Bug 103431 - NULL dereference at hdmi_chmap_ctl_info
Summary: NULL dereference at hdmi_chmap_ctl_info
Status: RESOLVED CODE_FIX
Alias: None
Product: Drivers
Classification: Unclassified
Component: Sound(ALSA) (show other bugs)
Hardware: All Linux
: P1 high
Assignee: Jaroslav Kysela
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-08-24 13:54 UTC by Andreas Reis
Modified: 2015-08-29 15:35 UTC (History)
1 user (show)

See Also:
Kernel Version: drm-intel-nightly / sound-unstable
Subsystem:
Regression: No
Bisected commit-id:


Attachments
Test patch (912 bytes, patch)
2015-08-24 16:07 UTC, Takashi Iwai
Details | Diff
desktop kernel config (103.97 KB, application/octet-stream)
2015-08-25 19:23 UTC, Andreas Reis
Details
dmesg from sound/for-next (68.46 KB, text/plain)
2015-08-25 19:28 UTC, Andreas Reis
Details
output of alsa-info.sh (57.02 KB, text/plain)
2015-08-25 19:55 UTC, Andreas Reis
Details
Fix patch (2.32 KB, patch)
2015-08-26 05:50 UTC, Takashi Iwai
Details | Diff

Description Andreas Reis 2015-08-24 13:54:42 UTC
At drm-intel-nightly: 2015y-08m-24d-07h-39m-09s plus "ALSA: hda: fix possible NULL dereference", on both my Haswells with alsa compiled-in:

[    8.900499] BUG: unable to handle kernel NULL pointer dereference at 00000000000000c8
[    8.900552] IP: [<ffffffff817cf093>] hdmi_chmap_ctl_info+0x23/0x40
[    8.900592] PGD 210c26067 PUD 210c25067 PMD 0 
[    8.900624] Oops: 0000 [#1] PREEMPT SMP 
[    8.900654] Modules linked in: iwlmvm iwlwifi nfsd nfs auth_rpcgss oid_registry nfs_acl lockd grace sunrpc ip_tables x_tables
[    8.900751] CPU: 1 PID: 476 Comm: alsactl Tainted: G     U  W I     4.2.0-1-cu #1
[    8.900793] Hardware name: Notebook                         W840SU Series                    /W840SU Series                    , BIOS 4.6.5 11/26/2013
[    8.900863] task: ffff8800d7cc0000 ti: ffff8800d6944000 task.ti: ffff8800d6944000
[    8.900904] RIP: 0010:[<ffffffff817cf093>]  [<ffffffff817cf093>] hdmi_chmap_ctl_info+0x23/0x40
[    8.900955] RSP: 0018:ffff8800d6947c50  EFLAGS: 00010286
[    8.900985] RAX: 0000000000000000 RBX: ffff8800d6947ca0 RCX: 0000000000000000
[    8.901024] RDX: 0000000000000000 RSI: ffff8800d6947ca0 RDI: ffff88007f8c93c0
[    8.901063] RBP: ffff8800d6947c88 R08: 0000000000000000 R09: 0000000001be45c0
[    8.901101] R10: 0000000000000021 R11: 0000000000000246 R12: ffff88007f8c93c0
[    8.901139] R13: 00007fff2fc8f1d0 R14: ffff880215248450 R15: ffff8800d7ff2900
[    8.901179] FS:  00007f956c13d700(0000) GS:ffff88021fa80000(0000) knlGS:0000000000000000
[    8.901222] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    8.901253] CR2: 00000000000000c8 CR3: 0000000210c23000 CR4: 00000000001406e0
[    8.901292] Stack:
[    8.901306]  ffffffff8178c4e0 0000000000000001 0000000000000000 ffff8800d7ff2900
[    8.901356]  00007fff2fc8f1d0 00007fff2fc8f1d0 ffff880215248000 ffff8800d6947dd8
[    8.901406]  ffffffff8178c656 0000000000000001 0000000300000000 0000000000000003
[    8.901456] Call Trace:
[    8.901478]  [<ffffffff8178c4e0>] ? snd_ctl_elem_info+0x50/0x150
[    8.901514]  [<ffffffff8178c656>] snd_ctl_elem_info_user+0x76/0xf0
[    8.901549]  [<ffffffff8178ce4a>] snd_ctl_ioctl+0x5ea/0x6d0
[    8.901583]  [<ffffffff812463dd>] do_vfs_ioctl+0x29d/0x480
[    8.901616]  [<ffffffff8123462e>] ? vfs_write+0x14e/0x190
[    8.901647]  [<ffffffff81250ede>] ? set_close_on_exec+0x4e/0x60
[    8.901682]  [<ffffffff81246639>] SyS_ioctl+0x79/0x90
[    8.901715]  [<ffffffff819b266e>] entry_SYSCALL_64_fastpath+0x12/0x71

