Ubuntu

Hardy: cx88 NULL pointer dereference

Reported by Frank Haverkamp on 2008-04-06
28
Affects Status Importance Assigned to Milestone
alsa-driver (Ubuntu)
Undecided
Unassigned
linux-ubuntu-modules-2.6.24 (Ubuntu)
High
Stefan Bader

Bug Description

NULL pointer access most probably in cx88 kernel module.

[ 62.687543] cx88/2: cx2388x dvb driver version 0.0.6 loaded
[ 62.687609] cx88/2: registering cx8802 driver, type: dvb access: shared
[ 62.687670] cx88[0]/2: subsystem: 0070:9601, board: Hauppauge WinTV-HVR1300 D
VB-T/Hybrid MPEG Encoder [card=56]
[ 62.687743] cx88[0]/2: cx2388x based DVB/ATSC card
[ 62.712545] NET: Registered protocol family 10
[ 62.712838] lo: Disabled Privacy Extensions
[ 62.713325] ADDRCONF(NETDEV_UP): eth0: link is not ready
[ 62.725375] cx88[0]/0: registered device video0 [v4l2]
[ 62.725453] cx88[0]/0: registered device vbi0
[ 62.725531] cx88[0]/0: registered device radio0
[ 62.726147] ACPI: PCI Interrupt Link [APC1] enabled at IRQ 16
[ 62.726222] ACPI: PCI Interrupt 0000:03:06.0[A] -> Link [APC1] -> GSI 16 (lev
el, low) -> IRQ 16
[ 62.733827] phy0: Selected rate control algorithm 'simple'
[ 62.819127] cx2388x alsa driver version 0.0.6 loaded
[ 62.846698] DVB: registering new adapter (cx88[0])
[ 62.846761] DVB: registering frontend 0 (Conexant CX22702 DVB-T)...
[ 62.886762] ACPI: PCI Interrupt 0000:03:07.1[A] -> Link [APC2] -> GSI 17 (lev
el, low) -> IRQ 17
[ 62.886992] cx88[0]/1: CX88x/0: ALSA support for cx2388x boards
[ 62.887149] Unable to handle kernel NULL pointer dereference at 0000000000000
008 RIP:
[ 62.887207] [<ffffffff88b7ff89>] :snd:snd_device_new+0x59/0xb0
[ 62.887393] PGD 12ab9a067 PUD 12ab57067 PMD 0
[ 62.887612] Oops: 0002 [1] SMP
[ 62.887769] CPU 0
[ 62.887875] Modules linked in: arc4 dvb_pll snd_seq_midi ecb cx88_alsa blkcip
her cx22702 snd_rawmidi snd_pcm_oss snd_mixer_oss snd_seq_midi_event rt61pci rt2
x00pci rt2x00lib ipv6 snd_seq cx88_dvb cx88_vp3054_i2c videobuf_dvb snd_pcm wm87
75 rfkill snd_seq_device dvb_core input_polldev crc_itu_t snd_timer joydev usbto
uchscreen snd_page_alloc cx8800 snd serio_raw cx8802 cx88xx mac80211 nvidia(P) i
2c_nforce2 ir_common i2c_algo_bit tveeprom compat_ioctl32 parport_pc parport psm
ouse cfg80211 i2c_core<6>udev: renamed network interface wlan0 to wlan2
[ 62.890352] videodev v4l2_common v4l1_compat videobuf_dma_sg videobuf_core b
tcx_risc evdev pcspkr eeprom_93cx6 shpchp pci_hotplug soundcore button iptable_n
at nf_nat nf_conntrack_ipv4 nf_conntrack iptable_mangle iptable_filter ip_tables
 x_tables ext3 jbd mbcache sg sr_mod cdrom sd_mod ata_generic usbhid hid pata_ac
pi usb_storage libusual floppy ohci1394 ieee1394 sata_nv forcedeth pata_amd ahci
 libata scsi_mod ohci_hcd ehci_hcd usbcore thermal processor fan fbcon tileblit
font bitblit softcursor fuse
[ 62.893108] Pid: 3754, comm: modprobe Tainted: P 2.6.24-15-generic #1
[ 62.893170] RIP: 0010:[<ffffffff88b7ff89>] [<ffffffff88b7ff89>] :snd:snd_dev
ice_new+0x59/0xb0
[ 62.893294] RSP: 0000:ffff81012ab93b38 EFLAGS: 00010286
