Latest working kernel version: some 2.4 (I wish I recall which one) Earliest failing kernel version: 2.6.23.17 and possibly earlier, in fact I don't recall it ever worked in early 2.6 Distribution: Debian 4.0 today Hardware Environment: x86, VIA C3, 512MB RAM, ASUS CUV4X MB(VT8605 [PM133 AGP], VT82C686), ATI TV Wonder VE (Bt878), Matrox G200 Software Environment: x86, mencoder Problem Description: not using TV system works OK, Watching using tvtime works OK for 30min - have not tried more, grabbing using mencoder either 2.6.13.17 v4l or 2.6.28 v4l2 also seen with 2.6.24.4. Steps to reproduce: either /usr/local/MPlayer-1.0rc2/bin/mencoder -tv buffersize=200:input=1:freq=603.15:fps=20:normid=8:saturation=95:contrast=-20:brightness=-10:width=704:height=576:audiorate=44000:adevice=/dev/dsp tv:// -ovc copy -oac copy -o /suplik/output.avi or: /usr/local/MPlayer-1.0rc2/bin/mencoder -tv buffersize=200:input=1:freq=603.15:fps=20:normid=8:mjpeg:decimation=1:audiorate=44000:adevice=/dev/dsp tv:// -ovc copy -oac copy -o /suplik/output.avi bttv0: timeout: drop=27 irq=19135/738575, risc=1eb4101c, bits: HSYNC OFLOW bttv0: OCERR @ 1eb4101c,bits: HSYNC OFLOW OCERR* Dec 29 16:11:12 azash last message repeated 4 times bttv0: OCERR @ 1eb41000,bits: HSYNC OFLOW OCERR* bttv0: OCERR @ 1eb4101c,bits: HSYNC OFLOW OCERR* Dec 29 16:11:12 azash last message repeated 5 times bttv0: timeout: drop=27 irq=19176/738616, risc=1eb4101c, bits: HSYNC OFLOW BUG: unable to handle kernel paging request at 73726e70 IP: [<c01490c2>] free_block+0x62/0x100 *pde = 00000000 Oops: 0002 [#1] [the oops later once I fugure out the decode] ---[ end trace 130080ab36d1d977 ]--- Fixing recursive fault but reboot is needed! ------------[ cut here ]------------ kernel BUG at mm/slab.c:602! invalid opcode: 0000 [#2] last sysfs file: /sys/block/md10/dev Modules linked in: fan ac tuner snd_emu10k1 bttv snd_rawmidi ir_common i2c_algo_bit pcspkr videobuf_dma_sg videobuf_core btcx_risc snd_ac97_codec tveeprom ac97_ Pid: 5681, comm: sleep Tainted: G D (2.6.28-i386 #1) System Name EIP: 0060:[<c01490ae>] EFLAGS: 00010046 CPU: 0 EIP is at free_block+0x4e/0x100 EAX: 00000000 EBX: 0000003c ECX: decc93c8 EDX: c13d9920 ESI: decc9000 EDI: df40aea0 EBP: df407320 ESP: c9c03eec DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process sleep (pid: 5681, ti=c9c02000 task=df4f2160 task.ti=c9c02000) Stack: 00000005 00000000 0000003c df409810 00000001 0000003c df407320 decaf41c 00000000 c0148f24 00000000 df409800 df409800 00000202 decaf41c da87e834 c0148fdc decaf41c decaa2cc df4f2160 c013ed43 decaf41c da87e800 c013ee0f Call Trace: [<c0148f24>] cache_flusharray+0x74/0xa0 [<c0148fdc>] kmem_cache_free+0x1c/0x30 [<c013ed43>] remove_vma+0x43/0x50 [<c013ee0f>] exit_mmap+0xbf/0xe0 [<c01139d0>] mmput+0x20/0x70 [<c0116429>] exit_mm+0x99/0xa0 [<c0117418>] do_exit+0x148/0x620 [<c014a50d>] filp_close+0x4d/0x60 [<c0117930>] do_group_exit+0x40/0x70 [<c0102b62>] syscall_call+0x7/0xb Code: 54 24 0c 8b 0c 82 8d 91 00 00 00 40 c1 ea 0c c1 e2 05 03 15 90 9a 57 c0 8b 02 25 00 40 00 00 85 c0 74 03 8b 52 0c 80 3a 00 78 04 <0f> 0b eb fe 8b 72 1c 8b EIP: [<c01490ae>] free_block+0x4e/0x100 SS:ESP 0068:c9c03eec ---[ end trace 130080ab36d1d977 ]--- Fixing recursive fault but reboot is needed! ------------[ cut here ]------------ kernel BUG at mm/slab.c:602! invalid opcode: 0000 [#3] last sysfs file: /sys/block/md10/dev Modules linked in: fan ac tuner snd_emu10k1 bttv snd_rawmidi ir_common i2c_algo_bit pcspkr videobuf_dma_sg videobuf_core btcx_risc snd_ac97_codec tveeprom ac97_ Pid: 4, comm: events/0 Tainted: G D (2.6.28-i386 #1) System Name EIP: 0060:[<c01490ae>] EFLAGS: 00010046 CPU: 0 EIP is at free_block+0x4e/0x100 EAX: 00000000 EBX: df409810 ECX: decc9278 EDX: c13d9920 ESI: 00000018 EDI: df409800 EBP: df407320 ESP: df447f54 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process events/0 (pid: 4, ti=df446000 task=df43f0d0 task.ti=df446000) Stack: 00000001 00000000 00000018 df409810 00000000 df409810 00000018 df409800 df407320 c01491c5 00000000 df40aea0 df407320 c057a3e0 00000000 c0149cf1 00000000 00000000 df401860 c057a3e0 c0149cc0 c0120592 df401860 c0120bc0 Call Trace: [<c01491c5>] drain_array+0x65/0x80 [<c0149cf1>] cache_reap+0x31/0xd0 [<c0149cc0>] cache_reap+0x0/0xd0 [<c0120592>] run_workqueue+0x62/0xd0 [<c0120bc0>] worker_thread+0x0/0x80 [<c0120c34>] worker_thread+0x74/0x80 [<c0122f50>] autoremove_wake_function+0x0/0x30 [<c0122dc8>] kthread+0x38/0x60 [<c0122d90>] kthread+0x0/0x60 [<c0103d97>] kernel_thread_helper+0x7/0x10 Code: 54 24 0c 8b 0c 82 8d 91 00 00 00 40 c1 ea 0c c1 e2 05 03 15 90 9a 57 c0 8b 02 25 00 40 00 00 85 c0 74 03 8b 52 0c 80 3a 00 78 04 <0f> 0b eb fe 8b 72 1c 8b EIP: [<c01490ae>] free_block+0x4e/0x100 SS:ESP 0068:df447f54 ---[ end trace 130080ab36d1d977 ]--- swap_dup: Bad swap file entry 80de7688 VM: killing process init swap_free: Bad swap file entry 80de7688 swap_free: Bad swap file entry 00b7eed0 swap_free: Bad swap file entry 00b7f020 Eeek! page_mapcount(page) went negative! (-1) page pfn = 0 page->flags = 404 page->count = 1 page->mapping = 00000000 vma->vm_ops = 0x0 ------------[ cut here ]------------ kernel BUG at mm/rmap.c:725! invalid opcode: 0000 [#4] last sysfs file: /sys/block/md10/dev Modules linked in: fan ac tuner snd_emu10k1 bttv snd_rawmidi ir_common i2c_algo_bit pcspkr videobuf_dma_sg videobuf_core btcx_risc snd_ac97_codec tveeprom ac97_ Pid: 