Bug 25692

Summary: Kernel oops (NULL pointer deref) during boot on stac92xx_unsol_event
Product: Drivers Reporter: Nicos P. (nicosp)
Component: Sound(ALSA)Assignee: Takashi Iwai (tiwai)
Status: CLOSED CODE_FIX    
Severity: normal CC: florian, maciej.rutecki, rjw
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 2.6.37-rc7 Subsystem:
Regression: Yes Bisected commit-id:
Bug Depends on:    
Bug Blocks: 21782    
Attachments: Full kernel log
Fix patch
Corrected fix patch

Description Nicos P. 2010-12-27 12:08:48 UTC
Created attachment 41702 [details]
Full kernel log

I am using linux-image-2.6.37-rc7-amd64 (2.6.37~rc7-1~experimental.1) from debian experimental. My motherboard is Intel D946GZIS. During boot I get this oops and sound does not work. It used to work on 2.6.36 and before.

Below is the relevant part of dmesg. I also attached the whole thing (kernel.log). I am new to submitting kernel bugs so I apologise beforehand if I am missing any info. Please let me know if you need anything else.

[    6.267424] HDA Intel 0000:00:1b.0: PCI INT A -> GSI 22 (level, low) -> IRQ 22
[    6.267479] HDA Intel 0000:00:1b.0: irq 40 for MSI/MSI-X
[    6.267505] HDA Intel 0000:00:1b.0: setting latency timer to 64
[    6.320950] input: HDA Digital PCBeep as /devices/pci0000:00/0000:00:1b.0/input/input6
[    6.520042] BUG: unable to handle kernel NULL pointer dereference at           (null)
[    6.520066] IP: [<ffffffffa072cc3b>] stac92xx_unsol_event+0x38b/0x577 [snd_hda_codec_idt]
[    6.520087] PGD 36854067 PUD 7bc27067 PMD 0 
[    6.520100] Oops: 0000 [#1] SMP 
[    6.520108] last sysfs file: /sys/module/snd_hda_codec/initstate
[    6.520119] CPU 0 
[    6.520123] Modules linked in: snd_hda_codec_idt snd_hda_intel(+) snd_hda_codec snd_hwdep snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device rng_core snd parport_pc joydev evdev parport soundcore snd_page_alloc processor i2c_i801 pcspkr tpm_tis tpm tpm_bios shpchp pci_hotplug psmouse serio_raw ext4 mbcache jbd2 crc16 usbhid hid uas usb_storage btrfs zlib_deflate crc32c libcrc32c sg sd_mod crc_t10dif sr_mod cdrom ata_generic nouveau ttm ata_piix uhci_hcd libata drm_kms_helper drm i2c_algo_bit ehci_hcd i2c_core usbcore video e100 mii scsi_mod thermal_sys output button nls_base [last unloaded: scsi_wait_scan]
[    6.520310] 
[    6.520315] Pid: 483, comm: modprobe Not tainted 2.6.37-rc7-amd64 #1 D946GZIS/        
[    6.520323] RIP: 0010:[<ffffffffa072cc3b>]  [<ffffffffa072cc3b>] stac92xx_unsol_event+0x38b/0x577 [snd_hda_codec_idt]
[    6.520337] RSP: 0018:ffff88007c343c68  EFLAGS: 00010246
[    6.520343] RAX: 0000000000000000 RBX: ffff880079d9a400 RCX: 0000000000000701
[    6.520350] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880079d9a400
[    6.520357] RBP: ffff88007954d000 R08: 0000000000000000 R09: 0000000000000708
[    6.520366] R10: ffff88007ec0fd30 R11: ffff88007ec136c0 R12: ffff88007954d1a0
[    6.520373] R13: ffff88003673dc08 R14: ffff88007954d004 R15: ffff88007f817090
[    6.520381] FS:  00007f7683d8b700(0000) GS:ffff88007ec00000(0000) knlGS:0000000000000000
[    6.520389] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[    6.520395] CR2: 0000000000000000 CR3: 000000007bc40000 CR4: 00000000000006f0
[    6.520403] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[    6.520410] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[    6.520418] Process modprobe (pid: 483, threadinfo ffff88007c342000, task ffff88007f116540)
[    6.520426] Stack:
[    6.520429]  0000000000000000 ffff880079d9a400 000000000000000b ffff88007954d000
[    6.520442]  000000000000000b ffff880079d9a400 ffff88007954d000 0000000000000001
[    6.520454]  ffff88007954d000 ffff88007954d004 ffff88007f817090 ffffffffa072a185
[    6.520466] Call Trace:
[    6.520474]  [<ffffffffa072a185>] ? stac92xx_init+0x393/0x66c [snd_hda_codec_idt]
[    6.520486]  [<ffffffffa0701125>] ? snd_hda_codec_build_controls+0x23/0x42 [snd_hda_codec]
[    6.520497]  [<ffffffffa07030b6>] ? snd_hda_build_controls+0x1a/0x73 [snd_hda_codec]
[    6.520508]  [<ffffffffa071f821>] ? azx_probe+0x7cc/0x86b [snd_hda_intel]
[    6.520519]  [<ffffffff8123dd45>] ? __pm_runtime_set_status+0x162/0x186
[    6.520528]  [<ffffffff811aed2e>] ? local_pci_probe+0x49/0x92
[    6.520536]  [<ffffffff811afa35>] ? pci_device_probe+0xc2/0xef
[    6.520544]  [<ffffffff8123737e>] ? driver_sysfs_add+0x66/0x8d
[    6.520551]  [<ffffffff812374bf>] ? driver_probe_device+0xa8/0x138
[    6.520558]  [<ffffffff8123759e>] ? __driver_attach+0x4f/0x6f
[    6.520565]  [<ffffffff8123754f>] ? __driver_attach+0x0/0x6f
[    6.520573]  [<ffffffff81236b48>] ? bus_for_each_dev+0x44/0x78
[    6.520580]  [<ffffffff81236fa0>] ? bus_add_driver+0xa8/0x1f0
[    6.520587]  [<ffffffff81237845>] ? driver_register+0x90/0xf8
[    6.520595]  [<ffffffff811afc7f>] ? __pci_register_driver+0x4e/0xc0
[    6.520604]  [<ffffffffa0724000>] ? alsa_card_azx_init+0x0/0x20 [snd_hda_intel]
[    6.520613]  [<ffffffff81002079>] ? do_one_initcall+0x78/0x131
[    6.520622]  [<ffffffff81075dac>] ? sys_init_module+0x97/0x1d3
[    6.520629]  [<ffffffff81009a12>] ? system_call_fastpath+0x16/0x1b
[    6.520636] Code: 8d 95 a0 01 00 00 85 c0 4c 0f 44 e2 45 8a 44 24 03 45 84 c0 78 1d 48 8b 85 68 01 00 00 45 0f be c0 b9 01 07 00 00 31 d2 48 89 df <0f> b7 30 e8 b5 3f fd ff 45 8a 44 24 02 45 84 c0 78 1d 48 8b 85 
[    6.520729] RIP  [<ffffffffa072cc3b>] stac92xx_unsol_event+0x38b/0x577 [snd_hda_codec_idt]
[    6.520740]  RSP <ffff88007c343c68>
[    6.520744] CR2: 0000000000000000
[    6.522186] ---[ end trace 6fbb469bd6db683d ]---
Comment 1 Takashi Iwai 2011-01-05 10:31:16 UTC
Could you give alsa-info.sh output (run with --no-upload option) on the working (2.6.36.x) kernel?  Also, load snd-hda-intel driver with probe_only=1 option on the latest 2.6.37 kernel and give alsa-info.sh output as well.
Comment 2 Nicos P. 2011-01-12 21:13:31 UTC
On 05/01/11 12:32, bugzilla-daemon@bugzilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=25692
> 
> 
> 
> 
> 
> --- Comment #1 from Takashi Iwai <tiwai@suse.de>  2011-01-05 10:31:16 ---
> Could you give alsa-info.sh output (run with --no-upload option) on the
> working
> (2.6.36.x) kernel?  Also, load snd-hda-intel driver with probe_only=1 option
> on
> the latest 2.6.37 kernel and give alsa-info.sh output as well.
> 
2.6.36
http://www.alsa-project.org/db/?f=9d6f665d7397a28c38d8f5f96d3ef238357643e7