[ 62.893354] RAX: 0000000000000000 RBX: ffffffff88b6d350 RCX: 0000000000000000
[ 62.893415] RDX: ffff8101282229c0 RSI: 0000000000000000 RDI: ffff810128222a00
[ 62.893475] RBP: 0000000000001003 R08: 0000000000000000 R09: ffff8101282229c0
[ 62.893536] R10: 0000000000000000 R11: ffffffff803b6d90 R12: ffff81012ab25800
[ 62.893607] R13: ffffffff88bae620 R14: ffff81012ab93bb0 R15: ffffffff88be3ee8
[ 62.893668] FS: 00007ff0bfe746e0(0000) GS:ffffffff805b1000(0000) knlGS:0000000000000000
[ 62.893738] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 62.893798] CR2: 0000000000000008 CR3: 00000001283c7000 CR4: 00000000000006e0
[ 62.893859] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 62.893920] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 62.893982] Process modprobe (pid: 3754, threadinfo ffff81012ab92000, task ffff81012813cf80)
[ 62.894053] Stack: ffff81012ab25800 ffff81012ab25800 ffff81012ab93b98 ffffffff88b6d350
[ 62.894351] ffffffff88be4745 ffffffff88ba9128 ffff810129b39e58 ffff810128aaca00
[ 62.894613] 0000000000000018 ffff810128aaca58 0000000000000001 ffffffff88be2ca2
[ 62.894812] Call Trace:
[ 62.894937] [<ffffffff88ba9128>] :snd_timer:snd_timer_new+0x128/0x180
[ 62.895024] [<ffffffff88be2ca2>] :snd_pcm:snd_pcm_timer_init+0x52/0x1a0
[ 62.895102] [<ffffffff88bd97dd>] :snd_pcm:snd_pcm_dev_register+0xfd/0x220
[ 62.895180] [<ffffffff88b7fc9f>] :snd:snd_device_register_all+0x2f/0x60
[ 62.895251] [<ffffffff88b7ab8b>] :snd:snd_card_register+0x3b/0x390
[ 62.895324] [<ffffffff88c99c8d>] :cx88_alsa:cx88_audio_initdev+0x2ed/0x3d0
[ 62.895399] [<ffffffff80358848>] pci_device_probe+0xf8/0x170
[ 62.895466] [<ffffffff803b9edc>] driver_probe_device+0x9c/0x1b0
[ 62.895533] [<ffffffff803ba1a9>] __driver_attach+0xc9/0xd0
[ 62.895597] [<ffffffff803ba0e0>] __driver_attach+0x0/0xd0
[ 62.895659] [<ffffffff803b911d>] bus_for_each_dev+0x4d/0x80
[ 62.895726] [<ffffffff803b952c>] bus_add_driver+0xac/0x220
[ 62.895792] [<ffffffff80358ac9>] __pci_register_driver+0x69/0xb0
[ 62.895858] [<ffffffff80263b6e>] sys_init_module+0x18e/0x1a90
[ 62.895937] [<ffffffff8824b1e0>] :videobuf_dma_sg:videobuf_to_dma+0x0/0x40
[ 62.896010] [<ffffffff8020c37e>] system_call+0x7e/0x83
[ 62.896079]
[ 62.896138]
[ 62.896138] Code: 48 89 50 08 48 89 02 48 8d 83 50 01 00 00 48 89 93 50 01 00
[ 62.897258] RIP [<ffffffff88b7ff89>] :snd:snd_device_new+0x59/0xb0
[ 62.897369] RSP <ffff81012ab93b38>
[ 62.897427] CR2: 0000000000000008
[ 62.897498] ---[ end trace 8eaa2381f33a9776 ]---
[ 62.997658] cx2388x blackbird driver version 0.0.6 loaded
[ 62.997721] cx88/2: registering cx8802 driver, type: blackbird access: shared
[ 62.997783] cx88[0]/2: subsystem: 0070:9601, board: Hauppauge WinTV-HVR1300 DVB-T/Hybrid MPEG Encoder [card=56]
[ 62.997856] cx88[0]/2: cx23416 based mpeg encoder (blackbird reference design)
[ 62.998161] cx88[0]/2: registered device video1 [mpeg]
[ 63.169678] ADDRCONF(NETDEV_UP): wlan2: link is not ready
[ 63.955493] wlan2: Initial auth_alg=0

