WinTV-PVR-USB2 24xxx (pvrusb2) will not mount

[Ketan Patel]

Can't find WinTV-PVR-USB2 Model 24xx device in /dev, as was possible previous to dist-upgrade.

Current kernel (not working WinTV-PVR-USB2) is 4.4.0-91-generic
Last known working kernel was 4.4.0-83-generic

Description: Ubuntu 16.04.3 LTS
Release: 16.04

linux-image-4.4.0-91-generic:
  Installed: 4.4.0-91.114
  Candidate: 4.4.0-91.114
  Version table:
 *** 4.4.0-91.114 500
        500 http://us.archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages
        100 /var/lib/dpkg/status

linux-image-extra-4.4.0-91-generic:
  Installed: 4.4.0-91.114
  Candidate: 4.4.0-91.114
  Version table:
 *** 4.4.0-91.114 500
        500 http://us.archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages
        500 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages
        100 /var/lib/dpkg/status

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Klas Adolfsson (klasa)]

I have this problem too. For me it appeared between 4.4.0-87-generic and 4.4.0-89-generic on 16.04 LTS. I have confirmed it by rebooting multiple times with both kernels.

It seems like there is a null reference problem in tveeprom_hauppauge_analog() in drivers/media/common/tveeprom.c. This code is called from pvrusb2-eeprom.c while reading the firmware.

The firmware itself seem to be the same while booting both working and non-working kernels, so I figure the problem is in the kernel.

dmesg:
[ 11.767533] cx25840 11-0044: loaded v4l-cx25840.fw firmware (16382 bytes)
[ 14.730812] BUG: unable to handle kernel NULL pointer dereference at 0000000000000002
[ 14.730837] IP: [<ffffffffc1595818>] tveeprom_hauppauge_analog+0x818/0xbc0 [tveeprom]

I will try to attach both the firmware and a full output from dmesg.

[Klas Adolfsson (klasa)]

Some more information:
- Attaching full dmesg of working and non-working boot. Also .ko from working and non-working kernel (although I doubt there is any debug info in there)
- I am using different hardware than the original poster, WinTV HVR-1900 Model 73219 LF, rev D2F5, but the same driver
- There is also someone else affected by the bug here: https://askubuntu.com/questions/945568/no-dev-mount-for-usb-device
- The newest kernel available for me on 16.04 LTS is also affected, 4.4.0-96-generic.

[Klas Adolfsson (klasa)]

A diff with the fix is attached.

It is indeed the changes in /drivers/media/usb/pvrusb2/pvrusb2-eeprom.c between 4.4.0-87 and 4.4.0-89 that causes the driver to crash.

I reverted the changes and compiled them in 4.4.0-96. After finding the newly compiled pvrusb2.ko and placing it in my existing -96 kernel, everything worked perfectly.

I can't fully figure out the bug though, in the working -87 version a dummy object is created and used in the call to tveeprom_hauppauge_analog(), which I can't see is using it. I guess there may be a macro or something that expands and then references the object. In the non-working -98 version, the fake object has been replaced with NULL and that seem to cause the problem. Meanwhile, the mainline kernel seem to have removed the parameter entirely.

Source code for reference:
Working:
http://kernel.ubuntu.com/git/ubuntu/ubuntu-xenial.git/tree/drivers/media/usb/pvrusb2/pvrusb2-
eeprom.c?h=Ubuntu-4.4.0-87.110

Non-working:
http://kernel.ubuntu.com/git/ubuntu/ubuntu-xenial.git/tree/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c?h=Ubuntu-4.4.0-89.112

Mainline kernel change that caused the bug:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c?h=v4.14-rc1&id=6830733d53a4517588e56227b9c8538633f0c496

Later removal of the problematic function argument in mainline kernel:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c?h=v4.14-rc1&id=446aba663b8240b24202cb8902b0d5c8f91aa3da
(I have no idea if the current mainline kernel works or not)

I hope this can get resolved for future 4.4.0 kernels in 16.04 LTS!

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "diff.txt" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]