5740, comm: init Tainted: G D (2.6.28-i386 #1) System Name EIP: 0060:[<c014163a>] EFLAGS: 00010246 CPU: 0 EIP is at page_remove_rmap+0xba/0xf0 EAX: 00000000 EBX: c1000000 ECX: ffffffff EDX: c04db440 ESI: db569908 EDI: decc996c EBP: 09278000 ESP: dec2fec0 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process init (pid: 5740, ti=dec2e000 task=ded88430 task.ti=dec2e000) Stack: c1000000 0925b000 c013c3de 00000025 00000000 db569908 dec2ff2c 00000000 00000001 df469090 de768820 c0555eb4 00000000 ffffffff df469090 003f2fff 09278000 00000000 db56995c de768820 ded88430 de768854 c013edc1 ffffffff Call Trace: [<c013c3de>] unmap_vmas+0x24e/0x400 [<c013edc1>] exit_mmap+0x71/0xe0 [<c01139d0>] mmput+0x20/0x70 [<c0116429>] exit_mm+0x99/0xa0 [<c0117418>] do_exit+0x148/0x620 [<c0117930>] do_group_exit+0x40/0x70 [<c010e98f>] do_page_fault+0x4df/0x540 [<c010e4b0>] do_page_fault+0x0/0x540 [<c03d10da>] error_code+0x6a/0x70 Code: c0 74 0d 8b 50 08 b8 a2 5c 45 c0 e8 31 d7 fe ff 8b 46 48 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 c0 5c 45 c0 e8 16 d7 fe ff <0f> 0b eb fe 8b 53 10 83 EIP: [<c014163a>] page_remove_rmap+0xba/0xf0 SS:ESP 0068:dec2fec0 ---[ end trace 130080ab36d1d977 ]--- Fixing recursive fault but reboot is needed! Dec 29 16:13:03 azash syslogd 1.4.1#18: restart.
Oh crap. The previous is incomplete no line wrap and missing ends of lines. BUG: unable to handle kernel paging request at 73726e70 IP: [<c01490c2>] free_block+0x62/0x100 *pde = 00000000 Oops: 0002 [#1] last sysfs file: /sys/block/md10/dev Modules linked in: fan ac tuner snd_emu10k1 bttv snd_rawmidi ir_common i2c_algo_bit pcspkr videobuf_dma_sg videobuf_core btcx_risc snd_ac97_codec tveeprom ac97_ bus snd_util_mem e100 snd_hwdep i2c_viapro thermal processor thermal_sys Pid: 5287, comm: mencoder Not tainted (2.6.28-i386 #1) System Name EIP: 0060:[<c01490c2>] EFLAGS: 00210082 CPU: 0 EIP is at free_block+0x62/0x100 EAX: df40aea0 EBX: 0000003c ECX: db569668 EDX: 73726e6c ESI: db569000 EDI: df40aea0 EBP: df407320 ESP: df467eec DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process mencoder (pid: 5287, ti=df466000 task=df48fb40 task.ti=df466000) Stack: 00000006 00000000 0000003c df409810 0000002d 0000003c df407320 df7de470 00000000 c0148f24 00000000 df409800 df409800 00200246 df7de470 da87ecb4 c0148fdc df7de470 decaacf8 df48fb40 c013ed43 df7de470 da87ec80 c013ee0f Call Trace: [<c0148f24>] cache_flusharray+0x74/0xa0 [<c0148fdc>] kmem_cache_free+0x1c/0x30 [<c013ed43>] remove_vma+0x43/0x50 [<c013ee0f>] exit_mmap+0xbf/0xe0 [<c01139d0>] mmput+0x20/0x70 [<c0116429>] exit_mm+0x99/0xa0 [<c0117418>] do_exit+0x148/0x620 [<c0117930>] do_group_exit+0x40/0x70 [<c0102b62>] syscall_call+0x7/0xb Code: 90 9a 