Hi Laurentiu,
Quoting Laurentiu Palcu (2022-03-07 13:37:50)
> When removing the max9286 module we get a kernel oops:
>
> Unable to handle kernel paging request at virtual address 000000aa00000094
> Mem abort info:
> ESR = 0x96000004
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x04: level 0 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000004
> CM = 0, WnR = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=0000000880d85000
> [000000aa00000094] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 96000004 [#1] PREEMPT SMP
> Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec
> CPU: 2 PID: 713 Comm: rmmod Tainted: G C 5.15.5-00057-gaebcd29c8ed7-dirty #5
> Hardware name: Freescale i.MX8QXP MEK (DT)
> pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : i2c_mux_del_adapters+0x24/0xf0
> lr : max9286_remove+0x28/0xd0 [max9286]
> sp : ffff800013a9bbf0
> x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: 0000000000000000
> x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
> x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff800009297000
> x20: ffff0008048b0f70 x19: 000000aa00000064 x18: 0000000000000000
> x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
> x14: 0000000000000014 x13: 0000000000000000 x12: ffff000802da49e8
> x11: ffff000802051918 x10: ffff000802da4920 x9 : ffff000800030098
> x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d
> x5 : 8080808000000000 x4 : 0000000000000000 x3 : 0000000000000000
> x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : 0000000000000000
> Call trace:
> i2c_mux_del_adapters+0x24/0xf0
> max9286_remove+0x28/0xd0 [max9286]
> i2c_device_remove+0x40/0x110
> __device_release_driver+0x188/0x234
> driver_detach+0xc4/0x150
> bus_remove_driver+0x60/0xe0
> driver_unregister+0x34/0x64
> i2c_del_driver+0x58/0xa0
> max9286_i2c_driver_exit+0x1c/0x490 [max9286]
> __arm64_sys_delete_module+0x194/0x260
> invoke_syscall+0x48/0x114
> el0_svc_common.constprop.0+0xd4/0xfc
> do_el0_svc+0x2c/0x94
> el0_svc+0x28/0x80
> el0t_64_sync_handler+0xa8/0x130
> el0t_64_sync+0x1a0/0x1a4
>
> The Oops happens because the I2C client data does not point to
> max9286_priv anymore but to v4l2_subdev. The change happened in
> max9286_init() which calls v4l2_i2c_subdev_init() later on...
>
I think this needs a Fixes tag, but it looks like it happened when we
merged the driver. So that makes it:
Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
I see in max9286_probe() we set
i2c_set_clientdata(client, (struct max9286_priv) priv);
And indeed, then we call
max9286_init()
max9286_v4l2_register()
v4l2_i2c_subdev_init(&priv->sd, priv->client, &max9286_subdev_ops);
So I think this patch should probably also remove the call to
i2c_set_clientdata() in probe to prevent confusion.
> Signed-off-by: Laurentiu Palcu <[email protected]>
> ---
> drivers/media/i2c/max9286.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
> index d2a4915ed9f7..04f5b7e3a9e5 100644
> --- a/drivers/media/i2c/max9286.c
> +++ b/drivers/media/i2c/max9286.c
> @@ -1385,7 +1385,7 @@ static int max9286_probe(struct i2c_client *client)
>
> static int max9286_remove(struct i2c_client *client)
> {
> - struct max9286_priv *priv = i2c_get_clientdata(client);
> + struct max9286_priv *priv = sd_to_max9286(i2c_get_clientdata(client));
What happens if the module load failed before calling max9286_init(), in
that case, would the i2c_get_clientdata() return NULL?
If so, should this be checked?