Frank Haverkamp (f-haverkamp) wrote :

haver@grobi:~$ lsb_release -rd
Description: Ubuntu hardy (development branch)
Release: 8.04

The system this occurs on I already described here: https://bugs.launchpad.net/ubuntu/+bug/212226

Frank Haverkamp (f-haverkamp) wrote :

The NULL pointer access is happening when accessing the list in
snd_device_new(). Adding a mutex when modifing the list is fixing this
problem.

Frank Haverkamp (f-haverkamp) wrote :

I would be happy if someone could take my patch, and show it to the appropriate persons so that the problem can get fixed quickly. The patch is against the latest linux git, but the problem it is in the Ubuntu alsa-driver package too.

Daniel T Chen (crimsun) wrote :

You need corresponding fixes in snd_device_free(). Good catch!

Changed in linux-ubuntu-modules-2.6.24:
assignee: nobody → ubuntu-kernel-team
importance: Undecided → High
status: New → Triaged

Daniel, I assume you meant the corresponding fixes for snd_device_disconnect() were missing as it looks like Frank already had the fixes for snd_device_free() incorporated. I'm attaching an updated patch. I also added two additional mutex_unlock() calls in snd_device_register() that were missing from the original patch from Frank.

Frank care to test this newer patch and verify it still resolves the kernel oops you were seeing. I can then nudge the kernel team to get this in before Hardy final. Thanks.

Tim Gardner (timg-tpi) wrote :
Changed in linux-ubuntu-modules-2.6.24:
assignee: ubuntu-kernel-team → timg-tpi
milestone: none → ubuntu-8.04
status: Triaged → Fix Committed
Frank Haverkamp (f-haverkamp) wrote :

I just tried out the modified patch and it still works fine for me. I am looking forward seeing the new kernel having this issue resolved. Thanks.

Juan C. Villa (juanqui) wrote :

Hey Frank,

I believe I patched my alsa kernel module, compiled, and installed it. But it's not fixing the issue for me. I am not sure if I did the process correctly. How did you get your system patched up?? Thanks in advance!

Frank Haverkamp (f-haverkamp) wrote :

Hi Juan,

I had some trouble before I found a way to patch the module. First I thought that I could compile the modules in the kernel tree, but I figured out that Ubuntu seems to build the alsa-modules separately. I tried the official way with make-kpkg for building those modules, but I failed. I commented this in:
     https://bugs.launchpad.net/ubuntu/+source/kernel-package/+bug/204698.

Finally I used the already installed alsa-sources, configured it myself, build it myself, backuped the appropriate .ko file e.g. snd.ko and replaced it with my version. I also added a printk("Modified ..."); to the code to see that my module was indeed taken ;-), which I deleted of course from the patch.

cd /usr/src/modules/alsa-driver*
sudo ./configure --with-kernel=/usr/src/linux-headers-$(uname -r)
sudo make

Frank

Juan C. Villa (juanqui) wrote :

Frank,

Thanks for the pointers! That's similar to what I did, but I am sure I made a mistake somewhere. I'll try it soon. Thanks

Dustin Kirkland  (kirkland) wrote :

Tried the 2.6.24-16 kernel, still has a a null pointer dereference.