57 c0 8b 02 25 00 40 00 00 85 c0 74 03 8b 52 0c 80 3a 00 78 04 0f 0b eb fe 8b 72 1c 8b 44 24 28 8b 7c 85 4c 8b 16 8b 46 04 <89> 42 04 89 10 c7 06 00 01 10 00 c7 46 04 00 02 20 00 2b 4e 0c EIP: [<c01490c2>] free_block+0x62/0x100 SS:ESP 0068:df467eec ---[ end trace 130080ab36d1d977 ]--- Fixing recursive fault but reboot is needed! ------------[ cut here ]------------ kernel BUG at mm/slab.c:602! invalid opcode: 0000 [#2] last sysfs file: /sys/block/md10/dev Modules linked in: fan ac tuner snd_emu10k1 bttv snd_rawmidi ir_common i2c_algo_bit pcspkr videobuf_dma_sg videobuf_core btcx_risc snd_ac97_codec tveeprom ac97_ bus snd_util_mem e100 snd_hwdep i2c_viapro thermal processor thermal_sys Pid: 5681, comm: sleep Tainted: G D (2.6.28-i386 #1) System Name EIP: 0060:[<c01490ae>] EFLAGS: 00010046 CPU: 0 EIP is at free_block+0x4e/0x100 EAX: 00000000 EBX: 0000003c ECX: decc93c8 EDX: c13d9920 ESI: decc9000 EDI: df40aea0 EBP: df407320 ESP: c9c03eec DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process sleep (pid: 5681, ti=c9c02000 task=df4f2160 task.ti=c9c02000) Stack: 00000005 00000000 0000003c df409810 00000001 0000003c df407320 decaf41c 00000000 c0148f24 00000000 df409800 df409800 00000202 decaf41c da87e834 c0148fdc decaf41c decaa2cc df4f2160 c013ed43 decaf41c da87e800 c013ee0f Call Trace: [<c0148f24>] cache_flusharray+0x74/0xa0 [<c0148fdc>] kmem_cache_free+0x1c/0x30 [<c013ed43>] remove_vma+0x43/0x50 [<c013ee0f>] exit_mmap+0xbf/0xe0 [<c01139d0>] mmput+0x20/0x70 [<c0116429>] exit_mm+0x99/0xa0 [<c0117418>] do_exit+0x148/0x620 [<c014a50d>] filp_close+0x4d/0x60 [<c0117930>] do_group_exit+0x40/0x70 [<c0102b62>] syscall_call+0x7/0xb Code: 54 24 0c 8b 0c 82 8d 91 00 00 00 40 c1 ea 0c c1 e2 05 03 15 90 9a 57 c0 8b 02 25 00 40 00 00 85 c0 74 03 8b 52 0c 80 3a 00 78 04 <0f> 0b eb fe 8b 72 1c 8b 44 24 28 8b 7c 85 4c 8b 16 8b 46 04 89 EIP: [<c01490ae>] free_block+0x4e/0x100 SS:ESP 0068:c9c03eec ---[ end trace 130080ab36d1d977 ]--- Fixing recursive fault but reboot is needed! ------------[ cut here ]------------ kernel BUG at mm/slab.c:602! invalid opcode: 0000 [#3] last sysfs file: /sys/block/md10/dev Modules linked in: fan ac tuner snd_emu10k1 bttv snd_rawmidi ir_common i2c_algo_bit pcspkr videobuf_dma_sg videobuf_core btcx_risc snd_ac97_codec tveeprom ac97_ bus snd_util_mem e100 snd_hwdep i2c_viapro thermal processor thermal_sys Pid: 4, comm: events/0 Tainted: G D (2.6.28-i386 #1) System Name EIP: 0060:[<c01490ae>] EFLAGS: 00010046 CPU: 0 EIP is at free_block+0x4e/0x100 EAX: 00000000 EBX: df409810 ECX: decc9278 EDX: c13d9920 ESI: 00000018 EDI: df409800 EBP: df407320 ESP: df447f54 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process events/0 (pid: 4, ti=df446000 