[linux-dvb] kernel BUG with AverTV DVB-T 777 and kernel 2.6.23-rc3

Andy Walls awalls at radix.net
Sun May 25 04:33:03 CEST 2008


On Sat, 2008-05-24 at 18:17 +0200, Jose Alberto Reguero wrote:
> Work well with kernel 2.6.25
> 
> Jose Alberto
> _______________________________________________
> linux-dvb mailing list
> linux-dvb at linuxtv.org
> http://www.linuxtv.org/cgi-bin/mailman/listinfo/linux-dvb


I've figured this one out, but don't have time to make a patch just yet.
See below:


> BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
> IP: [<ffffffffa0b1953b>] :tuner_simple:simple_tuner_attach+0x99/0x396

Note the memory address 8 access in simple_tuner_attach().

> PGD 7d988067 PUD 7d989067 PMD 0                                                 
> Oops: 0000 [1] SMP                                                              
> CPU 1                                                                           
> Modules linked in: tuner_simple tuner_types mt352 saa7134_dvb(+) mt2060 snd_usb_audio(+) videobuf_dvb snd_seq_dummy snd_hda_intel snd_seq_oss(+) saa7134 snd_seq_midi_event snd_seq snd_pcm_oss v4l2_common videobuf_dma_sg snd_mixer_oss videobuf_core snd_pcm ir_kbd_i2c dvb_usb_dib0700(+) snd_timer dib7000p ir_common dib7000m nvidia(P) pwc snd_usb_lib dvb_usb dvb_core dib3000mc dibx000_common snd_page_alloc sr_mod tveeprom compat_ioctl32 dib0070 i2c_viapro snd_rawmidi snd_seq_device snd_hwdep i2c_core cdrom sg videodev v4l1_compat button ppdev parport_pc k8temp hwmon pata_via shpchp snd serio_raw pcspkr atl1 mii parport soundcore floppy ahci ata_generic pata_acpi sata_via libata sd_mod scsi_mod ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd [last unloaded: scsi_wait_scan]                         
> Pid: 1553, comm: modprobe Tainted: P          2.6.26-rc3 #2                     
> RIP: 0010:[<ffffffffa0b1953b>]  [<ffffffffa0b1953b>] :tuner_simple:simple_tuner_attach+0x99/0x396

Note modprobe making a system call caused the fault, and that segment
selector 010, the kernel code segment, means the problem is in kernel
code.

> RSP: 0018:ffff81007d0d7c88  EFLAGS: 00010286                                    
> RAX: 0000000000000043 RBX: ffff81007d45c000 RCX: 00000000c3e796e9               
> RDX: 00000000ffffffff RSI: 00000000000000c3 RDI: ffff81007d45c208               
> RBP: ffff81007d0d7ce8 R08: 0000000000000001 R09: 0000000000000000               
> R10: 0000000000000000 R11: ffffffffa0b1af00 R12: ffff81007d45c1d0               
> R13: ffff81007e411408 R14: ffff81007d45c161 R15: 0000000000000043               
> FS:  00007fc159ba16f0(0000) GS:ffff81007f802780(0000) knlGS:0000000000000000    
> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b                               
> CR2: 0000000000000008 CR3: 000000007d98b000 CR4: 00000000000006e0               
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000               
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400               
> Process modprobe (pid: 1553, threadinfo ffff81007d0d6000, task ffff81007e142d20)
> Stack:  0000000000000000 ffffffff81054bf8 ffff000100010061 ffff81007d0d7cb7     
>  ffff81007d45c000 ffffffffa0b06e80 ffff81007d45c170 ffff81007d45c000            
>  ffff81007d45c000 ffffffffa0b06e80 ffff81007d45c170 0000000000000000            
> Call Trace:                                                                     
>  [<ffffffff81054bf8>] ? gpl_only_unused_warning+0x0/0x1b                        
>  [<ffffffffa0b033e5>] :saa7134_dvb:dvb_init+0xec5/0x15bd                        
>  [<ffffffff8102ba59>] ? try_to_wake_up+0x1cc/0x1dd                              
>  [<ffffffffa0a3c9f8>] :saa7134:saa7134_ts_register+0x4a/0x92                    
>  [<ffffffffa0139010>] :saa7134_dvb:dvb_register+0x10/0x12                       
>  [<ffffffff81057bcc>] sys_init_module+0x199c/0x1af8                             
>  [<ffffffff810a3c90>] ? do_sync_read+0xe7/0x12d                                 
>  [<ffffffff8100ba4a>] ? do_notify_resume+0x88f/0x8b0                            
>  [<ffffffff8103e66e>] ? msleep+0x0/0x1e                                         
>  [<ffffffff8100bf8b>] system_call_after_swapgs+0x7b/0x80                        
> 
> 
> Code: 60 01 00 00 48 85 c0 74 07 be 01 00 00 00 ff d0 48 8d 75 b0 ba 01 00 00 00 4c 89 e7 e8 93 4d 65 ff ff c8 74 44 44 89 f8 83 ca ff <8a> 0c 25 08 00 00 00 48 6b c0 30 4c 8b 80 90 26 b1 a0 48 8b 04                                         

