Bug 11732 - Oops while mounting a DVD-ROM
Summary: Oops while mounting a DVD-ROM
Alias: None
Product: IO/Storage
Classification: Unclassified
Component: IDE (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: Bartlomiej Zolnierkiewicz
Depends on:
Reported: 2008-10-10 12:02 UTC by Vedran Furač
Modified: 2009-04-27 15:04 UTC (History)
4 users (show)

See Also:
Kernel Version: 2.6.27-rc7
Regression: Yes
Bisected commit-id:

blkparse output (56.53 KB, text/plain)
2008-10-16 04:35 UTC, Vedran Furač

Description Vedran Furač 2008-10-10 12:02:22 UTC
Latest working kernel version:
Earliest failing kernel version: 2.6.27-rc7
Distribution: Debian
Hardware Environment:
Software Environment:
Problem Description:

Steps to reproduce: Mount a DVD-ROM

[150430.437461] ------------[ cut here ]------------
[150430.437470] WARNING: at arch/x86/kernel/pci-nommu.c:62 nommu_map_sg+0x29/0x80()
[150430.437473] Modules linked in: nls_cp437 vfat fat isofs zlib_inflate nls_utf8 ntfs ext4dev jbd2 crc16 udf nls_base crc_itu_t radeon drm tun autofs4 ipv6 video output ac battery nfsd auth_rpcgss exportfs nfs lockd nfs_acl sunrpc quota_v2 fuse it87 hwmon_vid eeprom tuner_simple tuner_types tuner snd_cs4232 snd_opl3_lib snd_hwdep snd_cs4231_lib snd_mpu401 snd_mpu401_uart bttv ns558 gameport snd_seq_midi snd_rawmidi snd_intel8x0 snd_ac97_codec videodev v4l1_compat rtc_cmos ac97_bus snd_pcm_oss ir_common rtc_core snd_mixer_oss compat_ioctl32 i2c_algo_bit rtc_lib v4l2_common videobuf_dma_sg videobuf_core snd_bt87x btcx_risc tveeprom snd_pcm snd_seq_dummy serio_raw pcspkr psmouse shpchp snd_seq_oss pci_hotplug snd_seq_midi_event snd_seq snd_timer snd_seq_device snd soundcore snd_page_alloc parport_pc parport button i2c_nforce2 nvidia_agp i2c_core agpgart evdev sd_mod joydev ext3 jbd mbcache dm_mirror dm_log dm_snapshot dm_mod usbhid hid ff_memless ide_cd_mod cdrom ide_disk ata_generic usb_storage libata scsi_mod dock 8139cp amd74xx floppy 8139too mii ide_pci_generic ide_core ehci_hcd ohci_hcd usbcore thermal processor fan thermal_sys
[150430.437587] Pid: 19225, comm: firefox-bin Tainted: G        W 2.6.27-rc7-686 #1
[150430.437591]  [<c0123d17>] warn_on_slowpath+0x40/0x63
[150430.437600]  [<c01356f2>] enqueue_hrtimer+0xc9/0xd4
[150430.437606]  [<c0135cf3>] hrtimer_start+0x104/0x11f
[150430.437610]  [<c011adea>] hrtick_start_fair+0x120/0x156
[150430.437614]  [<c0119e00>] resched_task+0x1a/0x59
[150430.437621]  [<c01217d0>] check_preempt_wakeup+0x14b/0x153
[150430.437626]  [<c01754d3>] slab_destroy+0x2b/0x40
[150430.437632]  [<c010817f>] nommu_map_sg+0x29/0x80
[150430.437641]  [<f9025d7c>] ide_build_sglist+0x45/0x4a [ide_core]
[150430.437667]  [<f9025dac>] ide_build_dmatable+0x2b/0x11d [ide_core]
[150430.437683]  [<f9025fa1>] ide_dma_setup+0x2f/0xc3 [ide_core]
[150430.437698]  [<f905a179>] cdrom_do_newpc_cont+0x0/0x13 [ide_cd_mod]
[150430.437708]  [<f9059c87>] ide_cd_do_request+0x53c/0x5e8 [ide_cd_mod]
[150430.437716]  [<f9021138>] ide_wait_stat+0x3f/0x6c [ide_core]
[150430.437731]  [<f901fca7>] ide_do_request+0x642/0x86b [ide_core]
[150430.437746]  [<f905a274>] cdrom_newpc_intr+0xc2/0x502 [ide_cd_mod]
[150430.437753]  [<c012b297>] lock_timer_base+0x19/0x35
[150430.437761]  [<f902004c>] ide_intr+0x17c/0x1a3 [ide_core]
[150430.437774]  [<c01540a2>] handle_IRQ_event+0x23/0x51
[150430.437779]  [<c0155359>] handle_edge_irq+0xc4/0x104
[150430.437784]  [<c0105faf>] do_IRQ+0x4d/0x66
[150430.437789]  [<c0104297>] common_interrupt+0x23/0x28
[150430.437794]  =======================
[150430.437796] ---[ end trace 6b02c72c822d6675 ]---
[150430.676787] ISO 9660 Extensions: Microsoft Joliet Level 3
[150430.710752] ISOFS: changing to secondary root
Comment 1 Andrew Morton 2008-10-10 12:17:55 UTC
I recategorised this to IDE.

