Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

'rmmod sof_acpi_dev' kernel panic on BYT with sof-byt-nocodec.tplg #33

Closed
zhuqingliang opened this issue Jul 16, 2018 · 10 comments
Closed

'rmmod sof_acpi_dev' kernel panic on BYT with sof-byt-nocodec.tplg #33

zhuqingliang opened this issue Jul 16, 2018 · 10 comments
Assignees
@lyakh
Labels
bug Something isn't working BYT Applies to Baytrail platform P2 Critical bugs or normal features

Comments

@zhuqingliang
Copy link

environment:
sof-dev: a3a39f2
sof: c4a9cca
soft: 2abbfc0

reproduce steps:
using topology/sof-byt-nocodec.tplg or topology/sof-byt-rt5651.tplg
rmmod sof_acpi_dev
check dmesg log.

log:
dmesg.log
rmbox.log
@zhuqingliang zhuqingliang mentioned this issue Jul 16, 2018
Closed
@plbossart plbossart added the bug Something isn't working label Jul 16, 2018
@plbossart
Copy link
Member

reproduced with sof-byt-nocodec.tplg but with a different error (which seems more difficult to handle)
dmesg.log

No issues whatsoever with APL also in nocodec topology, not sure why.

@plbossart plbossart mentioned this issue Jul 19, 2018
Closed
@ghost
Copy link

ghost commented Aug 14, 2018

the PR #80 and PR #72 can fix this kind of kernel panic issue already.

@keqiaozhang keqiaozhang added the P2 Critical bugs or normal features label Aug 20, 2018
@jocelyn-li jocelyn-li mentioned this issue Sep 13, 2018
Closed
@ZhendanYang
Copy link

Can't reproduce on BYT with sof-byt-nocodec.tplg, but still exists with sof-byt-rt5651.tplg
Test env:
kernel : sof-dev 64cf3e3
firmware : stable1.2 f883691
sof tool : d77beaf

Log:
dmesg-33.log
rmbox-t-33.log

@ZhendanYang ZhendanYang reopened this Sep 13, 2018
@ZhendanYang
Copy link

ZhendanYang commented Sep 20, 2018 •
edited
Loading

Firmware load failed after booting. So tests were blocked.
Env:
sof-dev : 108d9cf
sof tool: 78748d4
sof stable-1.2: 7dd4b1d
tplg: sof-byt-nocodec.tplg
Log:
dmesg-byt.log

@lgirdwood
Copy link
Member

@lyakh looks like a topology component double free attempt (1st time may set it to NULL).