2.6.37 with probe_only=1
http://www.alsa-project.org/db/?f=caac93fa5ecdde63a778d7a28946538a2d69989c

I was blown away with the ease of use of alsa-info.sh. Thank you for
taking the time to make bug reporting for alsa so easy for us.
Comment 3 Takashi Iwai 2011-01-13 07:18:36 UTC
Thanks.  The patch below should fix the issue.
It's now in sound git tree and will be included to the upstream in the next pull request.
Comment 4 Takashi Iwai 2011-01-13 07:19:13 UTC
Created attachment 43382 [details]
Fix patch
Comment 5 Takashi Iwai 2011-01-13 07:32:54 UTC
Created attachment 43392 [details]
Corrected fix patch

Sorry, this one is correct.
Comment 6 Nicos P. 2011-01-14 22:54:14 UTC
On 13/01/11 09:32, bugzilla-daemon@bugzilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=25692
> 
> 
> Takashi Iwai <tiwai@suse.de> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>   Attachment #43382 [details]|0                           |1
>         is obsolete|                            |
> 
> 
> 
> 
> --- Comment #5 from Takashi Iwai <tiwai@suse.de>  2011-01-13 07:32:54 ---
> Created an attachment (id=43392)
>  --> (https://bugzilla.kernel.org/attachment.cgi?id=43392)
> Corrected fix patch
> 
> Sorry, this one is correct.
> 

I applied this patch on linux-image-2.6.37-trunk-amd64
(linux-image-2.6.37-rc7-amd64) and sound is working perfectly. Thanks!
Comment 7 Florian Mickler 2011-01-15 12:59:47 UTC
Patch: https://bugzilla.kernel.org/attachment.cgi?id=43392
Comment 8 Rafael J. Wysocki 2011-02-02 23:49:09 UTC
Fixed by commit 80c6785 ALSA: hda - Fix NULL-derefence with a single mic in STAC auto-mic detection .