task=df43f0d0 task.ti=df446000) Stack: 00000001 00000000 00000018 df409810 00000000 df409810 00000018 df409800 df407320 c01491c5 00000000 df40aea0 df407320 c057a3e0 00000000 c0149cf1 00000000 00000000 df401860 c057a3e0 c0149cc0 c0120592 df401860 c0120bc0 Call Trace: [<c01491c5>] drain_array+0x65/0x80 [<c0149cf1>] cache_reap+0x31/0xd0 [<c0149cc0>] cache_reap+0x0/0xd0 [<c0120592>] run_workqueue+0x62/0xd0 [<c0120bc0>] worker_thread+0x0/0x80 [<c0120c34>] worker_thread+0x74/0x80 [<c0122f50>] autoremove_wake_function+0x0/0x30 [<c0122dc8>] kthread+0x38/0x60 [<c0122d90>] kthread+0x0/0x60 [<c0103d97>] kernel_thread_helper+0x7/0x10 Code: 54 24 0c 8b 0c 82 8d 91 00 00 00 40 c1 ea 0c c1 e2 05 03 15 90 9a 57 c0 8b 02 25 00 40 00 00 85 c0 74 03 8b 52 0c 80 3a 00 78 04 <0f> 0b eb fe 8b 72 1c 8b 44 24 28 8b 7c 85 4c 8b 16 8b 46 04 89 EIP: [<c01490ae>] free_block+0x4e/0x100 SS:ESP 0068:df447f54 ---[ end trace 130080ab36d1d977 ]--- swap_dup: Bad swap file entry 80de7688 VM: killing process init swap_free: Bad swap file entry 80de7688 swap_free: Bad swap file entry 00b7eed0 swap_free: Bad swap file entry 00b7f020 Eeek! page_mapcount(page) went negative! (-1) page pfn = 0 page->flags = 404 page->count = 1 page->mapping = 00000000 vma->vm_ops = 0x0 ------------[ cut here ]------------ kernel BUG at mm/rmap.c:725! invalid opcode: 0000 [#4] last sysfs file: /sys/block/md10/dev Modules linked in: fan ac tuner snd_emu10k1 bttv snd_rawmidi ir_common i2c_algo_bit pcspkr videobuf_dma_sg videobuf_core btcx_risc snd_ac97_codec tveeprom ac97_ bus snd_util_mem e100 snd_hwdep i2c_viapro thermal processor thermal_sys Pid: 5740, comm: init Tainted: G D (2.6.28-i386 #1) System Name EIP: 0060:[<c014163a>] EFLAGS: 00010246 CPU: 0 EIP is at page_remove_rmap+0xba/0xf0 EAX: 00000000 EBX: c1000000 ECX: ffffffff EDX: c04db440 ESI: db569908 EDI: decc996c EBP: 09278000 ESP: dec2fec0 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 Process init (pid: 5740, ti=dec2e000 task=ded88430 task.ti=dec2e000) Stack: c1000000 0925b000 c013c3de 00000025 00000000 db569908 dec2ff2c 00000000 00000001 df469090 de768820 c0555eb4 00000000 ffffffff df469090 003f2fff 09278000 00000000 db56995c de768820 ded88430 de768854 c013edc1 ffffffff Call Trace: [<c013c3de>] unmap_vmas+0x24e/0x400 [<c013edc1>] exit_mmap+0x71/0xe0 [<c01139d0>] mmput+0x20/0x70 [<c0116429>] exit_mm+0x99/0xa0 [<c0117418>] do_exit+0x148/0x620 [<c0117930>] do_group_exit+0x40/0x70 [<c010e98f>] do_page_fault+0x4df/0x540 [<c010e4b0>] do_page_fault+0x0/0x540 [<c03d10da>] error_code+0x6a/0x70 Code: c0 74 0d 8b 50 08 b8 a2 5c 45 c0 e8 31 d7 fe ff 8b 46 48 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 c0 5c 45 c0 e8 16 d7 fe ff <0f> 0b eb