2010-08-10 22:13:19

by Sander Eikelenboom

[permalink] [raw]
Subject: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

Hi,

While trying to test try and report about some other bugs, i ran into this kernel panic when trying to grab video from my usb 2.0 em28xx videgrabber connected to a usb 2.0 port.
Complete serial log attachted.


[ 279.680018] general protection fault: 0000 [#1] SMP
[ 279.683901] last sysfs file: /sys/devices/pci0000:00/0000:00:12.2/usb1/1-5/i2c-0/name
[ 279.683901] CPU 5
[ 279.683901] Modules linked in: xt_multiport ipt_REJECT xt_recent xt_limit xt_tcpudp powernow_k8 mperf xt_state ipt_MA
SQUERADE ipt_LOG iptable_mangle iptable_filter iptable_nat ip_tables nf_nat x_tables nf_conntrack_ipv4 nf_conntrack nf_d
efrag_ipv4 fuse hwmon_vid loop saa7115 snd_cmipci gameport snd_opl3_lib snd_hwdep snd_mpu401_uart snd_rawmidi em28xx v4l
2_common snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_seq_device videodev snd_timer snd v4l1_compat v4l
2_compat_ioctl32 videobuf_vmalloc videobuf_core psmouse tpm_tis joydev evdev tveeprom serio_raw shpchp edac_core i2c_pii
x4 soundcore pcspkr i2c_core pci_hotplug wmi snd_page_alloc processor button sd_mod r8169 thermal fan thermal_sys [last
unloaded: scsi_wait_scan]
[ 279.683901]
[ 279.683901] Pid: 0, comm: swapper Not tainted 2.6.352.6.35-vanilla-xhci-isoc+ #6 890FXA-GD70 (MS-7640) /MS-7640
[ 279.683901] RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
[ 279.683901] RSP: 0018:ffff880001b43c68 EFLAGS: 00010082
[ 279.683901] RAX: dead000000200200 RBX: 0000000000000804 RCX: ffff880229625818
[ 279.683901] RDX: dead000000100100 RSI: 0000000000000003 RDI: ffff880229625868
[ 279.683901] RBP: ffff880001b43d08 R08: 0000000000000000 R09: 0000000000000804
[ 279.683901] R10: ffff880229597000 R11: 0000000000000000 R12: 0000000000000000
[ 279.683901] R13: ffff88022f158820 R14: ffff880229597000 R15: 0000000000000344
[ 279.683901] FS: 00007fa4bd3706e0(0000) GS:ffff880001b40000(0000) knlGS:0000000000000000
[ 279.683901] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 279.683901] CR2: 00007fa4bd35f000 CR3: 000000022a9ad000 CR4: 00000000000006e0
[ 279.683901] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 279.683901] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 279.683901] Process swapper (pid: 0, threadinfo ffff880237d4a000, task ffff880237d2f7a0)
[ 279.683901] Stack:
[ 279.683901] ffffffff8103d7a3 ffff880001b43cb0 0000000000000082 ffff8802375e2188
[ 279.683901] <0> 0000000000000804 ffff880229625818 ffff880229597a40 ffff880229597a90
[ 279.683901] <0> ffffc90010b72000 0000000000000000 0000002237d20000 ffff880229597000
[ 279.683901] Call Trace:
[ 279.683901] <IRQ>
[ 279.683901] [<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
[ 279.683901] [<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
[ 279.683901] [<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
[ 279.683901] [<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
[ 279.683901] [<ffffffff8136cd15>] ehci_work+0x504/0x8da
[ 279.683901] [<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
[ 279.683901] [<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
[ 279.683901] [<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
[ 279.683901] [<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
[ 279.683901] [<ffffffff8100b241>] handle_irq+0x1f/0x2a
[ 279.683901] [<ffffffff8100a884>] do_IRQ+0x5a/0xc1
[ 279.683901] [<ffffffff8146c953>] ret_from_intr+0x0/0x11
[ 279.683901] <EOI>
[ 279.683901] [<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
[ 279.683901] [<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
[ 279.683901] [<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
[ 279.683901] [<ffffffff81007868>] cpu_idle+0x51/0x84
[ 279.683901] [<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5
[ 279.683901] Code: 83 ef 80 e8 69 39 01 e1 48 8b 4d 88 49 c7 86 18 0b 00 00 00 00 00 00 be 03 00 00 00 48 8b 51 40 48
8b 41 48 48 89 cf 48 83 c7 50 <48> 89 42 08 48 89 10 48 b8 00 01 10 00 00 00 ad de 48 89 41 40
[ 279.683901] RIP [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
[ 279.683901] RSP <ffff880001b43c68>
[ 279.683901] ---[ end trace 0f55a03076b067cf ]---
[ 279.683901] Kernel panic - not syncing: Fatal exception in interrupt
[ 279.683901] Pid: 0, comm: swapper Tainted: G D 2.6.352.6.35-vanilla-xhci-isoc+ #6
[ 279.683901] Call Trace:
[ 279.683901] <IRQ> [<ffffffff81469cf9>] panic+0xb1/0x12a
[ 279.683901] [<ffffffff81043b90>] ? kmsg_dump+0x126/0x140
[ 279.683901] [<ffffffff8100c354>] oops_end+0x89/0x96
[ 279.683901] [<ffffffff8100c534>] die+0x55/0x5e
[ 279.683901] [<ffffffff8100a26f>] do_general_protection+0x130/0x138
[ 279.683901] [<ffffffff8146cc05>] general_protection+0x25/0x30
[ 279.683901] [<ffffffffa004fbc5>] ? em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
[ 279.683901] [<ffffffffa004fba2>] ? em28xx_isoc_copy_vbi+0x60b/0x812 [em28xx]
[ 279.683901] [<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
[ 279.683901] [<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
[ 279.683901] [<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
[ 279.683901] [<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
[ 279.683901] [<ffffffff8136cd15>] ehci_work+0x504/0x8da
[ 279.683901] [<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
[ 279.683901] [<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
[ 279.683901] [<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
[ 279.683901] [<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
[ 279.683901] [<ffffffff8100b241>] handle_irq+0x1f/0x2a
[ 279.683901] [<ffffffff8100a884>] do_IRQ+0x5a/0xc1
[ 279.683901] [<ffffffff8146c953>] ret_from_intr+0x0/0x11
[ 279.683901] <EOI> [<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
[ 279.683901] [<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
[ 279.683901] [<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
[ 279.683901] [<ffffffff81007868>] cpu_idle+0x51/0x84
[ 279.683901] [<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5