[   39.508975] sof-audio sof-audio: pcm: free stream 0 dir 1
[   39.509005] sof-audio sof-audio: ipc: send 0x60030000
[   39.509090] sof-audio sof-audio: ipc: 0x60030000 succeeded
[   39.509270] sof-audio sof-audio: pcm: close stream 0 dir 1
[   39.653888] sof-audio sof-audio: free topology...
[   39.653928] BUG: unable to handle kernel NULL pointer dereference at 0000000000000070
[   39.653941] PGD 0 P4D 0 
[   39.653950] Oops: 0000 [#1] SMP PTI
[   39.653955] Modules linked in: intel_soc_dts_thermal intel_soc_dts_iosf intel_powerclamp coretemp kvm_intel kvm irqbypass punit_atom_debug crct10dif_pclmul nls_iso8859_1 crc32_pclmul ghash_clmulni_intel pcbc aesni_intel sof_acpi_dev(-) snd_sof_intel_bdw aes_x86_64 crypto_simd snd_sof_intel_byt snd_sof_nocodec cryptd snd_sof_intel_hsw glue_helper snd_sof snd_soc_rt5651 snd_sof_xtensa_dsp snd_soc_rl6231 snd_soc_acpi_intel_match snd_soc_acpi snd_soc_core snd_compress snd_pcm_dmaengine ac97_bus snd_seq_midi snd_seq_midi_event snd_pcm joydev input_leds snd_rawmidi lpc_ich shpchp snd_seq mei_txe mei snd_seq_device snd_timer snd mac_hid soundcore pwm_lpss_platform spi_pxa2xx_platform 8250_dw pwm_lpss sunrpc parport_pc ppdev lp parport ip_tables x_tables autofs4 i915 i2c_algo_bit drm_kms_helper syscopyarea
[   39.654041]  sysfillrect sysimgblt fb_sys_fops r8169 drm ahci mii libahci video sdhci_acpi sdhci hid_generic usbhid hid
[   39.654064] CPU: 0 PID: 1195 Comm: pulseaudio Not tainted 4.17.0-a3a39-noc-+ #9
[   39.654068] Hardware name: ADI Minnowboard Turbot D0 PLATFORM/MinnowBoard Turbot, BIOS MNW2MAX1.X64.0090.R01.1601281003 01/28/2016
[   39.654096] RIP: 0010:remove_widget+0xaf/0x150 [snd_soc_core]
[   39.654102] RSP: 0018:ffffb08f80e4bd00 EFLAGS: 00010246
[   39.654108] RAX: ffff9493f49a6da8 RBX: 0000000000000000 RCX: 0000000000000001
[   39.654112] RDX: 0000000000000001 RSI: fffff4d3c158a9c0 RDI: 0000000040000000
[   39.654116] RBP: ffff9493f380c6a8 R08: ffff9494162a7ba0 R09: 00000001802a0023
[   39.654120] R10: ffffb08f80e4bc30 R11: 0000000000000000 R12: 0000000000000000
[   39.654124] R13: ffff94942f47b000 R14: 0000000000000000 R15: ffff9493f380c6a8
[   39.654129] FS:  00007f5690eaf8c0(0000) GS:ffff949438200000(0000) knlGS:0000000000000000
[   39.654133] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   39.654137] CR2: 0000000000000070 CR3: 000000006c800000 CR4: 00000000001006f0
[   39.654141] Call Trace:
[   39.654175]  snd_soc_tplg_component_remove+0x79/0x390 [snd_soc_core]
[   39.654192]  snd_sof_free_topology+0x32/0x50 [snd_sof]
[   39.654219]  soc_pcm_private_free+0x4a/0x60 [snd_soc_core]
[   39.654236]  snd_pcm_free+0x30/0xa0 [snd_pcm]
[   39.654252]  __snd_device_free+0x48/0x80 [snd]
[   39.654264]  snd_device_free_all+0x2b/0x40 [snd]
[   39.654275]  release_card_device+0x32/0x90 [snd]
[   39.654286]  device_release+0x30/0x90
[   39.654296]  kobject_put+0x84/0x1b0
[   39.654309]  snd_card_file_remove+0x97/0x170 [snd]
[   39.654322]  snd_ctl_release+0x103/0x110 [snd]
[   39.654332]  __fput+0xd8/0x210
[   39.654341]  task_work_run+0x8a/0xb0
[   39.654350]  exit_to_usermode_loop+0xbd/0xc0
[   39.654358]  do_syscall_64+0xf3/0x110
[   39.654366]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[   39.654373] RIP: 0033:0x7f568fa4ddf0
[   39.654377] RSP: 002b:00007ffc4d7e1a20 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[   39.654384] RAX: 0000000000000000 RBX: 0000000000000029 RCX: 00007f568fa4ddf0
[   39.654388] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000029
[   39.654392] RBP: 000055d472034e90 R08: 0000000000000001 R09: 00007ffc4d7e1900
[   39.654396] R10: 0000000000000fa0 R11: 0000000000000293 R12: 0000000000000000
[   39.654400] R13: 000055d471fe61c0 R14: 000055d47201c850 R15: 0000000000000001
[   39.654405] Code: 10 e8 16 e5 af fa 48 8b 45 f8 48 85 c0 0f 84 9d 00 00 00 39 5d e8 0f 8e 94 00 00 00 8b 55 20 4c 63 e3 83 fa 01 4e 8b 34 e0 75 af <49> 8b 7e 70 e8 e8 e4 af fa eb a4 85 c9 7e 76 45 31 f6 4d 63 fe 
[   39.654502] RIP: remove_widget+0xaf/0x150 [snd_soc_core] RSP: ffffb08f80e4bd00
[   39.654507] CR2: 0000000000000070
[   39.654513] ---[ end trace 4c7e9b6826a322ca ]---
[   39.919556] sof-audio sof-audio: ipc rx: 0x90020000 done

@mengdonglin mengdonglin added the BYT Applies to Baytrail platform label Sep 26, 2018
ranj063 pushed a commit to ranj063/linux that referenced this issue Nov 28, 2018
@selvintxavier @gregkh
RDMA/bnxt_re: Fix recursive lock warning in debug kernel
88018bc 
[ Upstream commit d455f29 ]

Fix possible recursive lock warning. Its a false warning as the locks are
part of two differnt HW Queue data structure - cmdq and creq. Debug kernel
is throwing the following warning and stack trace.