Last kernel was from Thursday and didn't have that yet, so seems only two relevant commits:
http://cgit.freedesktop.org/drm-intel/commit/?id=fa4f18b4f402d3654415935511d8e0bb51a102b7
http://cgit.freedesktop.org/drm-intel/commit/?id=18dfd79d92e5292611ac4944a67bd837dd7632c9
Comment 1 Takashi Iwai 2015-08-24 14:50:37 UTC
Reverting the commit fa4f18b4f402d3654 helps?
Comment 2 Andreas Reis 2015-08-24 15:10:19 UTC
Yes.

(Two more unrelated things I might add:

1. The "Bug Tracker" link on alsa-project.org still 404's and should probably better redirect to the Sound(ALSA) list here.

2. On my CA0132 the Master volume slider every now and then just ceases to have an effect. Haven't filed a bug as I have no idea how to reproduce it, and it might as well be another firmware issue.)
Comment 3 Takashi Iwai 2015-08-24 15:16:51 UTC
(In reply to Takashi Iwai from comment #1)
> Reverting the commit fa4f18b4f402d3654 helps?

It works on my machine.  How is the way to reproduce?  Please give your kernel config.

I ignore the rest of your unrelated comments.
Comment 4 Takashi Iwai 2015-08-24 16:07:26 UTC
Also, does the patch below have any influence on the behavior?
Comment 5 Takashi Iwai 2015-08-24 16:07:48 UTC
Created attachment 185701 [details]
Test patch
Comment 6 Andreas Reis 2015-08-24 23:19:23 UTC
No change with the test patch. grep 'SND.*=' on my desktop's config with the bug:

CONFIG_SND=y
CONFIG_SND_TIMER=y
CONFIG_SND_PCM=y
CONFIG_SND_HWDEP=y
CONFIG_SND_JACK=y
CONFIG_SND_SEQUENCER=y
CONFIG_SND_OSSEMUL=y
CONFIG_SND_MIXER_OSS=m
CONFIG_SND_PCM_OSS=m
CONFIG_SND_PCM_OSS_PLUGINS=y
CONFIG_SND_SEQUENCER_OSS=y
CONFIG_SND_HRTIMER=y
CONFIG_SND_SEQ_HRTIMER_DEFAULT=y
CONFIG_SND_DYNAMIC_MINORS=y
CONFIG_SND_MAX_CARDS=32
CONFIG_SND_PROC_FS=y
CONFIG_SND_VERBOSE_PROCFS=y
CONFIG_SND_VMASTER=y
CONFIG_SND_DMA_SGBUF=y
CONFIG_SND_DRIVERS=y
CONFIG_SND_PCI=y
CONFIG_SND_HDA=y
CONFIG_SND_HDA_INTEL=y
CONFIG_SND_HDA_HWDEP=y
CONFIG_SND_HDA_RECONFIG=y
CONFIG_SND_HDA_INPUT_BEEP=y
CONFIG_SND_HDA_INPUT_BEEP_MODE=1
CONFIG_SND_HDA_PATCH_LOADER=y
CONFIG_SND_HDA_CODEC_HDMI=y
CONFIG_SND_HDA_CODEC_CA0132=y
CONFIG_SND_HDA_CODEC_CA0132_DSP=y
CONFIG_SND_HDA_GENERIC=y
CONFIG_SND_HDA_POWER_SAVE_DEFAULT=0
CONFIG_SND_HDA_CORE=y
CONFIG_SND_HDA_DSP_LOADER=y
CONFIG_SND_HDA_I915=y
CONFIG_SND_HDA_PREALLOC_SIZE=4096

