leannogasawara)]

The Ubuntu Kernel Team is planning to move to the 2.6.27 kernel for the upcoming Intrepid Ibex 8.10 release. As a result, the kernel team would appreciate it if you could please test this newer 2.6.27 Ubuntu kernel. There are one of two ways you should be able to test:

1) If you are comfortable installing packages on your own, the linux-image-2.6.27-* package is currently available for you to install and test.

--or--

2) The upcoming Alpha5 for Intrepid Ibex 8.10 will contain this newer 2.6.27 Ubuntu kernel. Alpha5 is set to be released Thursday Sept 4. Please watch http://www.ubuntu.com/testing for Alpha5 to be announced. You should then be able to test via a LiveCD.

Please let us know immediately if this newer 2.6.27 kernel resolves the bug reported here or if the issue remains. More importantly, please open a new bug report for each new bug/regression introduced by the 2.6.27 kernel and tag the bug report with 'linux-2.6.27'. Also, please specifically note if the issue does or does not appear in the 2.6.26 kernel. Thanks again, we really appreicate your help and feedback.

[Henrique Ferreiro (henrique-ferreiro)]

For me, kernel 2.6.27 has the same bug.

uname -a: Linux macbook 2.6.27-7-generic #1 SMP Thu Oct 30 04:12:22 UTC 2008 x86_64 GNU/Linux

[Launchpad Janitor (janitor)]

Per a decision made by the Ubuntu Kernel Team, bugs will longer be assigned to the ubuntu-kernel-team in Launchpad as part of the bug triage process. The ubuntu-kernel-team is being unassigned from this bug report. Refer to https://wiki.ubuntu.com/KernelTeamBugPolicies for more information. Thanks.

[Steve Beattie (sbeattie)]

It's curious that the evbug module is getting loaded, because by default /etc/modprobe.d/blacklist contains an entry to prevent evbug from getting loaded. Can you confirm that it's blacklisted somewhere under /etc/modprobe.d/ on your system? Can you report the results of lsmod when it gets loaded, to see if some other module is pulling it in? Thanks.

[PtOLU8zjbZxlgNOiyGyd (lkgdx5kefrptmd7ccufa-deactivatedaccount)]

I'd bet this bug affects LiveCD installs only. I installed from a 9.04 alpha6 LiveCD and suffered from random crashes caused by buffers overflows that could only be attributed to this spamming. After reading this bug I decided to reinstall module-init-tools and lo-and-behold! dpkg asks me to replace damaged configuration files. I allowed dpkg to replace all files with original ones and instead of a bunch of empty files I have now a decent set of blacklisted modules including evbug in blacklist.conf, which was very much empty before.

[Makoto (makotothedragon)]

If the bug still persists, I haven't managed to notice anything with it in the nearly year time since I've reported it. After blacklisting it and removing it, the annoying spam messages have never popped up again.

No other module is loading evbug in, not to my knowledge on the machine in question - I had deleted and unloaded the module. Not sure if that's a safe thing or not.

[Dana Goyette (danagoyette)]

This is not only a nuisance; it's a real security hazard, as well! If you think about it, having the kernel report every keycode in dmesg... is like having a world-readable keylogger installed.
In my case (on karmic), evbug was loading even when blacklisted; to actually disable it, I had to dpkg-divert it out of the way.

[joel jaeggli (joelja)]

This is occuring again in:

Description: Ubuntu karmic (development branch)
Release: 9.10

Linux chickenhawk 2.6.31-4-generic #22-Ubuntu SMP Fri Jul 24 18:06:15 UTC 2009 i686 GNU/Linux

looks like a regression...

as per previously dmesg fills up with:

[80457.612191] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 54
[80457.612226] evbug.c: Event. Dev: input5, Type: 1, Code: 54, Value: 1
[80457.612245] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80457.756232] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 39
[80457.756258] evbug.c: Event. Dev: input5, Type: 1, Code: 39, Value: 1
[80457.756273] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80457.917998] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 54
[80457.918033] evbug.c: Event. Dev: input5, Type: 1, Code: 54, Value: 0
[80457.918054] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80457.959911] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 39
[80457.959943] evbug.c: Event. Dev: input5, Type: 1, Code: 39, Value: 0
[80457.959962] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80458.106146] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 28
[80458.106174] evbug.c: Event. Dev: input5, Type: 1, Code: 28, Value: 1
[80458.106189] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80458.264272] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 28
[80458.264306] evbug.c: Event. Dev: input5, Type: 1, Code: 28, Value: 0
[80458.264324] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80458.360908] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 28
[80458.360935] evbug.c: Event. Dev: input5, Type: 1, Code: 28, Value: 1
[80458.360950] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80458.542204] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 28
[80458.542232] evbug.c: Event. Dev: input5, Type: 1, Code: 28, Value: 0
[80458.542247] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80461.861002] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 56
[80461.861039] evbug.c: Event. Dev: input5, Type: 1, Code: 56, Value: 1
[80461.861059] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80461.890069] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 29
[80461.890097] evbug.c: Event. Dev: input5, Type: 1, Code: 29, Value: 1
[80461.890112] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80462.014530] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 203
[80462.014556] evbug.c: Event. Dev: input5, Type: 1, Code: 105, Value: 1
[80462.014571] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80462.213624] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 203
[80462.213648] evbug.c: Event. Dev: input5, Type: 1, Code: 105, Value: 0
[80462.213662] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80462.385760] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 29
[80462.385778] evbug.c: Event. Dev: input5, Type: 1, Code: 29, Value: 0
[80462.385788] evbug.c: Event. Dev: input5, Type: 0, Code: 0, Value: 0
[80462.394000] evbug.c: Event. Dev: input5, Type: 4, Code: 4, Value: 56
[80462.394024] evbug.c: Event. Dev: input5, Type: 1, Code: 56, Value: 0
[80...

[joel jaeggli (joelja)]

obviously:

rmmod evbug

makes this stop.

the following also shows this module not being blacklisted if in fact it should be:

root@chickenhawk:/etc/modprobe.d# ls
alsa-base.conf blacklist-firewire.conf blacklist-watchdog.conf
blacklist-ath_pci.conf blacklist-framebuffer.conf libpisock9.conf
blacklist.conf blacklist-modem.conf
blacklist.conf~ blacklist-oss.conf
root@chickenhawk:/etc/modprobe.d# grep evbug *.conf
root@chickenhawk:/etc/modprobe.d#

[Makoto (makotothedragon)]

Joel -

I don't have a copy of Karmic handy, nor do I have the time to test it, but IIRC, the location that it looks for the blacklisted module is /etc/modprobe.d/modprobe.conf. If you cat that, and then pipe it through a grep evbug, then we've got a regression on our hands, or a major problem.

[what_if (jonathan-a-phelps)]

This is _not_ a bug, technically speaking but a configuration issue.

When the kernel module evbug is installed this is what it should do. That said, evbug is not a module that should be automatically loaded by a desktop linux system due to issues such as this. Developers can load this module manually.

Anyone having this issue should check their /var/log directory for large files.

[what_if (jonathan-a-phelps)]

This bug is fixed in newer packages 'module-init-tools_3.10-2_amd64.deb' and 'module-init-tools_3.10-2_i386.deb'.

Recommending version upgrade on Jaunty from 3.7~9-2 to 3.10-2.

[Scott James Remnant (Canonical) (canonical-scott)]

This module has been blacklisted since almost the dawn of time.

If you are missing a blacklist line for it, it is because you have modified your /etc/modprobe.d/blacklist.conf file

At least two reporters have obvious blacklist.conf~ files alongside it, so no denying it please ;-)

[Shang Wu (shangwu)]

I am on Karmic, and I am start having this issue now...

The module-init-tools is on version 3.10-2.

Tried rmmod evbug, but when I plugged in my USB mouse, the issue start happening again.

I am on 2.6.31-9-generic-pae #29-Ubuntu SMP Sun Aug 30 18:36:39 UTC 2009 i686 GNU/Linux

[Scott James Remnant (Canonical) (canonical-scott)]

On Wed, 2009-09-09 at 21:10 +0000, Shang Wu wrote:

> I am on Karmic, and I am start having this issue now...
>
> The module-init-tools is on version 3.10-2.
>
> Tried rmmod evbug, but when I plugged in my USB mouse, the issue start
> happening again.
>
> I am on 2.6.31-9-generic-pae #29-Ubuntu SMP Sun Aug 30 18:36:39 UTC 2009
> i686 GNU/Linux
>
Attach your /etc/modprobe.d/blacklist.conf file

Scott
--
Scott James Remnant
<email address hidden>

[Muelli (ubuntu-bugs-auftrags-killer)]

Okay, I was hit by this "bug", too. While I see that the evdebug module perfectly does what it's meant to do, I don't really see why this module is being loaded automatically.

Anyway, I accidentally my /etc/modprobe.d/blacklist{,.conf} and now I want to restore it. Unfortunately, neither apt-get install --reinstall module-init-tools nor dpkg-reconfigure module-init-tools help me. What's the correct way of bringing the default config back?

[Nev Delap (nevdelap)]

Hi,

I have this problem in maverick, here is the head of my blacklist.conf.
___________________
# This file lists those modules which we don't want to be loaded by
# alias expansion, usually so some other driver will be loaded for the
# device instead.