[  783.914967] ============================================
[  783.914970] WARNING: possible recursive locking detected
[  783.914973] 4.19.0-rc2+ thesofproject#33 Not tainted
[  783.914976] --------------------------------------------
[  783.914979] swapper/2/0 is trying to acquire lock:
[  783.914982] 000000002aa3949d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
[  783.914999]
but task is already holding lock:
[  783.915002] 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re]
[  783.915013]
other info that might help us debug this:
[  783.915016]  Possible unsafe locking scenario:

[  783.915019]        CPU0
[  783.915021]        ----
[  783.915034]   lock(&(&hwq->lock)->rlock);
[  783.915035]   lock(&(&hwq->lock)->rlock);
[  783.915037]
 *** DEADLOCK ***

[  783.915038]  May be due to missing lock nesting notation

[  783.915039] 1 lock held by swapper/2/0:
[  783.915040]  #0: 00000000be73920d (&(&hwq->lock)->rlock){..-.}, at: bnxt_qplib_service_creq+0x2a/0x350 [bnxt_re]
[  783.915044]
stack backtrace:
[  783.915046] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.0-rc2+ thesofproject#33
[  783.915047] Hardware name: Dell Inc. PowerEdge R730/0599V5, BIOS 1.0.4 08/28/2014
[  783.915048] Call Trace:
[  783.915049]  <IRQ>
[  783.915054]  dump_stack+0x90/0xe3
[  783.915058]  __lock_acquire+0x106c/0x1080
[  783.915061]  ? sched_clock+0x5/0x10
[  783.915063]  lock_acquire+0xbd/0x1a0
[  783.915065]  ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
[  783.915069]  _raw_spin_lock_irqsave+0x4a/0x90
[  783.915071]  ? bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
[  783.915073]  bnxt_qplib_service_creq+0x232/0x350 [bnxt_re]
[  783.915078]  tasklet_action_common.isra.17+0x197/0x1b0
[  783.915081]  __do_softirq+0xcb/0x3a6
[  783.915084]  irq_exit+0xe9/0x100
[  783.915085]  do_IRQ+0x6a/0x120
[  783.915087]  common_interrupt+0xf/0xf
[  783.915088]  </IRQ>

Use nested notation for the spin_lock to avoid this warning.

Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
@mengdonglin
Copy link
Collaborator

@stevyan @markyang Could you help to check if this issue is gone with fixing of #144 by #311?

@markyang
Copy link

markyang commented Dec 12, 2018 •
edited
Loading

Summary:
This issue cannot be reproduced on BYT-nocodec using the build on Dec 7.
There is no Kernel Panic.

Test steps:

  1. kmod_scripts/sof_bootone.sh
  2. aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: sofnocodec [sof-nocodec], device 0: Passthrough (*) []
  Subdevices: 1/1
  Subdevice #0: subdevice #0
  1. arecord -l
**** List of CAPTURE Hardware Devices ****
card 0: sofnocodec [sof-nocodec], device 0: Passthrough (*) []
  Subdevices: 1/1
  Subdevice #0: subdevice #0

Test env:
sof master: b5d6c71 #Dec 7
kernel sof-dev: a71221d #Dec 7
tplg: test-ssp2-mclk-0-I2S-volume-s16le-s16le-48k-19200k-nocodec.tplg

@mengdonglin
Copy link
Collaborator

@markyang it's good that we don't have kernel panic during unloading/reloading here. But the topology loaded seems wrong. https://github.com/thesofproject/sof/blob/master/tools/topology/sof-byt-rt5651.m4 should be used for Minnowboard with AL5651.

Could you help to

  • check why test-ssp2-mclk-0-I2S-volume-s16le-s16le-48k-19200k-nocodec.tplg is loaded here?
  • is unload/reload healthy with byt-rt5651.m4 for Minnow with ALC5651?