--
Sander


Attachments:
dmesg-em28xx (89.00 kB)

2010-08-10 22:45:24

by Devin Heitmueller

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

Hello Sander,

Which application were you using, and specifically which em28xx based
product do you have?

Devin

On Tue, Aug 10, 2010 at 6:12 PM, Sander Eikelenboom
<[email protected]> wrote:
> Hi,
>
> While trying to test try and report about some other bugs, ?i ran into this kernel panic when trying to grab video from my usb 2.0 em28xx videgrabber connected to a usb 2.0 port.
> Complete serial log attachted.
>
>
> [ ?279.680018] general protection fault: 0000 [#1] SMP
> [ ?279.683901] last sysfs file: /sys/devices/pci0000:00/0000:00:12.2/usb1/1-5/i2c-0/name
> [ ?279.683901] CPU 5
> [ ?279.683901] Modules linked in: xt_multiport ipt_REJECT xt_recent xt_limit xt_tcpudp powernow_k8 mperf xt_state ipt_MA
> SQUERADE ipt_LOG iptable_mangle iptable_filter iptable_nat ip_tables nf_nat x_tables nf_conntrack_ipv4 nf_conntrack nf_d
> efrag_ipv4 fuse hwmon_vid loop saa7115 snd_cmipci gameport snd_opl3_lib snd_hwdep snd_mpu401_uart snd_rawmidi em28xx v4l
> 2_common snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_seq_device videodev snd_timer snd v4l1_compat v4l
> 2_compat_ioctl32 videobuf_vmalloc videobuf_core psmouse tpm_tis joydev evdev tveeprom serio_raw shpchp edac_core i2c_pii
> x4 soundcore pcspkr i2c_core pci_hotplug wmi snd_page_alloc processor button sd_mod r8169 thermal fan thermal_sys [last
> unloaded: scsi_wait_scan]
> [ ?279.683901]
> [ ?279.683901] Pid: 0, comm: swapper Not tainted 2.6.352.6.35-vanilla-xhci-isoc+ #6 890FXA-GD70 (MS-7640) ?/MS-7640
> [ ?279.683901] RIP: 0010:[<ffffffffa004fbc5>] ?[<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
> [ ?279.683901] RSP: 0018:ffff880001b43c68 ?EFLAGS: 00010082
> [ ?279.683901] RAX: dead000000200200 RBX: 0000000000000804 RCX: ffff880229625818
> [ ?279.683901] RDX: dead000000100100 RSI: 0000000000000003 RDI: ffff880229625868
> [ ?279.683901] RBP: ffff880001b43d08 R08: 0000000000000000 R09: 0000000000000804
> [ ?279.683901] R10: ffff880229597000 R11: 0000000000000000 R12: 0000000000000000
> [ ?279.683901] R13: ffff88022f158820 R14: ffff880229597000 R15: 0000000000000344
> [ ?279.683901] FS: ?00007fa4bd3706e0(0000) GS:ffff880001b40000(0000) knlGS:0000000000000000
> [ ?279.683901] CS: ?0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ ?279.683901] CR2: 00007fa4bd35f000 CR3: 000000022a9ad000 CR4: 00000000000006e0
> [ ?279.683901] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ ?279.683901] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [ ?279.683901] Process swapper (pid: 0, threadinfo ffff880237d4a000, task ffff880237d2f7a0)
> [ ?279.683901] Stack:
> [ ?279.683901] ?ffffffff8103d7a3 ffff880001b43cb0 0000000000000082 ffff8802375e2188
> [ ?279.683901] <0> 0000000000000804 ffff880229625818 ffff880229597a40 ffff880229597a90
> [ ?279.683901] <0> ffffc90010b72000 0000000000000000 0000002237d20000 ffff880229597000
> [ ?279.683901] Call Trace:
> [ ?279.683901] ?<IRQ>
> [ ?279.683901] ?[<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
> [ ?279.683901] ?[<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
> [ ?279.683901] ?[<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
> [ ?279.683901] ?[<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