--
Kieran
>
> i2c_mux_del_adapters(priv->mux);
>
> --
> 2.17.1
>
On Mon, Mar 07, 2022 at 02:27:11PM +0000, Kieran Bingham wrote:
> Hi Laurentiu,
>
> Quoting Laurentiu Palcu (2022-03-07 13:37:50)
> > When removing the max9286 module we get a kernel oops:
> >
> > Unable to handle kernel paging request at virtual address 000000aa00000094
> > Mem abort info:
> > ESR = 0x96000004
> > EC = 0x25: DABT (current EL), IL = 32 bits
> > SET = 0, FnV = 0
> > EA = 0, S1PTW = 0
> > FSC = 0x04: level 0 translation fault
> > Data abort info:
> > ISV = 0, ISS = 0x00000004
> > CM = 0, WnR = 0
> > user pgtable: 4k pages, 48-bit VAs, pgdp=0000000880d85000
> > [000000aa00000094] pgd=0000000000000000, p4d=0000000000000000
> > Internal error: Oops: 96000004 [#1] PREEMPT SMP
> > Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec
> > CPU: 2 PID: 713 Comm: rmmod Tainted: G C 5.15.5-00057-gaebcd29c8ed7-dirty #5
> > Hardware name: Freescale i.MX8QXP MEK (DT)
> > pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > pc : i2c_mux_del_adapters+0x24/0xf0
> > lr : max9286_remove+0x28/0xd0 [max9286]
> > sp : ffff800013a9bbf0
> > x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: 0000000000000000
> > x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
> > x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff800009297000
> > x20: ffff0008048b0f70 x19: 000000aa00000064 x18: 0000000000000000
> > x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
> > x14: 0000000000000014 x13: 0000000000000000 x12: ffff000802da49e8
> > x11: ffff000802051918 x10: ffff000802da4920 x9 : ffff000800030098
> > x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d
> > x5 : 8080808000000000 x4 : 0000000000000000 x3 : 0000000000000000
> > x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : 0000000000000000
> > Call trace:
> > i2c_mux_del_adapters+0x24/0xf0
> > max9286_remove+0x28/0xd0 [max9286]
> > i2c_device_remove+0x40/0x110
> > __device_release_driver+0x188/0x234
> > driver_detach+0xc4/0x150
> > bus_remove_driver+0x60/0xe0
> > driver_unregister+0x34/0x64
> > i2c_del_driver+0x58/0xa0
> > max9286_i2c_driver_exit+0x1c/0x490 [max9286]
> > __arm64_sys_delete_module+0x194/0x260
> > invoke_syscall+0x48/0x114
> > el0_svc_common.constprop.0+0xd4/0xfc
> > do_el0_svc+0x2c/0x94
> > el0_svc+0x28/0x80
> > el0t_64_sync_handler+0xa8/0x130
> > el0t_64_sync+0x1a0/0x1a4
> >
> > The Oops happens because the I2C client data does not point to
> > max9286_priv anymore but to v4l2_subdev. The change happened in
> > max9286_init() which calls v4l2_i2c_subdev_init() later on...
> >
>
> I think this needs a Fixes tag, but it looks like it happened when we
> merged the driver. So that makes it:
>
> Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
>
> I see in max9286_probe() we set
> i2c_set_clientdata(client, (struct max9286_priv) priv);
>
> And indeed, then we call
>
> max9286_init()
> max9286_v4l2_register()
> v4l2_i2c_subdev_init(&priv->sd, priv->client, &max9286_subdev_ops);
>
> So I think this patch should probably also remove the call to
> i2c_set_clientdata() in probe to prevent confusion.
Agreed.
> > Signed-off-by: Laurentiu Palcu <[email protected]>
> > ---
> > drivers/media/i2c/max9286.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
> > index d2a4915ed9f7..04f5b7e3a9e5 100644
> > --- a/drivers/media/i2c/max9286.c
> > +++ b/drivers/media/i2c/max9286.c
> > @@ -1385,7 +1385,7 @@ static int max9286_probe(struct i2c_client *client)
> >
> > static int max9286_remove(struct i2c_client *client)
> > {
> > - struct max9286_priv *priv = i2c_get_clientdata(client);
> > + struct max9286_priv *priv = sd_to_max9286(i2c_get_clientdata(client));
>
> What happens if the module load failed before calling max9286_init(), in
> that case, would the i2c_get_clientdata() return NULL?
>
> If so, should this be checked?