@markyang
Copy link

@mengdonglin sorry, this test was on BYT-nocodec, I've updated the summary.

@mengdonglin
Copy link
Collaborator

Closing the issue since it's fixed.

plbossart pushed a commit that referenced this issue Feb 13, 2019
@TinaZhangZW @danvet
drm/modes: Prevent division by zero htotal
a2fcd5c 
This patch prevents division by zero htotal.

In a follow-up mail Tina writes:

> > How did you manage to get here with htotal == 0? This needs backtraces (or if
> > this is just about static checkers, a mention of that).
> > -Daniel
>
> In GVT-g, we are trying to enable a virtual display w/o setting timings for a pipe
> (a.k.a htotal=0), then we met the following kernel panic:
>
> [   32.832048] divide error: 0000 [#1] SMP PTI
> [   32.833614] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.18.0-rc4-sriov+ #33
> [   32.834438] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.10.1-0-g8891697-dirty-20180511_165818-tinazhang-linux-1 04/01/2014
> [   32.835901] RIP: 0010:drm_mode_hsync+0x1e/0x40
> [   32.836004] Code: 31 c0 c3 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 8b 87 d8 00 00 00 85 c0 75 22 8b 4f 68 85 c9 78 1b 69 47 58 e8 03 00 00 99 <f7> f9 b9 d3 4d 62 10 05 f4 01 00 00 f7 e1 89 d0 c1 e8 06 f3 c3 66
> [   32.836004] RSP: 0000:ffffc900000ebb90 EFLAGS: 00010206
> [   32.836004] RAX: 0000000000000000 RBX: ffff88001c67c8a0 RCX: 0000000000000000
> [   32.836004] RDX: 0000000000000000 RSI: ffff88001c67c000 RDI: ffff88001c67c8a0
> [   32.836004] RBP: ffff88001c7d03a0 R08: ffff88001c67c8a0 R09: ffff88001c7d0330
> [   32.836004] R10: ffffffff822c3a98 R11: 0000000000000001 R12: ffff88001c67c000
> [   32.836004] R13: ffff88001c7d0370 R14: ffffffff8207eb78 R15: ffff88001c67c800
> [   32.836004] FS:  0000000000000000(0000) GS:ffff88001da00000(0000) knlGS:0000000000000000
> [   32.836004] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   32.836004] CR2: 0000000000000000 CR3: 000000000220a000 CR4: 00000000000006f0
> [   32.836004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   32.836004] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [   32.836004] Call Trace:
> [   32.836004]  intel_mode_from_pipe_config+0x72/0x90
> [   32.836004]  intel_modeset_setup_hw_state+0x569/0xf90
> [   32.836004]  intel_modeset_init+0x905/0x1db0
> [   32.836004]  i915_driver_load+0xb8c/0x1120
> [   32.836004]  i915_pci_probe+0x4d/0xb0
> [   32.836004]  local_pci_probe+0x44/0xa0
> [   32.836004]  ? pci_assign_irq+0x27/0x130
> [   32.836004]  pci_device_probe+0x102/0x1c0
> [   32.836004]  driver_probe_device+0x2b8/0x480
> [   32.836004]  __driver_attach+0x109/0x110
> [   32.836004]  ? driver_probe_device+0x480/0x480
> [   32.836004]  bus_for_each_dev+0x67/0xc0
> [   32.836004]  ? klist_add_tail+0x3b/0x70
> [   32.836004]  bus_add_driver+0x1e8/0x260
> [   32.836004]  driver_register+0x5b/0xe0
> [   32.836004]  ? mipi_dsi_bus_init+0x11/0x11
> [   32.836004]  do_one_initcall+0x4d/0x1eb
> [   32.836004]  kernel_init_freeable+0x197/0x237
> [   32.836004]  ? rest_init+0xd0/0xd0
> [   32.836004]  kernel_init+0xa/0x110
> [   32.836004]  ret_from_fork+0x35/0x40
> [   32.836004] Modules linked in:
> [   32.859183] ---[ end trace 525608b0ed0e8665 ]---
> [   32.859722] RIP: 0010:drm_mode_hsync+0x1e/0x40
> [   32.860287] Code: 31 c0 c3 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 8b 87 d8 00 00 00 85 c0 75 22 8b 4f 68 85 c9 78 1b 69 47 58 e8 03 00 00 99 <f7> f9 b9 d3 4d 62 10 05 f4 01 00 00 f7 e1 89 d0 c1 e8 06 f3 c3 66
> [   32.862680] RSP: 0000:ffffc900000ebb90 EFLAGS: 00010206
> [   32.863309] RAX: 0000000000000000 RBX: ffff88001c67c8a0 RCX: 0000000000000000
> [   32.864182] RDX: 0000000000000000 RSI: ffff88001c67c000 RDI: ffff88001c67c8a0
> [   32.865206] RBP: ffff88001c7d03a0 R08: ffff88001c67c8a0 R09: ffff88001c7d0330
> [   32.866359] R10: ffffffff822c3a98 R11: 0000000000000001 R12: ffff88001c67c000
> [   32.867213] R13: ffff88001c7d0370 R14: ffffffff8207eb78 R15: ffff88001c67c800
> [   32.868075] FS:  0000000000000000(0000) GS:ffff88001da00000(0000) knlGS:0000000000000000
> [   32.868983] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [   32.869659] CR2: 0000000000000000 CR3: 000000000220a000 CR4: 00000000000006f0
> [   32.870599] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [   32.871598] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [   32.872549] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
>
> Since drm_mode_hsync() has the logic to check mode->htotal, I just extend it to cover the case htotal==0.