> [ ?279.683901] ?[<ffffffff8136cd15>] ehci_work+0x504/0x8da
> [ ?279.683901] ?[<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
> [ ?279.683901] ?[<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
> [ ?279.683901] ?[<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
> [ ?279.683901] ?[<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
> [ ?279.683901] ?[<ffffffff8100b241>] handle_irq+0x1f/0x2a
> [ ?279.683901] ?[<ffffffff8100a884>] do_IRQ+0x5a/0xc1
> [ ?279.683901] ?[<ffffffff8146c953>] ret_from_intr+0x0/0x11
> [ ?279.683901] ?<EOI>
> [ ?279.683901] ?[<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
> [ ?279.683901] ?[<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
> [ ?279.683901] ?[<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
> [ ?279.683901] ?[<ffffffff81007868>] cpu_idle+0x51/0x84
> [ ?279.683901] ?[<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5
> [ ?279.683901] Code: 83 ef 80 e8 69 39 01 e1 48 8b 4d 88 49 c7 86 18 0b 00 00 00 00 00 00 be 03 00 00 00 48 8b 51 40 48
> 8b 41 48 48 89 cf 48 83 c7 50 <48> 89 42 08 48 89 10 48 b8 00 01 10 00 00 00 ad de 48 89 41 40
> [ ?279.683901] RIP ?[<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
> [ ?279.683901] ?RSP <ffff880001b43c68>
> [ ?279.683901] ---[ end trace 0f55a03076b067cf ]---
> [ ?279.683901] Kernel panic - not syncing: Fatal exception in interrupt
> [ ?279.683901] Pid: 0, comm: swapper Tainted: G ? ? ?D ? ? 2.6.352.6.35-vanilla-xhci-isoc+ #6
> [ ?279.683901] Call Trace:
> [ ?279.683901] ?<IRQ> ?[<ffffffff81469cf9>] panic+0xb1/0x12a
> [ ?279.683901] ?[<ffffffff81043b90>] ? kmsg_dump+0x126/0x140
> [ ?279.683901] ?[<ffffffff8100c354>] oops_end+0x89/0x96
> [ ?279.683901] ?[<ffffffff8100c534>] die+0x55/0x5e
> [ ?279.683901] ?[<ffffffff8100a26f>] do_general_protection+0x130/0x138
> [ ?279.683901] ?[<ffffffff8146cc05>] general_protection+0x25/0x30
> [ ?279.683901] ?[<ffffffffa004fbc5>] ? em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
> [ ?279.683901] ?[<ffffffffa004fba2>] ? em28xx_isoc_copy_vbi+0x60b/0x812 [em28xx]
> [ ?279.683901] ?[<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
> [ ?279.683901] ?[<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
> [ ?279.683901] ?[<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
> [ ?279.683901] ?[<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
> [ ?279.683901] ?[<ffffffff8136cd15>] ehci_work+0x504/0x8da
> [ ?279.683901] ?[<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
> [ ?279.683901] ?[<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
> [ ?279.683901] ?[<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
> [ ?279.683901] ?[<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
> [ ?279.683901] ?[<ffffffff8100b241>] handle_irq+0x1f/0x2a
> [ ?279.683901] ?[<ffffffff8100a884>] do_IRQ+0x5a/0xc1
> [ ?279.683901] ?[<ffffffff8146c953>] ret_from_intr+0x0/0x11
> [ ?279.683901] ?<EOI> ?[<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
> [ ?279.683901] ?[<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
> [ ?279.683901] ?[<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
> [ ?279.683901] ?[<ffffffff81007868>] cpu_idle+0x51/0x84
> [ ?279.683901] ?[<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5
>
>
>
>
>
> --
> Sander