.remove() isn't called if .probe() fails, so it should be fine
> >
> > i2c_mux_del_adapters(priv->mux);
> >
--
Regards,
Laurent Pinchart
Hi Kieran, Laurent,
On Mon, Mar 07, 2022 at 04:35:44PM +0200, Laurent Pinchart wrote:
> On Mon, Mar 07, 2022 at 02:27:11PM +0000, Kieran Bingham wrote:
> > Hi Laurentiu,
> >
> > Quoting Laurentiu Palcu (2022-03-07 13:37:50)
> > > When removing the max9286 module we get a kernel oops:
> > >
> > > Unable to handle kernel paging request at virtual address 000000aa00000094
> > > Mem abort info:
> > > ESR = 0x96000004
> > > EC = 0x25: DABT (current EL), IL = 32 bits
> > > SET = 0, FnV = 0
> > > EA = 0, S1PTW = 0
> > > FSC = 0x04: level 0 translation fault
> > > Data abort info:
> > > ISV = 0, ISS = 0x00000004
> > > CM = 0, WnR = 0
> > > user pgtable: 4k pages, 48-bit VAs, pgdp=0000000880d85000
> > > [000000aa00000094] pgd=0000000000000000, p4d=0000000000000000
> > > Internal error: Oops: 96000004 [#1] PREEMPT SMP
> > > Modules linked in: fsl_jr_uio caam_jr rng_core libdes caamkeyblob_desc caamhash_desc caamalg_desc crypto_engine max9271 authenc crct10dif_ce mxc_jpeg_encdec
> > > CPU: 2 PID: 713 Comm: rmmod Tainted: G C 5.15.5-00057-gaebcd29c8ed7-dirty #5
> > > Hardware name: Freescale i.MX8QXP MEK (DT)
> > > pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> > > pc : i2c_mux_del_adapters+0x24/0xf0
> > > lr : max9286_remove+0x28/0xd0 [max9286]
> > > sp : ffff800013a9bbf0
> > > x29: ffff800013a9bbf0 x28: ffff00080b6da940 x27: 0000000000000000
> > > x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
> > > x23: ffff000801a5b970 x22: ffff0008048b0890 x21: ffff800009297000
> > > x20: ffff0008048b0f70 x19: 000000aa00000064 x18: 0000000000000000
> > > x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
> > > x14: 0000000000000014 x13: 0000000000000000 x12: ffff000802da49e8
> > > x11: ffff000802051918 x10: ffff000802da4920 x9 : ffff000800030098
> > > x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d
> > > x5 : 8080808000000000 x4 : 0000000000000000 x3 : 0000000000000000
> > > x2 : ffffffffffffffff x1 : ffff00080b6da940 x0 : 0000000000000000
> > > Call trace:
> > > i2c_mux_del_adapters+0x24/0xf0
> > > max9286_remove+0x28/0xd0 [max9286]
> > > i2c_device_remove+0x40/0x110
> > > __device_release_driver+0x188/0x234
> > > driver_detach+0xc4/0x150
> > > bus_remove_driver+0x60/0xe0
> > > driver_unregister+0x34/0x64
> > > i2c_del_driver+0x58/0xa0
> > > max9286_i2c_driver_exit+0x1c/0x490 [max9286]
> > > __arm64_sys_delete_module+0x194/0x260
> > > invoke_syscall+0x48/0x114
> > > el0_svc_common.constprop.0+0xd4/0xfc
> > > do_el0_svc+0x2c/0x94
> > > el0_svc+0x28/0x80
> > > el0t_64_sync_handler+0xa8/0x130
> > > el0t_64_sync+0x1a0/0x1a4
> > >
> > > The Oops happens because the I2C client data does not point to
> > > max9286_priv anymore but to v4l2_subdev. The change happened in
> > > max9286_init() which calls v4l2_i2c_subdev_init() later on...
> > >
> >
> > I think this needs a Fixes tag, but it looks like it happened when we
> > merged the driver. So that makes it:
> >
> > Fixes: 66d8c9d2422d ("media: i2c: Add MAX9286 driver")
> >
> > I see in max9286_probe() we set
> > i2c_set_clientdata(client, (struct max9286_priv) priv);
> >
> > And indeed, then we call
> >
> > max9286_init()
> > max9286_v4l2_register()
> > v4l2_i2c_subdev_init(&priv->sd, priv->client, &max9286_subdev_ops);
> >
> > So I think this patch should probably also remove the call to
> > i2c_set_clientdata() in probe to prevent confusion.
>
> Agreed.
I suppose the reason why i2c_set_clientdata() is called in probe() is
because max9286_init() uses i2c_get_clientdata() to get priv. But, that
would be easily fixed if we change the function declaration to
static int max9286_init(struct max9286_priv *priv)
From priv we can get both client and dev, which are used inside the
function.
I'll send a v2 shortly.
Thanks,
Laurentiu
>
> > > Signed-off-by: Laurentiu Palcu <[email protected]>
> > > ---
> > > drivers/media/i2c/max9286.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/media/i2c/max9286.c b/drivers/media/i2c/max9286.c
> > > index d2a4915ed9f7..04f5b7e3a9e5 100644
> > > --- a/drivers/media/i2c/max9286.c
> > > +++ b/drivers/media/i2c/max9286.c
> > > @@ -1385,7 +1385,7 @@ static int max9286_probe(struct i2c_client *client)
> > >
> > > static int max9286_remove(struct i2c_client *client)
> > > {
> > > - struct max9286_priv *priv = i2c_get_clientdata(client);
> > > + struct max9286_priv *priv = sd_to_max9286(i2c_get_clientdata(client));
> >
> > What happens if the module load failed before calling max9286_init(), in
> > that case, would the i2c_get_clientdata() return NULL?
> >
> > If so, should this be checked?
>
> .remove() isn't called if .probe() fails, so it should be fine
>
> > >
> > > i2c_mux_del_adapters(priv->mux);
> > >
>
> --
> Regards,
>
> Laurent Pinchart