Signed-off-by: Tina Zhang <tina.zhang@intel.com>
Cc: Adam Jackson <ajax@redhat.com>
Cc: Dave Airlie <airlied@redhat.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
[danvet: Add additional explanations + cc: stable.]
Cc: stable@vger.kernel.org
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Link: https://patchwork.freedesktop.org/patch/msgid/1548228539-3061-1-git-send-email-tina.zhang@intel.com
plbossart pushed a commit that referenced this issue Jul 17, 2020
@borntraeger
KVM: s390: reduce number of IO pins to 1
7749112 
The current number of KVM_IRQCHIP_NUM_PINS results in an order 3
allocation (32kb) for each guest start/restart. This can result in OOM
killer activity even with free swap when the memory is fragmented
enough:

kernel: qemu-system-s39 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_COMP|__GFP_ZERO), order=3, oom_score_adj=0
kernel: CPU: 1 PID: 357274 Comm: qemu-system-s39 Kdump: loaded Not tainted 5.4.0-29-generic #33-Ubuntu
kernel: Hardware name: IBM 8562 T02 Z06 (LPAR)
kernel: Call Trace:
kernel: ([<00000001f848fe2a>] show_stack+0x7a/0xc0)
kernel:  [<00000001f8d3437a>] dump_stack+0x8a/0xc0
kernel:  [<00000001f8687032>] dump_header+0x62/0x258
kernel:  [<00000001f8686122>] oom_kill_process+0x172/0x180
kernel:  [<00000001f8686abe>] out_of_memory+0xee/0x580
kernel:  [<00000001f86e66b8>] __alloc_pages_slowpath+0xd18/0xe90
kernel:  [<00000001f86e6ad4>] __alloc_pages_nodemask+0x2a4/0x320
kernel:  [<00000001f86b1ab4>] kmalloc_order+0x34/0xb0
kernel:  [<00000001f86b1b62>] kmalloc_order_trace+0x32/0xe0
kernel:  [<00000001f84bb806>] kvm_set_irq_routing+0xa6/0x2e0
kernel:  [<00000001f84c99a4>] kvm_arch_vm_ioctl+0x544/0x9e0
kernel:  [<00000001f84b8936>] kvm_vm_ioctl+0x396/0x760
kernel:  [<00000001f875df66>] do_vfs_ioctl+0x376/0x690
kernel:  [<00000001f875e304>] ksys_ioctl+0x84/0xb0
kernel:  [<00000001f875e39a>] __s390x_sys_ioctl+0x2a/0x40
kernel:  [<00000001f8d55424>] system_call+0xd8/0x2c8

As far as I can tell s390x does not use the iopins as we bail our for
anything other than KVM_IRQ_ROUTING_S390_ADAPTER and the chip/pin is
only used for KVM_IRQ_ROUTING_IRQCHIP. So let us use a small number to
reduce the memory footprint.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20200617083620.5409-1-borntraeger@de.ibm.com
kv2019i pushed a commit that referenced this issue Sep 10, 2020
@bharatpotnuri @davem330
cxgb4: fix thermal zone device registration
6b6382a 
When multiple adapters are present in the system, pci hot-removing second
adapter leads to the following warning as both the adapters registered
thermal zone device with same thermal zone name/type.
Therefore, use unique thermal zone name during thermal zone device
initialization. Also mark thermal zone dev NULL once unregistered.

