Bug 15111

Summary: Kernel BUG when trying to remove the saa7134_alsa module
Product: Mageia Reporter: Theodoros Kalamatianos <thkala>
Component: RPM PackagesAssignee: Kernel and Drivers maintainers <kernel>
Status: NEW --- QA Contact:
Severity: normal    
Priority: Normal CC: eeeemail, pterjan
Version: Cauldron   
Target Milestone: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard: MGA5TOO
Source RPM: kernel-3.18.3-1.mga5.src.rpm CVE:
Status comment:

Description Theodoros Kalamatianos 2015-01-22 09:51:07 CET 
Description of problem:

At some point I discovered that my PCI DVB-T tuner card (Asus My Cinema-P7131 Hybrid) was not responding - possibly something to do with a couple of preceding hibernate/resume cycles. While trying to get it back online I tried removing & loading again the saa7134* kernel modules that drive it.

At that point I got a kernel BUG when removing the saa7134_alsa module:

[333179.843938] BUG: unable to handle kernel NULL pointer dereference at 0000000000000250
[333179.843941] IP: [<ffffffffc055ac35>] snd_card_free+0x35/0x60 [snd]
[333179.843950] PGD 718a5d067 PUD 6bd07e067 PMD 0 
[333179.843952] Oops: 0002 [#1] SMP 
[333179.843954] Modules linked in: binfmt_misc snd_seq_dummy snd_seq rfcomm ip6table_mangle ip6table_raw nf_conntrack_ipv6 nf_defrag_ipv6 xt_CHECKSUM tun nf_log_ipv4 nf_log_common xt_LOG ipt_MASQUERADE nf_nat_masquerade_ipv4 xt_recent xt_comment xt_iprange iptable_nat nf_nat_ipv4 ipt_REJECT nf_reject_ipv4 xt_addrtype xt_physdev br_netfilter bridge stp llc xt_mark iptable_mangle xt_tcpudp xt_CT iptable_raw xt_multiport nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_nat_tftp nf_nat_snmp_basic nf_conntrack_snmp nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda ts_kmp nf_conntrack_amanda nf_nat nf_conntrack_sane nf_conntrack_tftp nf_conntrack_sip nf_conntrack_proto_udplite nf_conntrack_proto_sctp nf_conntrack_pptp nf_conntrack_proto_gre nf_conntrack_netlink nfnetlink
[333179.843970]  nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_conntrack iptable_filter ip_tables ip6table_filter ip6_tables x_tables lockd grace af_packet bnep msr saa7134_alsa(-) iTCO_wdt tda1004x iTCO_vendor_support intel_rapl mxm_wmi x86_pkg_temp_thermal intel_powerclamp coretemp crct10dif_pclmul cuse crc32_pclmul fuse crc32c_intel ghash_clmulni_intel cpufreq_ondemand cpufreq_conservative aesni_intel cpufreq_powersave aes_x86_64 pl2303 lrw gf128mul videobuf2_dvb glue_helper ablk_helper cryptd dvb_core usbserial microcode nvidia(PO) btusb bluetooth snd_usb_audio joydev serio_raw snd_usbmidi_lib snd_rawmidi snd_seq_device uvcvideo videobuf2_vmalloc rfkill ie31200_edac e1000e alx mei_me drm tpm_infineon mdio tpm_tis ptp fan video mei thermal pps_core
[333179.843989]  tpm edac_core button battery i2c_i801 lpc_ich shpchp processor wmi evdev sch_fq_codel ir_lirc_codec tda827x ir_xmp_decoder tda8290 ir_mce_kbd_decoder ir_rc6_decoder tuner ir_sony_decoder ir_sharp_decoder ir_sanyo_decoder lirc_dev ir_jvc_decoder ir_rc5_decoder ir_nec_decoder rc_asus_pc39 saa7134 tveeprom videobuf2_dma_sg videobuf2_memops snd_hda_codec_hdmi videobuf2_core rc_core v4l2_common videodev snd_hda_codec_realtek snd_hda_codec_generic media nvram it87 hwmon_vid snd_hda_intel snd_hda_controller snd_hda_codec snd_hwdep snd_pcm snd_timer snd soundcore kvm_intel kvm sunrpc ipv6 autofs4 dm_cache_mq dm_cache dm_persistent_data dm_bufio dm_bio_prison hid_generic usbhid hid xhci_pci ehci_pci xhci_hcd ehci_hcd raid1 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx ide_pci_generic
[333179.844008]  usbcore sr_mod firewire_ohci ide_core firewire_core crc_itu_t ata_generic usb_common dm_mirror dm_region_hash dm_log dm_mod pata_acpi [last unloaded: saa7134_dvb]
[333179.844014] CPU: 7 PID: 4239 Comm: rmmod Tainted: P           O   3.18.3-desktop-1.mga5 #1
[333179.844015] Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./Z77X-UD5H, BIOS F14 08/22/2012
[333179.844016] task: ffff880740788000 ti: ffff8803061c4000 task.ti: ffff8803061c4000
[333179.844017] RIP: 0010:[<ffffffffc055ac35>]  [<ffffffffc055ac35>] snd_card_free+0x35/0x60 [snd]
[333179.844023] RSP: 0018:ffff8803061c7e88  EFLAGS: 00010246
[333179.844024] RAX: ffff8803061c7ea8 RBX: ffff8803061c7e98 RCX: 0000000000000001
[333179.844025] RDX: ffffffffc0568080 RSI: ffffffffc0564dea RDI: ffff8803061c7ea0
[333179.844026] RBP: ffff8803061c7ec8 R08: 00000000e5efe401 R09: 00000001020000e4
[333179.844026] R10: ffffffff813b0964 R11: ffff8807e5efe460 R12: 0000000000000000
[333179.844027] R13: 0000000000000800 R14: 0000000000000000 R15: 00000000009e52d0
[333179.844028] FS:  00007ffb65cde700(0000) GS:ffff88081edc0000(0000) knlGS:0000000000000000
[333179.844029] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[333179.844029] CR2: 0000000000000250 CR3: 00000007ae824000 CR4: 00000000001407e0
[333179.844030] Stack:
[333179.844031]  0000000000000000 0000000000000005 ffff880300000000 ffffffff810e0000
[333179.844032]  ffff8803061c7ea8 ffff8803061c7ea8 ffffffffc1515610 ffffffffc1515380
[333179.844033]  ffff8803061c7ee8 ffffffffc1513a24 ffffffffc1515380 0000000000000000
[333179.844035] Call Trace:
[333179.844038]  [<ffffffff810e0000>] ? do_futex+0x60/0xa90
[333179.844043]  [<ffffffffc1513a24>] saa7134_alsa_exit+0x24/0x600 [saa7134_alsa]
[333179.844046]  [<ffffffff810e56f4>] SyS_delete_module+0x144/0x1e0
[333179.844049]  [<ffffffff81013181>] ? do_notify_resume+0x61/0x90
[333179.844052]  [<ffffffff816b246d>] system_call_fastpath+0x16/0x1b
[333179.844052] Code: 80 56 c0 48 c7 c6 ea 4d 56 c0 48 89 e5 41 54 53 48 8d 5d d0 49 89 fc 48 83 ec 30 c7 45 d0 00 00 00 00 48 8d 7b 08 e8 2b c5 b4 c0 <49> 89 9c 24 50 02 00 00 4c 89 e7 e8 9b fe ff ff 85 c0 75 0e 48 
[333179.844065] RIP  [<ffffffffc055ac35>] snd_card_free+0x35/0x60 [snd]
[333179.844070]  RSP <ffff8803061c7e88>
[333179.844071] CR2: 0000000000000250
[333179.844072] ---[ end trace 6732879c7994b055 ]---