--
Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com

2010-08-10 22:57:25

by Sander Eikelenboom

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

Hello Devin,

It's a k-world, which used to work fine (altough with another program, but I can't use that since it seems at least 2 other bugs prevent me from using my VM's :-)
It's this model http://global.kworld-global.com/main/prod_in.aspx?mnuid=1248&modid=6&pcid=47&ifid=17&prodid=104

Tried to grab with ffmpeg.


--
Sander



Wednesday, August 11, 2010, 12:45:20 AM, you wrote:

> Hello Sander,

> Which application were you using, and specifically which em28xx based
> product do you have?

> Devin

> On Tue, Aug 10, 2010 at 6:12 PM, Sander Eikelenboom
> <[email protected]> wrote:
>> Hi,
>>
>> While trying to test try and report about some other bugs, ?i ran into this kernel panic when trying to grab video from my usb 2.0 em28xx videgrabber connected to a usb 2.0 port.
>> Complete serial log attachted.
>>
>>
>> [ ?279.680018] general protection fault: 0000 [#1] SMP
>> [ ?279.683901] last sysfs file: /sys/devices/pci0000:00/0000:00:12.2/usb1/1-5/i2c-0/name
>> [ ?279.683901] CPU 5
>> [ ?279.683901] Modules linked in: xt_multiport ipt_REJECT xt_recent xt_limit xt_tcpudp powernow_k8 mperf xt_state ipt_MA
>> SQUERADE ipt_LOG iptable_mangle iptable_filter iptable_nat ip_tables nf_nat x_tables nf_conntrack_ipv4 nf_conntrack nf_d
>> efrag_ipv4 fuse hwmon_vid loop saa7115 snd_cmipci gameport snd_opl3_lib snd_hwdep snd_mpu401_uart snd_rawmidi em28xx v4l
>> 2_common snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_seq_device videodev snd_timer snd v4l1_compat v4l
>> 2_compat_ioctl32 videobuf_vmalloc videobuf_core psmouse tpm_tis joydev evdev tveeprom serio_raw shpchp edac_core i2c_pii
>> x4 soundcore pcspkr i2c_core pci_hotplug wmi snd_page_alloc processor button sd_mod r8169 thermal fan thermal_sys [last
>> unloaded: scsi_wait_scan]
>> [ ?279.683901]
>> [ ?279.683901] Pid: 0, comm: swapper Not tainted 2.6.352.6.35-vanilla-xhci-isoc+ #6 890FXA-GD70 (MS-7640) ?/MS-7640
>> [ ?279.683901] RIP: 0010:[<ffffffffa004fbc5>] ?[<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
>> [ ?279.683901] RSP: 0018:ffff880001b43c68 ?EFLAGS: 00010082
>> [ ?279.683901] RAX: dead000000200200 RBX: 0000000000000804 RCX: ffff880229625818
>> [ ?279.683901] RDX: dead000000100100 RSI: 0000000000000003 RDI: ffff880229625868
>> [ ?279.683901] RBP: ffff880001b43d08 R08: 0000000000000000 R09: 0000000000000804
>> [ ?279.683901] R10: ffff880229597000 R11: 0000000000000000 R12: 0000000000000000
>> [ ?279.683901] R13: ffff88022f158820 R14: ffff880229597000 R15: 0000000000000344
>> [ ?279.683901] FS: ?00007fa4bd3706e0(0000) GS:ffff880001b40000(0000) knlGS:0000000000000000