[  414.370143] ------------[ cut here ]------------
[  414.370944] sysfs group 'power' not found for kobject 'hwmon0'
[  414.371747] WARNING: CPU: 9 PID: 2661 at fs/sysfs/group.c:281
 sysfs_remove_group+0x76/0x80
[  414.382550] CPU: 9 PID: 2661 Comm: bash Not tainted 5.8.0-rc6+ #33
[  414.383593] Hardware name: Supermicro X10SRA-F/X10SRA-F, BIOS 2.0a 06/23/2016
[  414.384669] RIP: 0010:sysfs_remove_group+0x76/0x80
[  414.385738] Code: 48 89 df 5b 5d 41 5c e9 d8 b5 ff ff 48 89 df e8 60 b0 ff ff
 eb cb 49 8b 14 24 48 8b 75 00 48 c7 c7 90 ae 13 bb e8 6a 27 d0 ff <0f> 0b 5b 5d
 41 5c c3 0f 1f 00 0f 1f 44 00 00 48 85 f6 74 31 41 54
[  414.388404] RSP: 0018:ffffa22bc080fcb0 EFLAGS: 00010286
[  414.389638] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[  414.390829] RDX: 0000000000000001 RSI: ffff8ee2de3e9510 RDI: ffff8ee2de3e9510
[  414.392064] RBP: ffffffffbaef2ee0 R08: 0000000000000000 R09: 0000000000000000
[  414.393224] R10: 0000000000000000 R11: 000000002b30006c R12: ffff8ee260720008
[  414.394388] R13: ffff8ee25e0a40e8 R14: ffffa22bc080ff08 R15: ffff8ee2c3be5020
[  414.395661] FS:  00007fd2a7171740(0000) GS:ffff8ee2de200000(0000)
 knlGS:0000000000000000
[  414.396825] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  414.398011] CR2: 00007f178ffe5020 CR3: 000000084c5cc003 CR4: 00000000003606e0
[  414.399172] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  414.400352] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  414.401473] Call Trace:
[  414.402685]  device_del+0x89/0x400
[  414.403819]  device_unregister+0x16/0x60
[  414.405024]  hwmon_device_unregister+0x44/0xa0
[  414.406112]  thermal_remove_hwmon_sysfs+0x196/0x200
[  414.407256]  thermal_zone_device_unregister+0x1b5/0x1f0
[  414.408415]  cxgb4_thermal_remove+0x3c/0x4f [cxgb4]
[  414.409668]  remove_one+0x212/0x290 [cxgb4]
[  414.410875]  pci_device_remove+0x36/0xb0
[  414.412004]  device_release_driver_internal+0xe2/0x1c0
[  414.413276]  pci_stop_bus_device+0x64/0x90
[  414.414433]  pci_stop_and_remove_bus_device_locked+0x16/0x30
[  414.415609]  remove_store+0x75/0x90
[  414.416790]  kernfs_fop_write+0x114/0x1b0
[  414.417930]  vfs_write+0xcf/0x210
[  414.419059]  ksys_write+0xa7/0xe0
[  414.420120]  do_syscall_64+0x4c/0xa0
[  414.421278]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
[  414.422335] RIP: 0033:0x7fd2a686afd0
[  414.423396] Code: Bad RIP value.
[  414.424549] RSP: 002b:00007fffc1446148 EFLAGS: 00000246 ORIG_RAX:
 0000000000000001
[  414.425638] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd2a686afd0
[  414.426830] RDX: 0000000000000002 RSI: 00007fd2a7196000 RDI: 0000000000000001
[  414.427927] RBP: 00007fd2a7196000 R08: 000000000000000a R09: 00007fd2a7171740
[  414.428923] R10: 00007fd2a7171740 R11: 0000000000000246 R12: 00007fd2a6b43400
[  414.430082] R13: 0000000000000002 R14: 0000000000000001 R15: 0000000000000000
[  414.431027] irq event stamp: 76300
[  414.435678] ---[ end trace 13865acb4d5ab00f ]---

