Unplugging USB Headset causes Kernel Panic

Bug #1097396 reported by Tony Espy
78
This bug affects 15 people
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Fix Released
High
Unassigned
Precise
Fix Released
High
Chris J Arges
Raring
Fix Released
High
Unassigned

Bug Description

SRU Justification:

  Impact: When using a USB audio headset with pulseaudio, if one unplugs the headset the kernel will panic.

  Fix: This issue was because of some stable patches that were backported. The problem was shown to Takashi Iwai (upstream alsa), and he created a patch to fix this issue which was then applied to the 3.4 branch of the stable tree. This patch has then been cherry-picked to 3.2 precise. I also requested that this patch be applied to the 3.2 stable branch.
Here is the link to the commit: http://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=commit;h=115b96e58609cff057d22d0e6118dae093763461

  Testcase: Plug in a USB audio headset (ensure pulseaudio is working). Unplug it. If the kernel does not panic, then the test passes.

--

After a recent update which included a new kernel, my machine started to panic when I removed my USB headset after our morning stand-ups.

The headset is a Cyber Acoustics USB headset.

The crash is pretty easy to reproduce. Plugin the headset, unplug it, panic...

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: linux-image-3.2.0-35-generic-pae 3.2.0-35.55
ProcVersionSignature: Ubuntu 3.2.0-35.55-generic-pae 3.2.34
Uname: Linux 3.2.0-35-generic-pae i686
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
ApportVersion: 2.0.1-0ubuntu15.1
Architecture: i386
ArecordDevices:
 **** List of CAPTURE Hardware Devices ****
 card 0: Intel [HDA Intel], device 0: CONEXANT Analog [CONEXANT Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: espy 2270 F.... pulseaudio
Card0.Amixer.info:
 Card hw:0 'Intel'/'HDA Intel at 0xf2520000 irq 45'
   Mixer name : 'Intel IbexPeak HDMI'
   Components : 'HDA:14f15069,17aa21a4,00100302 HDA:80862804,17aa21b5,00100000'
   Controls : 26
   Simple ctrls : 8
Card29.Amixer.info:
 Card hw:29 'ThinkPadEC'/'ThinkPad Console Audio Control at EC reg 0x30, fw 6UHT33WW-1.14'
   Mixer name : 'ThinkPad EC 6UHT33WW-1.14'
   Components : ''
   Controls : 1
   Simple ctrls : 1
Card29.Amixer.values:
 Simple mixer control 'Console',0
   Capabilities: pswitch pswitch-joined penum
   Playback channels: Mono
   Mono: Playback [on]
Date: Tue Jan 8 13:39:30 2013
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 11.04 "Natty Narwhal" - Release i386 (20110427.1)
MachineType: LENOVO 2901CTO
MarkForUpload: True
ProcEnviron:
 TERM=xterm
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
ProcFB: 0 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.2.0-35-generic-pae root=UUID=b154a7ff-6a2a-4dae-804d-0e17319a3cec ro quiet splash vt.handoff=7
RelatedPackageVersions:
 linux-restricted-modules-3.2.0-35-generic-pae N/A
 linux-backports-modules-3.2.0-35-generic-pae N/A
 linux-firmware 1.79.1
SourcePackage: linux
StagingDrivers: mei
UpgradeStatus: Upgraded to precise on 2012-03-03 (311 days ago)
dmi.bios.date: 04/25/2012
dmi.bios.vendor: LENOVO
dmi.bios.version: 6UET69WW (1.49 )
dmi.board.name: 2901CTO
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr6UET69WW(1.49):bd04/25/2012:svnLENOVO:pn2901CTO:pvrThinkPadT410s:rvnLENOVO:rn2901CTO:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 2901CTO
dmi.product.version: ThinkPad T410s
dmi.sys.vendor: LENOVO

Revision history for this message
Tony Espy (awe) wrote :
Revision history for this message
Brad Figg (brad-figg) wrote : Status changed to Confirmed

This change was made by a bot.

Changed in linux (Ubuntu):
status: New → Confirmed
Revision history for this message
Tony Espy (awe) wrote :
Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

Hi Tony,

Do you happen to know the last kernel version that did not cause this panic? You should be able to identify in by reviewing the grub menu or reviewing /var/log/dpkg.log*

If you can identify the last good and first bad kernel, I can perform a kernel bisect to identify the commit that caused the regression.

Another good test would be to see if this still happens in the latest development kernel, so we know if it exists in Raring. If you have a chance, can you test v3.8-rc2? It can be downloaded from:
http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.8-rc2-raring/

Note that you will need to install both the linux-image and linux-image-extra .deb packages.

Changed in linux (Ubuntu):
importance: Undecided → High
tags: added: kernel-da-key needs-bisect snd-complete-urb
Changed in linux (Ubuntu):
status: Confirmed → Incomplete
Revision history for this message
Tony Espy (awe) wrote :

Looks like -35 broke it, as -34 works fine.

I'll give the Raring kernel a try first thing tomorrow.

Revision history for this message
Tony Espy (awe) wrote :

No kernel panic with the Raring kernel either...

Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

Can you test the following two upstream kernels to confirm the bug wasn't introduced by an Ubuntu SAUCE patch:

v3.2.33: http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.2.33-precise/
v3.2.34: http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.2.34-precise/

If the bug was introduced upstream, then 3.2.33 shouldn't have the bug and 3.2.34 should.

Revision history for this message
Tony Espy (awe) wrote :

v3.2.33: OK
v3.2.34: panic

Looks like we have a winner!

Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

Thanks for testing, Tony. I'll start a bisect between these two kernels. Will you be able to test about 7 - 10 kernels? If so, I'll post them here as the bisect progresses.

Revision history for this message
Joseph Salisbury (jsalisbury) wrote :

Actually, the next best this to do would be to see if this is already fixed in the latest version of 3.2 stable, since it is fixed in mainline.

Can you test v3.2.36:
http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.2.36-precise/

It might be better for me to perform a "Reverse" bisect and identify the upstream commit that fixes this versus trying to find the 3.2.34 commit that breaks things.

Chris J Arges (arges)
Changed in linux (Ubuntu Precise):
importance: Undecided → High
Changed in linux (Ubuntu Raring):
status: Incomplete → Fix Released
Changed in linux (Ubuntu Precise):
status: New → Triaged
Revision history for this message
Chris J Arges (arges) wrote :
Changed in linux (Ubuntu Precise):
assignee: nobody → Chris J Arges (arges)
status: Triaged → In Progress
Revision history for this message
Chris J Arges (arges) wrote :
Revision history for this message
Chris J Arges (arges) wrote :
Revision history for this message
Chris J Arges (arges) wrote :

3.2.0-34-generic #53-Ubuntu - works

Revision history for this message
Chris J Arges (arges) wrote :

Ok I've bisected down to this commit causing the issue:
502fac43542acaa225492e5d6f6b5cb0df7fc86c is the first bad commit
commit 502fac43542acaa225492e5d6f6b5cb0df7fc86c
Author: Takashi Iwai <email address hidden>
Date: Fri Oct 12 15:12:55 2012 +0200

    ALSA: usb-audio: Fix races at disconnection

    BugLink: http://bugs.launchpad.net/bugs/1081676

    commit 978520b75f0a1ce82b17e1e8186417250de6d545 upstream.
--

However, it works in newer versions, so I'll look around to see if any patches have fixed this on top of it.
So far I've seen one candidate and its already in the stack:

commit 5eddd573ea494ede9eed59b1468d7079962cb873
Author: Takashi Iwai <email address hidden>
Date: Tue Nov 13 11:22:48 2012 +0100

    ALSA: usb-audio: Fix mutex deadlock at disconnection

    BugLink: http://bugs.launchpad.net/bugs/1081676

    commit 10e44239f67d0b6fb74006e61a7e883b8075247a upstream.

Revision history for this message
Chris J Arges (arges) wrote :

http://people.canonical.com/~arges/lp1097396/

A fix with this revert can be tested here. So far it works for me, I can still use the usb headset properly.

Revision history for this message
Chris J Arges (arges) wrote :

Here is a backtrace from crash:

      KERNEL: kernel_link
    DUMPFILE: dump.201301181214 [PARTIAL DUMP]
        CPUS: 4
        DATE: Fri Jan 18 12:14:12 2013
      UPTIME: 00:00:37
LOAD AVERAGE: 0.76, 0.19, 0.06
       TASKS: 341
    NODENAME: ubuntu-ThinkPad-X220
     RELEASE: 3.2.0-35-generic
     VERSION: #55-Ubuntu SMP Wed Dec 5 17:42:16 UTC 2012
     MACHINE: x86_64 (2491 Mhz)
      MEMORY: 3.9 GB
       PANIC: "[ 37.128952] Oops: 0000 [#1] SMP " (check log for details)
         PID: 1895
     COMMAND: "zeitgeist-fts"
        TASK: ffff880106072e00 [THREAD_INFO: ffff8800c81d2000]
         CPU: 0
       STATE: TASK_RUNNING (PANIC)

crash> bt
PID: 1895 TASK: ffff880106072e00 CPU: 0 COMMAND: "zeitgeist-fts"
 #0 [ffff88011e2038c0] machine_kexec at ffffffff8103947a
 #1 [ffff88011e203930] crash_kexec at ffffffff810b52c8
 #2 [ffff88011e203a00] oops_end at ffffffff8165e168
 #3 [ffff88011e203a30] no_context at ffffffff816431ce
 #4 [ffff88011e203a70] __bad_area_nosemaphore at ffffffff816433a4
 #5 [ffff88011e203ad0] bad_area_nosemaphore at ffffffff816433d6
 #6 [ffff88011e203ae0] do_page_fault at ffffffff81660da6
 #7 [ffff88011e203bf0] page_fault at ffffffff8165d735
    [exception RIP: snd_complete_urb+107]
    RIP: ffffffffa03f041b RSP: ffff88011e203ca8 RFLAGS: 00010002
    RAX: 0000000000000000 RBX: ffff8801137332b8 RCX: 0000000000000002
    RDX: ffff8800ce171900 RSI: ffff8800ce171900 RDI: ffff8800ce171900
    RBP: ffff88011e203cd8 R8: 0000000000000206 R9: 0000000000000000
    R10: 0000000002552620 R11: 0000000000000000 R12: ffff880113733358
    R13: 0000000000000000 R14: ffff8800ce171900 R15: 0000000000000000
    ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000
 #8 [ffff88011e203ce0] usb_hcd_giveback_urb at ffffffff814940e4
 #9 [ffff88011e203d10] ehci_urb_done at ffffffff814ac0a0
#10 [ffff88011e203d50] sitd_complete at ffffffff814ad0ab
#11 [ffff88011e203d80] scan_periodic at ffffffff814ad536
#12 [ffff88011e203e10] ehci_work at ffffffff814ad7c9
#13 [ffff88011e203e30] ehci_irq at ffffffff814adaa1
#14 [ffff88011e203e90] usb_hcd_irq at ffffffff814937ed
#15 [ffff88011e203eb0] handle_irq_event_percpu at ffffffff810d9dc5
#16 [ffff88011e203f10] handle_irq_event at ffffffff810d9fd1
#17 [ffff88011e203f40] handle_fasteoi_irq at ffffffff810dcffa
#18 [ffff88011e203f60] handle_irq at ffffffff81016282
#19 [ffff88011e203f80] do_IRQ at ffffffff816680da
--- <IRQ stack> ---
#20 [ffff8800c81d3f50] ret_from_intr at ffffffff8165d46e
    RIP: ffffffffffffff9e RSP: 0000000000000206 RFLAGS: 00000033
    RAX: 000000000255fc70 RBX: 0000000000000000 RCX: 00000000025683f0
    RDX: 00007fff27884d90 RSI: 0000000002569470 RDI: 00007f028050a730
    RBP: 0000000000000001 R8: 0000000000000767 R9: 0000000002552620
    R10: 0000000000000000 R11: ffffffff816655c2 R12: 00000000025bda70
    R13: 0000000002557940 R14: 00007fff27884c18 R15: 000000010256c220
    ORIG_RAX: 00007f02740080a0 CS: 7f0280515551 SS: 7fff27884d20
bt: WARNING: possibly bogus exception frame

Revision history for this message
Chris J Arges (arges) wrote :

Commented on linux stable branch:
http://<email address hidden>/msg29160.html

Revision history for this message
Chris J Arges (arges) wrote :

Takashi Iwai has posted an update here:
http://<email address hidden>/msg29403.html

tags: removed: needs-bisect
Revision history for this message
Chris J Arges (arges) wrote :
Chris J Arges (arges)
description: updated
Revision history for this message
Chris J Arges (arges) wrote :

SRU sent to ubuntu ktml.

Revision history for this message
Rik Shaw (rik-shaw) wrote :

I have just run into this bug with a user who has the the stable 3.2 series in 12.04 (32 bit, all updates applied: can't immediately confirm their kernel version but it is the the 3.2.x).

I am wondering if anyone has any info on if the 3.5 series (package in precise to provide this: linux-image-generic-lts-quantal) has the same issue or not? Reading the other links above, I am not able to understand if this may be a relatively "safe" update this user can apply to address the problem.

Otherwise, it seems work is going on for an update to the 3.2 series?

Thanks again to Chris and others here for the work in finding the problem. Any help for how to practically (and simply) make a recommendation to a non-tech user on how to solve the problem ("wait" or "update to quantal kernel, etc.) would be greatly appreciated.

Tim Gardner (timg-tpi)
Changed in linux (Ubuntu Precise):
status: In Progress → Fix Committed
Revision history for this message
Luis Henriques (henrix) wrote :

This bug is awaiting verification that the kernel for Precise in -proposed solves the problem (3.2.0-38.59). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-precise' to 'verification-done-precise'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-precise
Revision history for this message
Rik Shaw (rik-shaw) wrote :

I am now away from the user that had this specific issue. Before leaving, I updated the machine to use the lts-quantal kernel (listed above), and haven't had reports of the kernel panics since, but this hasn't been thoroughly tested yet.