Version-Release number of selected component (if applicable):

$ uname -irsv 
Linux 3.18.3-desktop-1.mga5 #1 SMP Fri Jan 16 19:12:00 UTC 2015 x86_64

How reproducible:

Not quite sure yet...

Steps to Reproduce:
0. hibernate/resume a couple of times?
1. Kill the ALSA state daemon process
2. try to `rmmod saa7134_alsa'


Reproducible: 

Steps to Reproduce:
Theodoros Kalamatianos 2015-01-22 09:52:13 CET

CC: (none) => pterjan

Comment 1 claire robinson 2015-01-22 11:07:10 CET 
Similar here with an saa7134 cctv card. It doesn't use saa7134_alsa as it has no audio but modprobe then rmmod shows "Killed" and the following in the journal, no hibernation required..

<modprobe here>
kernel: saa7134 ALSA driver for DMA sound loaded
kernel: saa7130[0]/alsa: Kworld/KuroutoShikou SAA7130-TVPCI doesn't support digital audio
kernel: saa7130[1]/alsa: UNKNOWN/GENERIC doesn't support digital audio
kernel: saa7130[2]/alsa: UNKNOWN/GENERIC doesn't support digital audio
kernel: saa7130[3]/alsa: UNKNOWN/GENERIC doesn't support digital audio
kernel: saa7130[4]/alsa: UNKNOWN/GENERIC doesn't support digital audio
kernel: saa7130[5]/alsa: UNKNOWN/GENERIC doesn't support digital audio
kernel: saa7130[6]/alsa: UNKNOWN/GENERIC doesn't support digital audio
kernel: saa7130[7]/alsa: UNKNOWN/GENERIC doesn't support digital audio
zmc_dvideo0[7911]: INF [Monitor-1: 14000 - Capturing at 4.98 fps]

