Bug 15217

Summary:	NULL pointer dereference after resume-from-disk
Product:	Drivers	Reporter:	Clemens Eisserer (linuxhippy)
Component:	Video(DRI - non Intel)	Assignee:	drivers_video-dri
Status:	RESOLVED UNREPRODUCIBLE
Severity:	normal	CC:	akpm, alan, zajec5
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	2.6.32.7-37.fc12.i686	Subsystem:
Regression:	No	Bisected commit-id:

Description Clemens Eisserer 2010-02-03 10:39:07 UTC

First I suspended to disk without USB soundcard attached, then I attached it while the system was shut down and when resuming from disk I got the following stack-trace:

BUG: unable to handle kernel NULL pointer dereference at 00000014                                                                                            
IP: [<c0791a29>] mutex_lock+0x26/0x3e                                                                                                                        
*pde = 00000000                                                                                                                                              
Oops: 0002 [#1] SMP                                                                                                                                          
last sysfs file: /sys/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1:1.0/sound/card0/uevent                                                                    
Modules linked in: lp usblp snd_usb_audio snd_seq snd_pcm snd_timer snd_page_alloc snd_usb_lib snd_rawmidi snd_seq_device snd_hwdep snd soundcore fuse aes_i586 aes_generic rfcomm sco bridge stp llc bnep l2cap sunrpc ipv6 cpufreq_ondemand acpi_cpufreq uinput arc4 mmc_block ecb sdhci_pci iwl3945 sdhci mmc_core btusb bluetooth e1000e iwlcore iTCO_wdt ppdev iTCO_vendor_support parport_pc mac80211 parport cfg80211 joydev toshiba_acpi rfkill dm_multipath firewire_ohci firewire_core crc_itu_t yenta_socket rsrc_nonstatic i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: microcode]

Pid: 11376, comm: X Tainted: G        W  (2.6.32.7-37.fc12.i686 #1) Tecra A8
EIP: 0060:[<c0791a29>] EFLAGS: 00013246 CPU: 1
EIP is at mutex_lock+0x26/0x3e
EAX: 00000014 EBX: 00000014 ECX: 00000000 EDX: 0000005e
ESI: f6452c00 EDI: bfd80000 EBP: f65cbe38 ESP: f65cbe30
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process X (pid: 11376, ti=f65ca000 task=f4dae600 task.ti=f65ca000)
Stack:
 c04bdaa3 00000014 f65cbe48 f7ce27dd f5ea2160 f5ea21b8 f65cbe58 c04bda7e
<0> f5ea2160 f5e3d340 f65cbe74 c04bdb80 00000eda c3202eb0 f5e3d340 f4dae600
<0> f5e3d340 f65cbe84 c0438329 f3921a40 f4dae600 f65cbec0 c04dde1c f5e3d378
Call Trace:
 [<c04bdaa3>] ? remove_vma+0x5c/0x62
 [<f7ce27dd>] ? drm_gem_vm_close+0x1a/0x2c [drm]
 [<c04bda7e>] ? remove_vma+0x37/0x62
 [<c04bdb80>] ? exit_mmap+0xd7/0xf2
 [<c0438329>] ? mmput+0x4b/0xab
 [<c04dde1c>] ? flush_old_exec+0x3fe/0x66a
 [<c04de0f3>] ? kernel_read+0x33/0x43
 [<c050d603>] ? load_elf_binary+0x2e2/0xfd7
 [<c04b787f>] ? page_address+0x97/0xb5
 [<c05980f9>] ? ima_must_measure+0x20/0x2d
 [<c04dd63b>] ? search_binary_handler+0xb3/0x23a
 [<c050d321>] ? load_elf_binary+0x0/0xfd7
 [<c04de9ba>] ? do_execve+0x19f/0x279
 [<c0402112>] ? sys_execve+0x2b/0x4f
 [<c040365c>] ? syscall_call+0x7/0xb
Code: 31 c0 5b 5d c3 55 89 e5 53 83 ec 04 0f 1f 44 00 00 31 c9 ba 5e 00 00 00 89 c3 b8 43 d2 8a c0 e8 ac ac c9 ff e8 33 f8 ff ff 89 d8 <f0> ff 08 79 05 e8 fa fe ff ff 89 e0 25 00 e0 ff ff 89 43 10 5a
EIP: [<c0791a29>] mutex_lock+0x26/0x3e SS:ESP 0068:f65cbe30
CR2: 0000000000000014
---[ end trace 2c697ef0a0a3b953 ]---

Comment 1 Clemens Eisserer 2010-02-03 10:40:00 UTC

However, to be honest I have no idea if this problem is sound-related at all.
If not please move it to the appropriate category.

Comment 2 Andrew Morton 2010-02-03 15:06:02 UTC

I'll reassign it to DRM.  It looks like obj->dev was NULL in drm_gem_vm_close().

Comment 3 Rafał Miłecki 2010-02-03 22:24:57 UTC

Is this reproducible? If so, please retest without sound card magic. Does it actually help?