fe 8b 53 10 83 e2 01 f7 da 83 c2 06 8b 03 c1 e8 1e 69 EIP: [<c014163a>] page_remove_rmap+0xba/0xf0 SS:ESP 0068:dec2fec0 ---[ end trace 130080ab36d1d977 ]--- Fixing recursive fault but reboot is needed! Dec 29 16:13:03 azash syslogd 1.4.1#18: restart. klogd 1.4.1#18, log source = /proc/kmsg started. The system becomes frozen unresponsive. Keyboard in console not responding not blinking. Sometimes it's able to log the Oops and fix the error log it in the syslog. Sometimes panicking and blinking. Happens from 3 to 20 minutes of mencoding. Sometimes takes longer. Sometimes really quick. No other application running besides mencoder and while sleep 1; do sync; done Below the uniq -c of sorted "Code:" lines. Always at the usual places. Tried to switch SLUB/SLAB, Flat/Sparse, swapon/swapoff, cpufreq/nocpufreq and couple of selectable protections in the lowmem at compilation time. Not much change. Generally the 2.6.13.17 had less severe crashes. 2.6.28 with SLAB/Flat/sapoff is this bug report. 1 Code: 09 44 24 14 8b 44 24 14 83 c4 1c 5b 5e 5f 5d c3 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 66 83 38 00 78 03 31 c0 c3 8b 40 20 <ff> 40 04 c3 e9 5b ef ff ff 8d 74 26 00 8d bc 27 00 00 00 00 57 2 Code: 1c 51 c0 eb 0c 01 1d b8 1c 51 c0 11 15 bc 1c 51 c0 5b 5d c3 8d 74 26 00 55 89 e5 57 56 53 83 ec 10 89 45 ec 89 55 e8 89 cf 8b 00 <8b> 30 eb 2b 8d 58 f4 8b 40 f4 89 45 f0 8b 45 0c 89 04 24 8b 4d 1 Code: 38 00 00 00 00 eb 08 8b 54 24 58 89 54 24 38 3b 74 24 34 72 04 0f 0b eb fe 8b 4c 24 08 8b 11 89 f0 c1 e8 16 c1 e0 02 89 44 24 18 <8b> 4a 24 01 c8 89 44 24 18 8d ae 00 00 40 00 81 e5 00 00 c0 ff 2 Code: 54 24 0c 8b 0c 82 8d 91 00 00 00 40 c1 ea 0c c1 e2 05 03 15 90 9a 57 c0 8b 02 25 00 40 00 00 85 c0 74 03 8b 52 0c 80 3a 00 78 04 <0f> 0b eb fe 8b 72 1c 8b 44 24 28 8b 7c 85 4c 8b 16 8b 46 04 89 1 Code: 90 9a 57 c0 8b 02 25 00 40 00 00 85 c0 74 03 8b 52 0c 80 3a 00 78 04 0f 0b eb fe 8b 72 1c 8b 44 24 28 8b 7c 85 4c 8b 16 8b 46 04 <89> 42 04 89 10 c7 06 00 01 10 00 c7 46 04 00 02 20 00 2b 4e 0c 2 Code: 99 0a f6 ff 8b 95 e8 00 00 00 89 54 24 24 c7 44 24 28 00 00 00 00 c7 44 24 10 00 00 00 00 58 e8 29 37 22 00 e9 32 01 00 00 8b 37 <ff> 46 30 f6 06 02 75 0a c7 44 24 28 00 00 00 00 eb 3d 0f ba 2e 1 Code: c0 74 0d 8b 50 08 b8 a2 5c 45 c0 e8 31 d7 fe ff 8b 46 48 85 c0 74 14 8b 40 10 85 c0 74 0d 8b 50 2c b8 c0 5c 45 c0 e8 16 d7 fe ff <0f> 0b eb fe 8b 53 10 83 e2 01 f7 da 83 c2 06 8b 03 c1 e8 1e 69 1 Code: c2 18 39 0a 75 0f 8b 41 20 89 02 39 c8 75 06 c7 02 00 00 00 00 8b 51 24 8b 41 20 89 42 20 8b 41 20 89 50 24 c7 41 08 00 00 00 00 <0f> ba 33 14 19 c0 85 c0 74 08 89 d8 5b e9 dd 48 fb ff 5b c3 8d
Closing as obsolete please update the bug if still seen with modern kernels