<rmmod here>
kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000250
kernel: IP: [<ffffffffc061bc35>] snd_card_free+0x35/0x60 [snd]
kernel: PGD 4383f067 PUD 5bf2b067 PMD 0 
kernel: Oops: 0002 [#1] SMP 
kernel: Modules linked in: saa7134_alsa(-) fuse ipt_IFWLOG ipt_psd xt_set ip_set_hash_ip ip_set nf_log_i
kernel:  nf_conntrack_broadcast nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp ts_kmp nf_conntrack_
kernel:  ide_core ata_generic pata_acpi pata_via sata_via
kernel: CPU: 1 PID: 25798 Comm: rmmod Not tainted 3.18.3-desktop-2.mga5 #1
kernel: Hardware name: System manufacturer System Product Name/P5VD2-X, BIOS ASUS P5VD2-X ACPI BIOS Revi
kernel: task: ffff880043bbc830 ti: ffff88007c83c000 task.ti: ffff88007c83c000
kernel: Hardware name: System manufacturer System Product Name/P5VD2-X, BIOS ASUS P5VD2-X ACPI BIOS Revi
kernel: task: ffff880043bbc830 ti: ffff88007c83c000 task.ti: ffff88007c83c000
kernel: RIP: 0010:[<ffffffffc061bc35>]  [<ffffffffc061bc35>] snd_card_free+0x35/0x60 [snd]
kernel: RSP: 0018:ffff88007c83fe88  EFLAGS: 00010246
kernel: RAX: ffff88007c83fea8 RBX: ffff88007c83fe98 RCX: 0000000000000001
kernel: RDX: ffffffffc0629080 RSI: ffffffffc0625dea RDI: ffff88007c83fea0
kernel: RBP: ffff88007c83fec8 R08: ffff88007c83c000 R09: 0000000000000001
kernel: R10: 8080808080808080 R11: 0000000000000000 R12: 0000000000000000
kernel: R13: 0000000000000800 R14: 0000000000000000 R15: 000000000240c1d0
kernel: FS:  00007fb84e12f700(0000) GS:ffff88007fc80000(0000) knlGS:0000000000000000
kernel: CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
kernel: CR2: 0000000000000250 CR3: 000000005bfa5000 CR4: 00000000000007e0
kernel: Stack:
kernel:  0000000000000000 0000000200000005 ffff880000000000 ffffffff810e0000
kernel:  ffff88007c83fea8 ffff88007c83fea8 ffffffffc0938608 ffffffffc0938380
kernel:  ffff88007c83fee8 ffffffffc0936a24 ffffffffc0938380 0000000000000000
kernel: Call Trace:
kernel:  [<ffffffff810e0000>] ? exit_robust_list+0x120/0x130
kernel:  [<ffffffffc0936a24>] saa7134_alsa_exit+0x24/0x600 [saa7134_alsa]
kernel:  [<ffffffff810e5764>] SyS_delete_module+0x144/0x1e0
kernel:  [<ffffffff81013181>] ? do_notify_resume+0x61/0x90
kernel:  [<ffffffff816b24ed>] system_call_fastpath+0x16/0x1b
kernel: Code: 90 62 c0 48 c7 c6 ea 5d 62 c0 48 89 e5 41 54 53 48 8d 5d d0 49 89 fc 48 83 ec 30 c7 45 d0 
kernel: RIP  [<ffffffffc061bc35>] snd_card_free+0x35/0x60 [snd]
kernel:  RSP <ffff88007c83fe88>
kernel: CR2: 0000000000000250
kernel: ---[ end trace 1d4f0cb8900af168 ]---

CC: (none) => eeeemail

Comment 2 claire robinson 2015-01-22 11:08:49 CET 
# uname -a
Linux cctv 3.18.3-desktop-2.mga5 #1 SMP Wed Jan 21 15:40:50 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
Comment 3 claire robinson 2015-01-22 11:10:16 CET 
The module is not removed..

# lsmod | grep saa
saa7134_alsa           18546  0 
snd_pcm               114043  4 snd_hda_codec,snd_hda_intel,snd_hda_controller,saa7134_alsa
snd                    87899  16 snd_hda_codec_realtek,snd_hwdep,snd_timer,snd_pcm,snd_hda_codec_generic,snd_hda_codec,snd_hda_intel,saa7134_alsa
saa7134               191159  2 saa7134_alsa
tveeprom               21216  1 saa7134
videobuf2_dma_sg       13147  1 saa7134
videobuf2_core         47079  1 saa7134
rc_core                27333  1 saa7134
v4l2_common            15682  3 tuner,saa7134,videobuf2_core
videodev              154586  5 tuner,saa7134,v4l2_common,videobuf2_core
Samuel Verschelde 2015-05-31 21:59:06 CEST

Whiteboard: (none) => MGA5TOO

Comment 4 Marja Van Waes 2016-08-26 11:43:05 CEST 
Mass-reassigning all bugs with "kernel" in the Source RPM field that are assigned to tmb, to the kernel packagers group, because tmb is currently MIA.

Assignee: tmb => kernel