Changed in linux-ubuntu-modules-2.6.24:
status: Fix Committed → Triaged
Dustin Kirkland  (kirkland) wrote :

syslog attached.

Tim Gardner (timg-tpi) wrote :

Can someone try a test version of LUM with Frank's patch?

wget http://launchpadlibrarian.net/13408199/linux-ubuntu-modules-2.6.24-16-generic_2.6.24-16.23ubuntu1_`uname -m`.deb
sudo dpkg -i linux-ubuntu-modules-2.6.24-16-generic_2.6.24-16.23ubuntu1_`uname -m`.deb
sudo reboot

I don't think this is ultimately the correct patch, but it may at least allow you to boot and use your audio device.

Tim Gardner (timg-tpi) wrote :

Note that this test version comes from my PPA: https://launchpad.net/~timg-tpi/+archive

Tim Gardner (timg-tpi) on 2008-04-13
Changed in linux-ubuntu-modules-2.6.24:
status: Triaged → In Progress
Changed in alsa-driver:
status: New → Invalid
.Ulli (ulli) wrote :

Your wget source leads to a 404 for my system as
http://launchpadlibrarian.net/13408199/linux-ubuntu-modules-2.6.24-16-generic_2.6.24-16.23ubuntu1_x86_64.deb
does not exist.
Used http://ppa.launchpad.net/timg-tpi/ubuntu/pool/main/l/linux-ubuntu-modules-2.6.24/linux-ubuntu-modules-2.6.24-16-generic_2.6.24-16.23ubuntu1_amd64.deb instead.

For the HVR-1300:
The oops count drops from two to one, hal fails to initialize resulting neither sound nor network is available. The large time-lag has been reeinstated.

.Ulli (ulli) wrote :
.Ulli (ulli) wrote :
.Ulli (ulli) wrote :
.Ulli (ulli) wrote :
Stefan Bader (smb) wrote :

There might be a different solution. Could someone please try the lum modules from:
https://launchpad.net/~stefan-bader-canonical/+archive
Maybe the corruption is not a locking problem, but one of a mismatch of structures.

Frank Haverkamp (f-haverkamp) wrote :

Hi Stefan,

for me I think I can say relatively sure that it is a locking problem of the list data structures. I added printouts to to point where the list is modified. Putting the mutex around all spots with list modification helped for me:
+
+ mutex_lock(&register_mutex);
  list_add(&dev->list, &card->devices); /* add to the head of list */
+ mutex_unlock(&register_mutex);
  return 0;

As Tim already said, it might not be the ultimate fix, but I think it is at least in the right direction. Has somebody contact to the alsa developers? If so what do they say?

What is your proposed fix doing? Can you point me at the change e.g. the patch?

Thanks,

Frank

Stefan Bader (smb) wrote :

Hi Frank,

the change I would like to try has to do with the way lum is build. We have an updated version of the ALSA driver but the cx88 sound module was not build with these headers. We already had another cse where this lead to corruption because a driver used a layout of ALSA struct that did not match the ones of the driver.

This might be an explanation to why the crash happens when modifying list. Why it works with locking is not completely clear to me. Especially since I cannot really understand how this works. If I look at the backtrace you povided, it starts somewhere with dev_register_all (which takes the mutex while going through the list) and then (while in that function) calls pcm_dev_register which wants to add a new timer device by calling snd_device_new. This also tries to get the mutex and I think this is just a dead lock situation.

But anyways. I attach the patch I did and maybe you can try that, just to rule out that it isn't again this structure mismatch.

Dustin Kirkland  (kirkland) wrote :

Stefan-

I tried your PPA, modules; no luck.

syslog attached.