Fixes: b187191 ("cxgb4: Add thermal zone support")
Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
cujomalainey pushed a commit to cujomalainey/linux that referenced this issue Oct 26, 2020
@howardchungg @gregkh
Bluetooth: L2CAP: handle l2cap config request during open state
799263e 
[ Upstream commit 96298f6 ]

According to Core Spec Version 5.2 | Vol 3, Part A 6.1.5,
the incoming L2CAP_ConfigReq should be handled during
OPEN state.

The section below shows the btmon trace when running
L2CAP/COS/CFD/BV-12-C before and after this change.

=== Before ===
...
> ACL Data RX: Handle 256 flags 0x02 dlen 12                thesofproject#22
      L2CAP: Connection Request (0x02) ident 2 len 4
        PSM: 1 (0x0001)
        Source CID: 65
< ACL Data TX: Handle 256 flags 0x00 dlen 16                thesofproject#23
      L2CAP: Connection Response (0x03) ident 2 len 8
        Destination CID: 64
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
< ACL Data TX: Handle 256 flags 0x00 dlen 12                thesofproject#24
      L2CAP: Configure Request (0x04) ident 2 len 4
        Destination CID: 65
        Flags: 0x0000
> HCI Event: Number of Completed Packets (0x13) plen 5      thesofproject#25
        Num handles: 1
        Handle: 256
        Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5      thesofproject#26
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 16                thesofproject#27
      L2CAP: Configure Request (0x04) ident 3 len 8
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00                                            ..
< ACL Data TX: Handle 256 flags 0x00 dlen 18                thesofproject#28
      L2CAP: Configure Response (0x05) ident 3 len 10
        Source CID: 65
        Flags: 0x0000
        Result: Success (0x0000)
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 672
> HCI Event: Number of Completed Packets (0x13) plen 5      thesofproject#29
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 14                thesofproject#30
      L2CAP: Configure Response (0x05) ident 2 len 6
        Source CID: 64
        Flags: 0x0000
        Result: Success (0x0000)
> ACL Data RX: Handle 256 flags 0x02 dlen 20                thesofproject#31
      L2CAP: Configure Request (0x04) ident 3 len 12
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00 91 02 11 11                                ......
< ACL Data TX: Handle 256 flags 0x00 dlen 14                thesofproject#32
      L2CAP: Command Reject (0x01) ident 3 len 6
        Reason: Invalid CID in request (0x0002)
        Destination CID: 64
        Source CID: 65
> HCI Event: Number of Completed Packets (0x13) plen 5      thesofproject#33
        Num handles: 1
        Handle: 256
        Count: 1
...
=== After ===
...
> ACL Data RX: Handle 256 flags 0x02 dlen 12               thesofproject#22
      L2CAP: Connection Request (0x02) ident 2 len 4
        PSM: 1 (0x0001)
        Source CID: 65
< ACL Data TX: Handle 256 flags 0x00 dlen 16               thesofproject#23
      L2CAP: Connection Response (0x03) ident 2 len 8
        Destination CID: 64
        Source CID: 65
        Result: Connection successful (0x0000)
        Status: No further information available (0x0000)
< ACL Data TX: Handle 256 flags 0x00 dlen 12               thesofproject#24
      L2CAP: Configure Request (0x04) ident 2 len 4
        Destination CID: 65
        Flags: 0x0000
> HCI Event: Number of Completed Packets (0x13) plen 5     thesofproject#25
        Num handles: 1
        Handle: 256
        Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5     thesofproject#26
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 16               thesofproject#27
      L2CAP: Configure Request (0x04) ident 3 len 8
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00                                            ..
< ACL Data TX: Handle 256 flags 0x00 dlen 18               thesofproject#28
      L2CAP: Configure Response (0x05) ident 3 len 10
        Source CID: 65
        Flags: 0x0000
        Result: Success (0x0000)
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 672
> HCI Event: Number of Completed Packets (0x13) plen 5     thesofproject#29
        Num handles: 1
        Handle: 256
        Count: 1
> ACL Data RX: Handle 256 flags 0x02 dlen 14               thesofproject#30
      L2CAP: Configure Response (0x05) ident 2 len 6
        Source CID: 64
        Flags: 0x0000
        Result: Success (0x0000)
> ACL Data RX: Handle 256 flags 0x02 dlen 20               thesofproject#31
      L2CAP: Configure Request (0x04) ident 3 len 12
        Destination CID: 64
        Flags: 0x0000
        Option: Unknown (0x10) [hint]
        01 00 91 02 11 11                                .....
< ACL Data TX: Handle 256 flags 0x00 dlen 18               thesofproject#32
      L2CAP: Configure Response (0x05) ident 3 len 10
        Source CID: 65
        Flags: 0x0000
        Result: Success (0x0000)
        Option: Maximum Transmission Unit (0x01) [mandatory]
          MTU: 672
< ACL Data TX: Handle 256 flags 0x00 dlen 12               thesofproject#33
      L2CAP: Configure Request (0x04) ident 3 len 4
        Destination CID: 65
        Flags: 0x0000
> HCI Event: Number of Completed Packets (0x13) plen 5     thesofproject#34
        Num handles: 1
        Handle: 256
        Count: 1
> HCI Event: Number of Completed Packets (0x13) plen 5     thesofproject#35
        Num handles: 1
        Handle: 256
        Count: 1
...