The deference does not occur when I switch alsa to modules, in which case:
zcat /proc/config.gz | grep 'SND.*=m'                                                                                                             
CONFIG_SND=m
CONFIG_SND_TIMER=m
CONFIG_SND_PCM=m
CONFIG_SND_HWDEP=m
CONFIG_SND_SEQUENCER=m
CONFIG_SND_MIXER_OSS=m
CONFIG_SND_PCM_OSS=m
CONFIG_SND_HRTIMER=m
CONFIG_SND_HDA=m
CONFIG_SND_HDA_INTEL=m
CONFIG_SND_HDA_CODEC_HDMI=m
CONFIG_SND_HDA_CODEC_CA0132=m
CONFIG_SND_HDA_GENERIC=m
CONFIG_SND_HDA_CORE=m
Comment 7 Takashi Iwai 2015-08-25 06:24:06 UTC
Could you explain *how* to reproduce this?  Also, please give the full kernel messages containing Oops (preferably from the kernel with sound modules).

As mentioned, I couldn't reproduce this on my local machines (tried drm-intel-nightly, too).  So, we need to align the environment.  Let's try the following:

- Build the kernel without drm-intel-nightly.  Use vanilla merged sound/for-next as the test basis.  Build sound modules for ease of tests.

- Give the full kernel config.  A difference of debug config might influence on such behavior.

- Remove ca0132 board once and test.  If it's not possible, try to disable ca0132 part via enable option of snd-hda-intel module.
Comment 8 Andreas Reis 2015-08-25 19:23:45 UTC
Created attachment 185851 [details]
desktop kernel config

I get it by simply booting when the modules are compiled-in. ie, immediately and automatically.

- Just tried sound/for-next, same.

- See attachment. Laptop's display is one eDP, desktop's one HDMI connected to the mainboard.

- Can't, it's the mainboard's sound chip. Not relevant either, a) the laptop (with a Realtek ALC282) exhibits the same bug and b) the bug occurs even with CA0132 completely disabled.
Comment 9 Andreas Reis 2015-08-25 19:28:46 UTC
Created attachment 185861 [details]
dmesg from sound/for-next

desktop, SND modules compiled-in, CA0132 disabled
Comment 10 Takashi Iwai 2015-08-25 19:50:15 UTC
Why you don't enable CONFIG_SND_HDA_REALTEK=y?
And which device is what?  Please give alsa-info.sh taken from the working kernel.
Comment 11 Andreas Reis 2015-08-25 19:55:48 UTC
Created attachment 185871 [details]
output of alsa-info.sh

Because this is my desktop kernel config, not my laptop one.

Desktop: CA0132
Laptop ALC282

Both onboard chips, both on Haswell boards.
Comment 12 Takashi Iwai 2015-08-26 05:49:13 UTC
Ah, please explain clearly at the next time...  It was confusing!

Meanwhile, I found the culprit.  It's seen in dmesg before the Oops,

[    0.958225] WARNING: CPU: 0 PID: 4 at fs/sysfs/dir.c:31 sysfs_warn_dup+0x66/0x80()
[    0.958226] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/hdaudioC0D0/widgets'

So Oops was actually a red herring.  The fix patch is attached below.

At the next time, please give the full dmesg and alsa-info.sh output from the beginning.  This would reduce the time for bug hunt significantly.
Comment 13 Takashi Iwai 2015-08-26 05:50:00 UTC
Created attachment 185891 [details]
Fix patch
Comment 14 Andreas Reis 2015-08-29 15:35:12 UTC
Forgot to confirm, yes that indeed fixes it.

You're right ofc about what I should have included from the start. Sorry.

Note You need to log in before you can comment on or make changes to this bug.