# evbug is a debug tool that should be loaded explicitly
blacklist evbug <<<<<<<<<<<<<<<<<<<

# these drivers are very simple, the HID drivers are usually preferred
blacklist usbmouse
blacklist usbkbd
___________________

My kernel and debug logs where 500-900MB per week.

I removed the module and deleted the file.

So I wonder why it's loading if it is blacklisted?

But I'm just posting to flag that the problem is still around, and it doesn't seem to be invalid for the reason it has been marked as invalid.

$ uname -a
Linux bananinha 2.6.36-020636-generic #201010210905 SMP Thu Oct 21 10:17:53 UTC 2010 i686 GNU/Linux

[David Steiner (davidsteiner2010)]

just got spammed with messages from evbug.c

fresh install of maverick amd64
there was no /etc/modprobe.d/blacklist.conf file present, and neither was evbug blacklisted in the other files.

$ uname -a
Linux mango 2.6.35-28-generic #49-Ubuntu SMP Tue Mar 1 14:39:03 UTC 2011 x86_64 GNU/Linux

[David (dtschaefer)]

@ Muelli (ubuntu-bugs-auftrags-killer)

The correct way to restore the /etc/foo/bar* files is

sudo dpkg -i --force-confnew /var/cache/apt/archives/packagename.deb

[Hannu E K N (hannu-n)]

$ journalctl | grep evbug | wc -l
818321
$ uname -a
Linux gflap 5.13.0-52-generic #59~20.04.1-Ubuntu SMP Thu Jun 16 21:21:28 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

---
$ journalctl | grep evbug | sed -re 's/^.*(kernel.* )Code.*/\1/' | sort -u
kernel: evbug: Event. Dev: input13, Type: 0,
kernel: evbug: Event. Dev: input13, Type: 1,
kernel: evbug: Event. Dev: input13, Type: 17,
kernel: evbug: Event. Dev: input13, Type: 4,
kernel: evbug: Event. Dev: input14, Type: 0,
kernel: evbug: Event. Dev: input14, Type: 1,
kernel: evbug: Event. Dev: input14, Type: 17,
kernel: evbug: Event. Dev: input14, Type: 4,
kernel: evbug: Event. Dev: input15, Type: 0,
kernel: evbug: Event. Dev: input15, Type: 17,
kernel: evbug: Event. Dev: input18, Type: 0,
kernel: evbug: Event. Dev: input18, Type: 1,
kernel: evbug: Event. Dev: input18, Type: 4,
kernel: evbug: Event. Dev: input19, Type: 0,
kernel: evbug: Event. Dev: input19, Type: 1,
kernel: evbug: Event. Dev: input19, Type: 4,
kernel: evbug: Event. Dev: input31, Type: 0,
kernel: evbug: Event. Dev: input31, Type: 1,
kernel: evbug: Event. Dev: input31, Type: 2,
kernel: evbug: Event. Dev: input31, Type: 4,
kernel: evbug: Event. Dev: input4, Type: 0,
kernel: evbug: Event. Dev: input4, Type: 17,
kernel: evbug: Event. Dev: input5, Type: 0,
kernel: evbug: Event. Dev: input5, Type: 1,
kernel: evbug: Event. Dev: input5, Type: 2,
kernel: evbug: Event. Dev: input5, Type: 4,
kernel: evbug: Event. Dev: input7, Type: 0,
kernel: evbug: Event. Dev: input7, Type: 1,
kernel: evbug: Event. Dev: input7, Type: 2,
kernel: evbug: Event. Dev: input7, Type: 4,
sep 17 11:09:43 gflap kernel: evbug: Connected device: input0 (Lid Switch at PNP0C0D/button/input0)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input14 (Asus Keyboard at usb-0000:00:14.0-8/input0)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input15 (Asus Keyboard at usb-0000:00:14.0-8/input1)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input16 (Asus Keyboard at usb-0000:00:14.0-8/input2)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input17 (Asus Wireless Radio Control at asus-wireless/input0)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input18 (PC Speaker at isa0061/input0)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input19 (Asus WMI hotkeys at asus-nb-wmi/input0)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input1 (Sleep Button at PNP0C0E/button/input0)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input20 (HDA NVidia HDMI/DP,pcm=3 at ALSA)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input21 (HDA NVidia HDMI/DP,pcm=7 at ALSA)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input22 (HDA NVidia HDMI/DP,pcm=8 at ALSA)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input23 (HDA NVidia HDMI/DP,pcm=9 at ALSA)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input24 (HDA NVidia HDMI/DP,pcm=10 at ALSA)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input2 (Power Button at PNP0C0C/button/input0)
sep 17 11:09:43 gflap kernel: evbug: Connected device: input3 (Power Button at LNXPWRBN/button/input0)
sep 17 11:09:43 gflap kernel: evbug: Connec...