Comment 4 Clemens Eisserer 2010-02-04 14:04:58 UTC

Its not reproduceable, it seems the USB soundcard had nothing to do with it.

However today I got another OOops after resume.
With 2.6.31 suspend/resume worked completly flawless.

Oops: 0000 [#1] SMP                                                                      
last sysfs file: /sys/power/state                                                        
Modules linked in: snd_usb_audio snd_seq snd_pcm snd_timer snd_page_alloc snd_usb_lib snd_rawmidi snd_seq_device snd_hwdep snd soundcore aes_i586 aes_generic rfcomm sco bridge stp llc bnep l2cap sunrpc ipv6 cpufreq_ondemand acpi_cpufreq uinput arc4 mmc_block ppdev ecb parport_pc iwl3945 sdhci_pci iTCO_wdt sdhci iTCO_vendor_support iwlcore parport mmc_core btusb bluetooth e1000e mac80211 cfg80211 toshiba_acpi joydev rfkill dm_multipath firewire_ohci yenta_socket rsrc_nonstatic firewire_core crc_itu_t i915 drm_kms_helper drm i2c_algo_bit i2c_core video output [last unloaded: microcode]                                 

Pid: 1264, comm: hald-addon-inpu Not tainted (2.6.32.7-37.fc12.i686 #1) Tecra A8
EIP: 0060:[<c04d9408>] EFLAGS: 00010296 CPU: 0                                  
EIP is at fget_light+0x37/0x73                                                  
EAX: 00000004 EBX: ffffffff ECX: 00000000 EDX: f55fff80                         
ESI: f55ffc1c EDI: f55ffe78 EBP: f55ffbe0 ESP: f55ffbd4                         
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068                                   
Process hald-addon-inpu (pid: 1264, ti=f55fe000 task=f54fe600 task.ti=f55fe000) 
Stack:                                                                          
 f55ffc1c f55ffc1c f55ffe78 f55fff90 c04e7718 0000005b 00000000 f54fe600        
<0> f54fe600 f55ffeb8 093310a8 00000000 00000000 00000000 00000000 00000000     
<0> 00000000 f55ffe80 c04e7070 ffffffff 00000000 f54fe600 00000000 00000000     
Call Trace:                                                                     
 [<c04e7718>] ? do_sys_poll+0x1ea/0x3d5                                         
 [<c04e7070>] ? __pollwait+0x0/0xaa                                             
 [<c04e711a>] ? pollwake+0x0/0x65                                               
 [<c04e711a>] ? pollwake+0x0/0x65                                               
 [<c04e711a>] ? pollwake+0x0/0x65                                               
 [<c04e711a>] ? pollwake+0x0/0x65                                               
 [<c04e711a>] ? pollwake+0x0/0x65                                               
 [<c04e711a>] ? pollwake+0x0/0x65                                               
 [<c04e711a>] ? pollwake+0x0/0x65                                               
 [<c042cad7>] ? update_curr+0x1ce/0x1d6                                         
 [<c042cad7>] ? update_curr+0x1ce/0x1d6                                         
 [<c042cad7>] ? update_curr+0x1ce/0x1d6                                         
 [<c042d4fc>] ? dequeue_entity+0x3b/0x18d                                       
 [<c042d401>] ? __dequeue_entity+0x28/0x2c                                      
 [<c040226d>] ? __switch_to+0x84/0xf5                                           
 [<c0434b0a>] ? finish_task_switch+0x3e/0x92                                    
 [<c079117b>] ? schedule+0x817/0x864                                            
 [<c042cdea>] ? check_preempt_wakeup+0x1d8/0x267                                
 [<c044b183>] ? dequeue_signal+0xb6/0x125                                       
 [<c045a21d>] ? refrigerator+0xc3/0x126                                         
 [<c040293b>] ? do_signal+0x5f/0x71c                                            
 [<c045099f>] ? insert_work+0x75/0x7e                                           
 [<c0450ba9>] ? __queue_work+0x2f/0x34                                          
 [<c057fe57>] ? security_file_permission+0x14/0x16                              
 [<c04d847c>] ? rw_verify_area+0x9d/0xc0                                        
 [<c0480819>] ? audit_syscall_entry+0x116/0x138                                 
 [<c04e7abd>] ? do_restart_poll+0x30/0x47                                       
 [<c044796b>] ? sys_restart_syscall+0x16/0x18                                   
 [<c040365c>] ? syscall_call+0x7/0xb                                            
Code: 8b 0d 54 b4 a5 c0 8b 89 bc 03 00 00 c7 02 00 00 00 00 8b 19 4b 75 11 8b 51 04 3b 02 73 40 c1 e0 02 03 42 04 8b 08 eb 38 8b 49 04 <3b> 01 73 2f c1 e0 02 03 41 04 8b 08 85 c9 74 25 8b 59 18 8d 79                                                                    
EIP: [<c04d9408>] fget_light+0x37/0x73 SS:ESP 0068:f55ffbd4                              
CR2: 0000000000000000