I assume it is a regression also.  It might be that we just
added more debug stuff and the problme has been there for some time.
Comment 2 Alan 2008-10-10 12:32:12 UTC
Not idea - trace is a completely gaga mmu mapping failure. I'd say its a bust box or someone has loaded corrupting modules
Comment 3 Vedran Furač 2008-10-10 15:44:17 UTC
If you need more information please tell me. Kernel is from: 
Comment 4 Thomas Gleixner 2008-10-11 03:50:07 UTC
(In reply to comment #2)
> Not idea - trace is a completely gaga mmu mapping failure. I'd say its a bust
> box or someone has loaded corrupting modules

Hmm, I'd say it's a warn_on which triggers due to ide code calling dma_map_sg() from ide_build_sglist() with totally bogus parameters.

    WARN_ON(nents == 0 || sg[0].length == 0);

Giving the handle back to ide :)
Comment 5 Bartlomiej Zolnierkiewicz 2008-10-15 14:42:17 UTC
IDE gets arguments for dma_map_sg() from blk_rq_map_sg() so everything should be sweet...


- is the problem reproducible with vanilla 2.6.27?

- is it a regression?
Comment 6 Thomas Gleixner 2008-10-15 16:01:06 UTC
> IDE gets arguments for dma_map_sg() from blk_rq_map_sg() so everything should
> be sweet...

Adding Jens to the mix :)
Comment 7 Jens Axboe 2008-10-16 02:08:53 UTC
Initially it looks like IDE calling dma mapping for a request with no data attached. blk_rq_map_sg() returns 0 if no data is attached, it has no error case. So saying that IDE just passes that on to dma mapping doesn't say a whole lot. To be sure, it would be interesting to catch a blktrace of this happening so we can see more closely. So, IOW, do:

1) In one termimal, run blktrace /dev/hdX (eg /dev/hda, or whatever is your cdrom).
2) In another terminal, mount the drive or whatever reproduces the error.
3) In that first terminal, ctrl-c blktrace. Then run blkparse hdX -o output and attach output to this bug.
Comment 8 Vedran Furač 2008-10-16 04:35:20 UTC
Created attachment 18337 [details]
blkparse output

New info:
- Still happens with -rc9 (will try with vanilla 27 within next few days)
- Doesn't happen with 2.6.26
- Happens only with one drive (out of two tested, so it could be hw problem)
- Doesn't happen always, seem random but usually 2-3 times out of ten mounts
- It seems that it happens only when hal is running

blkparse output attached (more then one (u)mount)

Comment 9 Bartlomiej Zolnierkiewicz 2008-11-09 08:15:13 UTC
Could you try 2.6.28-rc3?  We've fixed some bugs related to ide-cd recently so this problem may get fixed as well.
Comment 10 Bartlomiej Zolnierkiewicz 2009-04-27 14:53:25 UTC
Should have been fixed by:

commit 9e772d0135a5b5f8355320be429efa339700d52d
Author: Borislav Petkov <petkovbb@googlemail.com>
Date:   Mon Feb 2 20:12:21 2009 +0100

    ide-cd: fix DMA for non bio-backed requests

    This one fixes http://bugzilla.kernel.org/show_bug.cgi?id=12320.

    Signed-off-by: Borislav Petkov <petkovbb@gmail.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

Note You need to log in before you can comment on or make changes to this bug.