The above code disassembles to:

  70:   00 00                   add    %al,(%rax)
  72:   48 85 c0                test   %rax,%rax
  75:   74 07                   je     0x7e
  77:   be 01 00 00 00          mov    $0x1,%esi
  7c:   ff d0                   callq  *%rax
  7e:   48 8d 75 b0             lea    0xffffffffffffffb0(%rbp),%rsi
  82:   ba 01 00 00 00          mov    $0x1,%edx
  87:   4c 89 e7                mov    %r12,%rdi
  8a:   e8 93 4d 65 ff          callq  0xffffffffff654e22
  8f:   ff c8                   dec    %eax
  91:   74 44                   je     0xd7
  93:   44 89 f8                mov    %r15d,%eax
  96:   83 ca ff                or     $0xffffffffffffffff,%edx
  99:   8a 0c 25 08 00 00 00    mov    0x8,%cl
                                       ^^^
                         Your problem --+  
  a0:   48 6b c0 30             imul   $0x30,%rax,%rax
  a4:   4c 8b 80 90 26 b1 a0    mov    0xffffffffa0b12690(%rax),%r8


The assembly code emitted by gcc for this segment of
tuner-simple.c:simple_tuner_attach() looks like:

        movl    $1, %edx
        movq    %r12, %rdi
        call    i2c_transfer
        decl    %eax
        je      .L362
        .loc 1 1056 0              <----- Source line 1056
        mov     %r15d, %eax
        orl     $-1, %edx
        movb    8, %cl             <----- Your problem
        imulq   $48, %rax, %rax
        movq    tuners(%rax), %r8
        movq    16, %rax           <----- Another problem
        testq   %rax, %rax
        je      .L366


The relevant section of tuner-simple.c:simple_tuner_attach():

1052                 if (fe->ops.i2c_gate_ctrl)
1053                         fe->ops.i2c_gate_ctrl(fe, 1);
1054 
1055                 if (1 != i2c_transfer(i2c_adap, &msg, 1))
1056                         tuner_warn("unable to probe %s, proceeding anyway.",
1057                                    tuners[type].name);
1058 
1059                 if (fe->ops.i2c_gate_ctrl)
1060                         fe->ops.i2c_gate_ctrl(fe, 0);


It looks like something about the "tuner_warn()" macro is causing
references to be made to very low memory addresses.  That is probably
not right.

So let's look further: here is the same section of
tuner-simple.c:simple_tuner_attach() after preprocessing, but before
conversion to assembly:

    if (fe->ops.i2c_gate_ctrl)
     fe->ops.i2c_gate_ctrl(fe, 1);

    if (1 != i2c_transfer(i2c_adap, &msg, 1))
     do { do { printk("<4>" "%s %d-%04x: " "unable to probe %s,
proceeding anyway.", priv->i2c_props.name, priv->i2c_props.adap ?
i2c_adapter_id(priv->i2c_props.adap) : -1, priv->i2c_props.addr,
tuners[type].name); } while (0); } while (0);


    if (fe->ops.i2c_gate_ctrl)
     fe->ops.i2c_gate_ctrl(fe, 0);
 

Hmmm. Lots of dereferences of something called "priv".  Looking at the
top of tuner-simple.c:simple_tuner_attach() we find:

1032         struct tuner_simple_priv *priv = NULL;
1033         int instance;

With no other operations on "priv" before the "tuner_warn()" invocation.


So tuner-simple.c:simple_tuner_attach() has a hard coded NULL pointer
dereference buried in a macro that only sometimes gets executed.
Changing the "tuner_warn()" invocation to something simple and innocuous
(e.g. plain old printk()) will work around your problem for now.

Regards,
Andy




More information about the linux-dvb mailing list