:-Dustin

  • unnamed Edit (189 bytes, application/pgp-signature; name=signature.asc)

On Sun, 2008-04-13 at 15:29 +0000, Tim Gardner wrote:
> Note that this test version comes from my PPA:
> https://launchpad.net/~timg-tpi/+archive

Tim-

Tried yours too... No luck. Syslog available, if you want it.

:-Dustin

Stefan Bader (smb) wrote :

@Dustin

what was the outcome with Tim's version. An oops or hang?

Dustin Kirkland  (kirkland) wrote :

It was an oops with Tim's last PPA version.

Dustin Kirkland  (kirkland) wrote :

Stefan's latest PPA version, however, works:

Package: linux-ubuntu-modules-2.6.24-16-generic
Installed-Size: 17320
Architecture: amd64
Version: 2.6.24-16.23ubuntu2
Size: 4902008
MD5sum: 7283e849e20f3169135efa1084562fac

cx88 loads on boot without any null pointer exceptions. Boot happens very fast. TV card is detected properly. /dev/video? exist. MythTV finds the cards, scans the channels. TV video and sound work properly.

No ill effects that I have seen. +1, Stefan! Thanks.

:-Dustin

Dustin Kirkland  (kirkland) wrote :

Also, I'm not seeing the "HAL failed" dialog on X startup anymore either. Seems this fixed that too!

:-Dustin

Stefan Bader (smb) wrote :

Fixed the build process to include ALSA headers and ALSA config.

Changed in linux-ubuntu-modules-2.6.24:
assignee: timg-tpi → stefan-bader-canonical
status: In Progress → Fix Committed
thom (tsk) wrote :

I can confirm the patch works with both sound and video.

Had the HAL problem with saa7134.
I too installed linux-ubuntu-modules-2.6.24-16-generic_2.6.24-16.23ubuntu2, from http://ppa.launchpad.net/stefan-bader-canonical/ubuntu/ and it also works here. For the first time in hardy perfect recognition of TV- video and audio and have xaw-tv running.
No side effects

Stefan, thanks for the fix man!! :-)

BTW, more happy testimonies of this fix are here:
https://bugs.launchpad.net/ubuntu/+source/linux-ubuntu-modules-2.6.24/+bug/212271

I haven't chimed in before, but I just wanted to confirm that latest lum from stefan's PPA fixes this bug for me as well.

AdamReid (atomic0x) wrote :

Stefan's patched version of LUM worked for my pcHDTV 5500 card. No oops, no hangs, no long waits on boot. Sound works finally, with no humming or buzzing. Great work!

Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux-ubuntu-modules-2.6.24 - 2.6.24-16.23

---------------
linux-ubuntu-modules-2.6.24 (2.6.24-16.23) hardy; urgency=low

  [Amit Kucheria]

  * Poulsbo: Update to latest DRM drivers (Beta09)

  [Stefan Bader]

  * Use LUM version of ALSA headers when building media drivers.
  * Include correct ALSA config for media drivers.
    - LP: #212960

  [Daniel Mack]

  * caiaq: make high sample rates work with A8DJ
    This patch for snd_usb_caiaq makes sample rates higher than 49KHz work
    with devices which have more than 2 stereo input/output pairs.

  * caiaq: correct input channel order
    This patch corrects the input channel order of hardware supported by
    snd_usb_caiaq.

  [Matthew Ranostay]

  * hda: Correct SPDIF out default config
    Several laptops have have the SPDIF out defined as 'Digital other out'
    when it should be 'SPDIF out' in the default config.

  [Soren Hansen]

  * Remove openvm tools
    We're reliably informed that open-vm-tools is not something we
    want to support. Each VMWare product comes with its own version of
    these kernel modules (released under the GPL and everything),
    while open-vm-tools is not actually supported for any version of
    any VMWare product. This might very well change in either the
    intrepid or intrepid+1 time frame, but it's not there yet.

 -- Tim Gardner <email address hidden> Fri, 11 Apr 2008 10:57:39 -0600

Changed in linux-ubuntu-modules-2.6.24:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers