056a:0302 Trusty Tahr, kernel 3.13: automatic load of wacom.ko driver cause a "hard" kernel panic

[Romano Giannetti]

I have just upgraded to 14.04 from 13.10.

I have a wacom cth-480 touch+pen tablet, which was not recognized on 13.10 (kernel 3.11). With the stock kernel from 14.04, I have an immediate kernel panic as soon as I plug in the tablet to the laptop.

The system is a asus 1005PE (32 bit install), Xubuntu, up-to date: Linux asus-romano 3.13.0-24-generic #46-Ubuntu SMP Thu Apr 10 19:08:14 UTC 2014 i686 i686 i686 GNU/Linux

The really strange thing is that if I manually load the driver with `sudo modprobe wacom` *before* pluggin the tablet in, then the tablet is recognized and works ok:

SYS: Apr 21 15:15:47 asus-romano kernel: [ 265.664161] usbcore: registered new interface driver wacom
SYS: Apr 21 15:15:52 asus-romano kernel: [ 270.088161] usb 2-1: new full-speed USB device number 2 using uhci_hcd
SYS: Apr 21 15:15:52 asus-romano kernel: [ 270.253626] usb 2-1: New USB device found, idVendor=056a, idProduct=0302
SYS: Apr 21 15:15:52 asus-romano kernel: [ 270.253641] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
SYS: Apr 21 15:15:52 asus-romano kernel: [ 270.253651] usb 2-1: Product: Intuos PTS
SYS: Apr 21 15:15:52 asus-romano kernel: [ 270.253659] usb 2-1: Manufacturer: Wacom Co.,Ltd.
SYS: Apr 21 15:15:52 asus-romano kernel: [ 270.257027] input: Wacom Intuos PT S Pen as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/input/input14
SYS: Apr 21 15:15:52 asus-romano kernel: [ 270.260630] input: Wacom Intuos PT S Finger as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.1/input/input15
SYS: Apr 21 15:15:52 asus-romano mtp-probe: checking bus 2, device 2: "/sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1"
SYS: Apr 21 15:15:52 asus-romano mtp-probe: bus: 2, device: 2 was not an MTP device

A screenshot of the kernel panic is added. I can reproduce it at will.

[Romano Giannetti (romano-giannetti)]

I reported it here too: https://sourceforge.net/p/linuxwacom/bugs/238/

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1310800

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Romano Giannetti (romano-giannetti)]

I tried --- but the page that opens my browser, after I (correctly) log in, says

"the information on this page is private"

"Not allowed here"

How can I upload the data manually?

[Romano Giannetti (romano-giannetti)]

Marked as confirmed because I am unable to user apport-collect, as commented above. I tried in all the way I can, but launchpad refuses to allow the data upload.
I used apport_cli --save apport_report.txt linux and attached the resulting file.

[Joseph Salisbury (jsalisbury)]

Would it be possible for you to test the latest upstream kernel? Refer to https://wiki.ubuntu.com/KernelMainlineBuilds . Please test the latest v3.15 kernel[0].

If this bug is fixed in the mainline kernel, please add the following tag 'kernel-fixed-upstream'.

If the mainline kernel does not fix this bug, please add the tag: 'kernel-bug-exists-upstream'.

If you are unable to test the mainline kernel, for example it will not boot, please add the tag: 'kernel-unable-to-test-upstream'.
Once testing of the upstream kernel is complete, please mark this bug as "Confirmed".

Thanks in advance.

[0] http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.15-rc2-trusty/

[Romano Giannetti (romano-giannetti)]

Tested with linux-image-3.15.0-031500rc2-generic_3.15.0-031500rc2.201404201435_i386.deb, still here.
Will attach oops image.

There are hints that the problem is known here: https://sourceforge.net/p/linuxwacom/bugs/238/#f170

In that case, I strongly advise adding "modprobe wacom" at boot in all the systems, to avoid crashes and potential data loss.

BTW, I installed the aforementioned kernel with dpkg -i ... how do I go back to the stock one? Thanks!

[Romano Giannetti (romano-giannetti)]

I can confirm that with linux-image-3.15.0-031500rc2-generic_3.15.0-031500rc2 the tablet works correctly if I manually load the driver *before* connecting it.

Still, seems a dangerous bug to me.

[Romano Giannetti (romano-giannetti)]

Ok, (relatively) good news

1) still with kernel linux-image-3.15.0-031500rc2-generic_3.15.0-031500rc2

2) I recompiled the input-wacom-0.20.0 that worked for me in 13.10, from here: http://sourceforge.net/projects/linuxwacom/files/xf86-input-wacom/input-wacom/input-wacom-0.20.0.tar.bz2/download

3) I substituted the module to the stock one, then rebooted;

4) the Oops is gone. So the problem must be in the changes from 0.20.0 and the current driver in the kernel, or in some modification of the ubuntu kernel team. In the first case the bug should be easy to catch, see the list of changes:

https://sourceforge.net/p/linuxwacom/input-wacom/ci/2d38b3ce57d003cbef854674a4850e38f32f8c13/log/?path=

Will test now with 0.21.0 to check if the bug is there.

[Romano Giannetti (romano-giannetti)]

Ok, compiling 0.21.0 against the upstream kernel (will test with the stock one) will too avoid the crash.

I think that my expertise stops here... I do not know how to check for differences between the input-wacom official tree and the ubuntu tree.

[Romano Giannetti (romano-giannetti)]

I reinstalled the linux-image-extra-3.13.0-24-generic and the crash went away.

I am really puzzled; I *did* try the newer kernel and had the crash. This morning has disappeared.

Marking invalid for now, still looking at it.

[Jacob Nevins (0jacobnk-ulp)]

I also have a recent Wacom tablet (CTH-480S, USB 056a:0302) and can reproduce a kernel panic with a freshly downloaded Xubuntu 14.04 i386 installation image running off a USB stick on my 32-bit netbook -- boot Xubuntu, plug the tablet in, and boom. So this is a real problem with the Trusty kernel on the installation media, regardless of whether it exists in newer upstream kernels (for which the situation seems confused).

The Ubuntu kernel team backported support for this range of tablets to the Trusty kernel by cherry-picks at (I believe) my instigation -- support for them only appeared upstream from 3.14, but a conversation on IRC resulted in the backported support (so I feel slightly responsible).

So, it's possible that this is an Ubuntu-specific problem related to the backport -- maybe not enough changes were backported? I did test some daily pre-release images (on amd64) and they worked for me fine then; this is the first time I've tried the final release.

(I haven't upgraded my amd64 machine to 14.04 yet; I'm still on 12.04, and with that I'm happily using the tablet with my own hand-rolled input-wacom 0.20.0 DKMS package. I haven't yet tried the amd64 installation image to see if I can get a panic out of it.)

I'm happy to gather further diagnostic information as necessary to resolve this issue in Trusty.

[Jacob Nevins (0jacobnk-ulp)]

For completeness, here's my panic, transcribed manually from my netbook (there may be typos). (Not sure how useful this will be since it's not the whole backtrace.)

...
[ 178.020018] [<c14c5581>] ? uhci_free_td+0xb1/0xd0
[ 178.020018] [<c14c6ce3>] uhci_scan_schedule+0x333/0x8d0
[ 178.020018] [<c14c7317>] uhci_irq+0x97/0x140
[ 178.020018] [<c14a1661>] usb_hcd_irq+0x21/0x30
[ 178.020018] [<c10a5ba5>] handle_irq_event_percpu+0x35/0x1a0
[ 178.020018] [<c10a5d41>] handle_irq_event+0x31/0x50
[ 178.020018] [<c10a8660>] ? unmask_irq+0x30/0x30
[ 178.020018] [<c10a86ae>] handle_fasteoi_irq+0x4e/0xe0
[ 178.020018] <IRQ>
[ 178.020018] [<c165a26c>] ? do_IRQ+0x3c/0xb0
[ 178.020018] [<c165a033>] ? common_interrupt+0x33/0x38
[ 178.020018] [<c13120ea>] ? mpihelp_submul_1+0x5a/0xc0
[ 178.020018] [<c1312ad7>] ? mpihelp_divrem+0x207/0x6f0
[ 178.020018] [<c13140fc>] ? mpi_powm+0x41c/0x890
[ 178.020018] [<c12c0e48>] ? RSA_verify_signature+0xb8/0x220
[ 178.020018] [<c12c0d90>] ? public_key_describe+0x40/0x40
[ 178.020018] [<c12c0cea>] ? public_key_verify_signature+0x9a/0xe0
[ 178.020018] [<c1314637>] ? mpi_alloc+0x57/0x80
[ 178.020018] [<c131230d>] ? mpi_read_raw_data+0x6d/0x110
[ 178.020018] [<c12c0d40>] ? public_key_read_verify_signature_2+0x10/0x20
[ 178.020018] [<c12c0bf7>] ? verify_signature+0x27/0x40
[ 178.020018] [<c10c50ab>] ? mod_verify_sig+0x29b/0x390
[ 178.020018] [<c10c2f33>] ? load_module+0x1b3/0x18e0
[ 178.020018] [<c1176774>] ? vfs_read+0xd4/0x140
[ 178.020018] [<c117b4c5>] ? kernel_read+0x35/0x50
[ 178.020018] [<c10c0c39>] ? copy_module_from_fd.isra.45+0xf9/0x190
[ 178.020018] [<c12a81a4>] ? aa_label_find_merge+0xf4/0x390
[ 178.020018] [<c10c47c5>] ? SyS_finit_module+0x75/0xc0
[ 178.020018] [<c11396db>] ? vm_mmap_pgoff+0x7b/0xa0
[ 178.020018] [<c1659b4d>] ? sysenter_do_call+0x12/0x28
[ 178.020018] Code: ff 8d b4 26 00 00 00 00 55 89 e5 57 56 53 83 ec 0c 3e 8d 74 26 00 83 fa 1f 89 c3 76 0b 83 c4 0c 5b 5e 5f 5d c3 8d 76 00 89 4d ec <0f> a3 50 18 19 c0 85 c0 89 55 f0 74 e5 8d b3 8c 01 00 00 89 f0
[ 178.020018] EIP: [<c14e6863>] input_event+0x23/0x70 SS:ESP 0068:f4c09dfc
[ 178.020018] CR2: 0000000000000018
[ 178.020018] Kernel panic - not syncing: Fatal exception in interrupt
[ 178.020018] drm_kms_helper: panic occurred, switching back to text console

[Romano Giannetti (romano-giannetti)]

I was not really able to reproduce the crash neither on my 32 nor the 64 bit system... so I am quite unable to help.
Has anyone explored the possibility of a corrupted/wrong wacom.ko in the distribution media?

Romano

[Jacob Nevins (0jacobnk-ulp)]

I guess it's down to me then...

Changed back to 'Confirmed', since the problem is readily reproducible for me, although it doesn't occur every time -- once I plugged the tablet in without triggering a crash (and it then worked correctly in my limited testing).

I've tried persuading this USB-stick-based system to save kernel crash dumps, without success so far. I guess that I might have to accelerate my upgrade of this machine to 14.04 to investigate this properly. What would be useful diagnostic information for me to acquire?

In the meantime, here's another manually-transcribed kernel panic -- this one includes the top of the backtrace so may be more useful.

(All three panics so far -- Romano's and my two -- are consistent in being at "EIP: [<c14e6863>] input_event+0x23/0x70", despite other differences.)

...
[ 172.825778] ESI: 00000000 EDI: f4f46614 EBP: e9265d84 ESP: e9265d6c
[ 172.825778] DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
[ 172.825778] CR0: 80050033 CR2: 00000018 CR3: 2f42c000 CR4: 000007f0
[ 172.825778] Stack:
[ 172.825778] c14a2189 0000000e f74b9c08 e9268400 00000000 f4f46614 e9265de4 f93cba1c
[ 172.825778] 00000000 e9265da8 c1050312 fffb9000 f65c22a0 00000000 e9265db0 c10501a3
[ 172.825778] f65c22c0 e9265e20 c1128da9 00000002 000000c1 0002f02f 00000000 00000002
[ 172.825778] Call Trace:
[ 172.825778] [<c14a2189>] ? usb_hcd_giveback_urb+0x99/0x100
[ 172.825778] [<f93cba1c>] wacom_wac_irq+0x19bc/0x1b00 [wacom]
[ 172.825778] [<c1050312>] ? kmap_atomic_prot+0xe2/0x100
[ 172.825778] [<c10501a3>] ? __kunmap_atomic+0x63/0x80
[ 172.825778] [<c1128da9>] ? get_page_from_freelist+0x299/0x600
[ 172.825778] [<f93cc8c1>] wacom_sys_irq+0x41/0x100 [wacom]
[ 172.825778] [<c1088d58>] ? update_curr+0xa8/0x1e0
[ 172.825778] [<c14c572c>] ? uhci_free_urb_priv+0xac/0xc0
[ 172.825778] [<c14a2076>] __usb_hcd_giveback_urb+0x66/0xe0
[ 172.825778] [<c14a2126>] usb_hcd_giveback_urb+0x36/0x100
[ 172.825778] [<c14c6480>] uhci_giveback_urb+0x90/0x2b0
[ 172.825778] [<c14bc22f>] ? ehci_irq+0x30f/0x480
[ 172.825778] [<c114225b>] ? __do_fault+0x24b/0x570
[ 172.825778] [<c14c6ce3>] uhci_scan_schedule+0x333/0x8d0
[ 172.825778] [<c14c7317>] uhci_irq+0x97/0x140
[ 172.825778] [<c1087871>] ? set_next_entity+0xb1/0xe0
[ 172.825778] [<c14a1661>] usb_hcd_irq+0x21/0x30
[ 172.825778] [<c10a5ba5>] handle_irq_event_percpu+0x35/0x1a0
[ 172.825778] [<c1655e17>] ? __do_page_fault+0x237/0x510
[ 172.825778] [<c10a5d41>] handle_irq_event+0x31/0x50
[ 172.825778] [<c10a86ae>] handle_fasteoi_irq+0x4e/0xe0
[ 172.825778] [<c1011847>] handle_irq+0x37/0x90
[ 172.825778] [<c165a26c>] do_IRQ+0x3c/0xb0
[ 172.825778] [<c165a033>] common_interrupt+0x33/0x38
[ 172.825778] Code: ff 8d b4 26 00 00 00 00 55 89 e5 57 56 53 83 ec 0c 3e 8d 74 26 00 83 fa 1f 89 c3 76 0b 83 c4 0c 5b 5e 5f 5d c3 8d 76 00 89 4d ec <0f> a3 50 18 19 c0 85 c0 89 55 f0 74 e5 8d b3 8c 01 00 00 89 f0
[ 172.825778] EIP: [<c14e6863>] input_event+0x23/0x70 SS:ESP 0068:e9265d6c
[ 172.825778] CR2: 0000000000000018

[riban (brian-riban)]

I can confirm exact same results with wacom Intuos. Booting with tablet plugged in does not crash. Plugging tablet in after booting triggers kernel panic. Similar to OP I updated from 13.10 to 14.04.1. Tablet not working in 13.10 at all. Rather nasty bug. Is there anything I can do to assist with diagnosis?

[Romano Giannetti (romano-giannetti)]

@riban: As I commented, I can't reproduce it any more. Or maybe it's random (I had a crash with the tablet in once, when reconnected with the wireless option).

There is a bug upstream: http://sourceforge.net/p/linuxwacom/bugs/238/ --- maybe you can chime in there and see if the developers can help.

[riban (brian-riban)]

I have attached dump files. I note: "BUG: unable to handle kernel NULL pointer dereference at 00000018" - may be a clue? I have also posted upstream as suggested but that thread seems to have found a work-around so may be less interested. This seems to be an issue with how Ubuntu packages this module and should be fixed out-of-the-box rather than requiring (geeky) workarounds. (I can do that but we Ubuntu is supposed to be for Human Beings - not just geeks!)

[Shuhao (shuhao)]

So I have a system that this happens to. Tablet model is CTH480S.

The thing is that this setup used to work until today (kernel update 2 days ago? Although running with an old version of the kernel show the same problem now).

The work around is add wacom into /etc/modules for now, if anyone is interested. This adds wacom to be loaded at boot time. Not sure what the consequence of this is, but it's a temporary solution until this problem is tracked down.

[Jacob Nevins (0jacobnk-ulp)]

I've finally installed Ubuntu 14.04, installed and enabled linux-crashdump and provoked this crash, and let Apport upload it... somewhere. I don't know how to find it or refer to it from this bug report (I wasn't given an opportunity to give an explanation).

[Kenneth Bogert (kbogert-uga)]

I can reliably trigger this bug on my machine in the 3.16 and 3.13 kernels. I've attached the kernel crash output for 3.16 (minus the dump because of its size, I can provide a link if desired).

Adding wacom to /etc/modules prevents this bug for me.

[Romano Giannetti (romano-giannetti)]

I have a new incarnation of the bug, but I am not being able to capture a track, although is quite easy to trigger.
Steps:
1 - load wacom.ko
2- connect the tablet **wirelessly**
3- wait until the tablet go to deep sleep (around 10 minutes)
4- switch the tablet on

-> hard crash, the PC is completely dead.

If you unplug and replug the USB radio dongle before switching the tablet on all is ok.

[Jason Gerecke (killertofu)]

I've taken a long hard look at this bug and believe I've been able to nail down the cause. The panic is caused by a NULL pointer being passed to the 'input_report_switch' function. It occurs if the kernel has probed the tablet's pen/pad interface and processes a status report from it before the kernel has a chance to probe the tablet's touchpad interface. The suggested workaround of loading the module before connecting the tablet only masks the issue by changing the timing of events enough so that the kernel is able to finish probing both interfaces before processing the status report.

This issue was addressed upstream by commit 44b9683 ("HID: wacom - make sure touch_input is valid before using it") which is part of the 3.19 kernel. Both the Trusty (3.13) and Vivid (3.16) kernels are missing this patch, however. Commit 44b9683 can be trivially backported; I've attached such a backport for convenience.

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1310800

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Rahul (rahulshantagiri9999)]

ApportVersion: 2.14.1-0ubuntu3.2
Architecture: i386
AudioDevicesInUse:
 USER PID ACCESS COMMAND
 /dev/snd/controlC0: ubuntu10 1973 F.... pulseaudio
CurrentDesktop: Unity
DistroRelease: Ubuntu 14.04
HibernationDevice: RESUME=UUID=d98e108a-7f3c-4278-a959-903f6fff9c2b
InstallationDate: Installed on 2015-10-16 (2 days ago)
InstallationMedia: Ubuntu 14.04.1 LTS "Trusty Tahr" - Release i386 (20140722.2)
IwConfig:
 lo no wireless extensions.

 eth0 no wireless extensions.
Lsusb:
 Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
 Bus 002 Device 005: ID 0e0f:0008 VMware, Inc.
 Bus 002 Device 003: ID 0e0f:0002 VMware, Inc. Virtual USB Hub
 Bus 002 Device 002: ID 0e0f:0003 VMware, Inc. Virtual Mouse
 Bus 002 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: VMware, Inc. VMware Virtual Platform
Package: linux (not installed)
ProcFB: 0 svgadrmfb
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-3.13.0-32-generic root=UUID=3b06945e-0f21-4d66-a651-8a825329ae6a ro find_preseed=/preseed.cfg auto noprompt priority=critical locale=en_US quiet
ProcVersionSignature: Ubuntu 3.13.0-32.57-generic 3.13.11.4
RelatedPackageVersions:
 linux-restricted-modules-3.13.0-32-generic N/A
 linux-backports-modules-3.13.0-32-generic N/A
 linux-firmware 1.127.5
RfKill:
 1: hci0: Bluetooth
  Soft blocked: no
  Hard blocked: no
Tags: trusty
Uname: Linux 3.13.0-32-generic i686
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
_MarkForUpload: True
dmi.bios.date: 05/20/2014
dmi.bios.vendor: Phoenix Technologies LTD
dmi.bios.version: 6.00
dmi.board.name: 440BX Desktop Reference Platform
dmi.board.vendor: Intel Corporation
dmi.board.version: None
dmi.chassis.asset.tag: No Asset Tag
dmi.chassis.type: 1
dmi.chassis.vendor: No Enclosure
dmi.chassis.version: N/A
dmi.modalias: dmi:bvnPhoenixTechnologiesLTD:bvr6.00:bd05/20/2014:svnVMware,Inc.:pnVMwareVirtualPlatform:pvrNone:rvnIntelCorporation:rn440BXDesktopReferencePlatform:rvrNone:cvnNoEnclosure:ct1:cvrN/A:
dmi.product.name: VMware Virtual Platform
dmi.product.version: None
dmi.sys.vendor: VMware, Inc.

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Rahul (rahulshantagiri9999)]

apport information

[Luis Henriques (henrix)]

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-trusty' to 'verification-done-trusty'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Jason Gerecke (killertofu)]

Trusty and Utopic kernels from -proposed tested and verified to no longer panic.

[Andy Whitcroft (apw)]

Fix released in 3.13.0-77.121