I am hoping someone else with this issue is able to test the proposed 3.2.x kernel to verify the bug has been squashed! If there isn't any confimation of this, I may have to run out and buy a USB headset to test myself.

Thanks so much for the work so far.

Revision history for this message
madmaze (matthias-a-lee) wrote :

I just tested it, seems to be working.
Marking as verification-done-precise

tags: added: verification-done-precise
tags: removed: verification-needed-precise
Revision history for this message
Kohsuke Kawaguchi (kk-kohsuke) wrote :

I tried the proposed 3.2.0-38 and confirmed that that fixed the problem.

Revision history for this message
Adam Conrad (adconrad) wrote : Update Released

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (17.3 KiB)

This bug was fixed in the package linux - 3.2.0-38.60

---------------
linux (3.2.0-38.60) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1124013

  [ Herton Ronaldo Krzesinski ]

  * SAUCE: fix i915 regression after commit 9594e7e
    - LP: #1119809

linux (3.2.0-38.59) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1116240

  [ Andy Whitcroft ]

  * [Config] enable various HVC consoles
    - LP: #1102206

  [ Herton Ronaldo Krzesinski ]

  * [Config] updateconfigs for 3.2.36 stable update

  [ Stefan Bader ]

  * (config) Move 9p modules into generic package
    - LP: #1107658

  [ Upstream Kernel Changes ]

  * Revert "device_cgroup: fix RCU usage"
    - LP: #1096966
  * Revert "sched, autogroup: Stop going ahead if autogroup is disabled"
    - LP: #1096966
  * Revert "ath9k_hw: Update AR9003 high_power tx gain table"
    - LP: #1096966
  * Revert "mm: vmscan: fix endless loop in kswapd balancing"
    - LP: #1096966
  * freezer: PF_FREEZER_NOSIG should be cleared along with PF_NOFREEZE
    - LP: #1096966
  * i915: Quirk no_lvds on Gigabyte GA-D525TUD ITX motherboard
    - LP: #1096966
  * drm/i915: Add no-lvds quirk for Supermicro X7SPA-H
    - LP: #1096966
  * ACPI: missing break
    - LP: #1096966
  * workqueue: convert BUG_ON()s in __queue_delayed_work() to
    WARN_ON_ONCE()s
    - LP: #1096966
  * hwmon: (coretemp) Improve support of recent Atom CPU models
    - LP: #1096966
  * hwmon: (coretemp) Add support for Atom D2000 and N2000 series CPU
    models
    - LP: #1096966
  * hwmon: (coretemp) Improve support for TjMax detection on Atom CPUs
    - LP: #1096966
  * hwmon: (coretemp) Add support for Atom CE4110/4150/4170
    - LP: #1096966
  * ARM: 7566/1: vfp: fix save and restore when running on pre-VFPv3 and
    CONFIG_VFPv3 set
    - LP: #1096966
  * sata_svw: check DMA start bit before reset
    - LP: #1096966
  * drivers/leds/leds-lp5521.c: fix typo
    - LP: #1096966
  * drivers/leds/leds-lp5521.c: ret may be uninitialized
    - LP: #1096966
  * drivers/leds/leds-lp5521.c: fix lp5521_read() error handling
    - LP: #1096966
  * scsi: aha152x: Fix sparse warning and make printing pointer address
    more portable.
    - LP: #1096966
  * ALSA: hda - Fix missing beep on ASUS X43U notebook
    - LP: #1096966
  * i7300_edac: Fix error flag testing
    - LP: #1096966
  * Revert misapplied "mmc: sh-mmcif: avoid oops on spurious interrupts"
    - LP: #1096966
  * tmpfs: fix shared mempolicy leak
    - LP: #1096966
  * powerpc: fix wii_memory_fixups() compile error on 3.0.y tree
    - LP: #1096966
  * s390/kvm: dont announce RRBM support
    - LP: #1096966
  * cgroup: cgroup_subsys->fork() should be called after the task is added
    to css_set
    - LP: #1096966
  * freezer: add missing mb's to freezer_count() and freezer_should_skip()
    - LP: #1096966
  * mm: add kmap_to_page()
    - LP: #1096966
  * mm: highmem: export kmap_to_page for modules
    - LP: #1096966
  * virtio: 9p: correctly pass physical address to userspace for high pages
    - LP: #1096966
  * virtio: force vring descriptors to be allocated from lowmem
    - LP: #1096966
  * ath9k_hw: Ena...

Changed in linux (Ubuntu Precise):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.