Signed-off-by: Howard Chung <howardchung@google.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
aiChaoSONG pushed a commit to aiChaoSONG/linux that referenced this issue May 6, 2021
@ojeda
Merge pull request thesofproject#33 from Rust-for-Linux/rust-bindgen
62d4aaa 
Use bindgen as a program rather than as a library
Vamshigopal pushed a commit to Vamshigopal/linux that referenced this issue Jan 9, 2023
@swkim101 @gregkh
Bluetooth: L2CAP: Fix u8 overflow
f3fe681 
[ Upstream commit bcd7026 ]

By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases
multiple times and eventually it will wrap around the maximum number
(i.e., 255).
This patch prevents this by adding a boundary check with
L2CAP_MAX_CONF_RSP

Btmon log:
Bluetooth monitor ver 5.64
= Note: Linux version 6.1.0-rc2 (x86_64)                               0.264594
= Note: Bluetooth subsystem version 2.22                               0.264636
@ MGMT Open: btmon (privileged) version 1.22                  {0x0001} 0.272191
= New Index: 00:00:00:00:00:00 (Primary,Virtual,hci0)          [hci0] 13.877604
@ RAW Open: 9496 (privileged) version 2.22                   {0x0002} 13.890741
= Open Index: 00:00:00:00:00:00                                [hci0] 13.900426
(...)
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             thesofproject#32 [hci0] 14.273106
        invalid packet size (12 != 1033)
        08 00 01 00 02 01 04 00 01 10 ff ff              ............
> ACL Data RX: Handle 200 flags 0x00 dlen 1547             thesofproject#33 [hci0] 14.273561
        invalid packet size (14 != 1547)
        0a 00 01 00 04 01 06 00 40 00 00 00 00 00        ........@.....
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             thesofproject#34 [hci0] 14.274390
        invalid packet size (16 != 2061)
        0c 00 01 00 04 01 08 00 40 00 00 00 00 00 00 04  ........@.......
> ACL Data RX: Handle 200 flags 0x00 dlen 2061             thesofproject#35 [hci0] 14.274932
        invalid packet size (16 != 2061)
        0c 00 01 00 04 01 08 00 40 00 00 00 07 00 03 00  ........@.......
= bluetoothd: Bluetooth daemon 5.43                                   14.401828
> ACL Data RX: Handle 200 flags 0x00 dlen 1033             thesofproject#36 [hci0] 14.275753
        invalid packet size (12 != 1033)
        08 00 01 00 04 01 04 00 40 00 00 00              ........@...

Signed-off-by: Sungwoo Kim <iam@sung-woo.kim>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This issue was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@lyakh lyakh

Labels
bug Something isn't working BYT Applies to Baytrail platform P2 Critical bugs or normal features
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
8 participants
@plbossart @lyakh @mengdonglin @lgirdwood @ZhendanYang @keqiaozhang @zhuqingliang @markyang