>> [ ?279.683901] CS: ?0010 DS: 0000 ES: 0000 CR0: 000000008005003b
>> [ ?279.683901] CR2: 00007fa4bd35f000 CR3: 000000022a9ad000 CR4: 00000000000006e0
>> [ ?279.683901] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> [ ?279.683901] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
>> [ ?279.683901] Process swapper (pid: 0, threadinfo ffff880237d4a000, task ffff880237d2f7a0)
>> [ ?279.683901] Stack:
>> [ ?279.683901] ?ffffffff8103d7a3 ffff880001b43cb0 0000000000000082 ffff8802375e2188
>> [ ?279.683901] <0> 0000000000000804 ffff880229625818 ffff880229597a40 ffff880229597a90
>> [ ?279.683901] <0> ffffc90010b72000 0000000000000000 0000002237d20000 ffff880229597000
>> [ ?279.683901] Call Trace:
>> [ ?279.683901] ?<IRQ>
>> [ ?279.683901] ?[<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
>> [ ?279.683901] ?[<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
>> [ ?279.683901] ?[<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
>> [ ?279.683901] ?[<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
>> [ ?279.683901] ?[<ffffffff8136cd15>] ehci_work+0x504/0x8da
>> [ ?279.683901] ?[<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
>> [ ?279.683901] ?[<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
>> [ ?279.683901] ?[<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
>> [ ?279.683901] ?[<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
>> [ ?279.683901] ?[<ffffffff8100b241>] handle_irq+0x1f/0x2a
>> [ ?279.683901] ?[<ffffffff8100a884>] do_IRQ+0x5a/0xc1
>> [ ?279.683901] ?[<ffffffff8146c953>] ret_from_intr+0x0/0x11
>> [ ?279.683901] ?<EOI>
>> [ ?279.683901] ?[<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
>> [ ?279.683901] ?[<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
>> [ ?279.683901] ?[<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
>> [ ?279.683901] ?[<ffffffff81007868>] cpu_idle+0x51/0x84
>> [ ?279.683901] ?[<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5
>> [ ?279.683901] Code: 83 ef 80 e8 69 39 01 e1 48 8b 4d 88 49 c7 86 18 0b 00 00 00 00 00 00 be 03 00 00 00 48 8b 51 40 48
>> 8b 41 48 48 89 cf 48 83 c7 50 <48> 89 42 08 48 89 10 48 b8 00 01 10 00 00 00 ad de 48 89 41 40
>> [ ?279.683901] RIP ?[<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
>> [ ?279.683901] ?RSP <ffff880001b43c68>
>> [ ?279.683901] ---[ end trace 0f55a03076b067cf ]---
>> [ ?279.683901] Kernel panic - not syncing: Fatal exception in interrupt
>> [ ?279.683901] Pid: 0, comm: swapper Tainted: G ? ? ?D ? ? 2.6.352.6.35-vanilla-xhci-isoc+ #6
>> [ ?279.683901] Call Trace:
>> [ ?279.683901] ?<IRQ> ?[<ffffffff81469cf9>] panic+0xb1/0x12a
>> [ ?279.683901] ?[<ffffffff81043b90>] ? kmsg_dump+0x126/0x140
>> [ ?279.683901] ?[<ffffffff8100c354>] oops_end+0x89/0x96
>> [ ?279.683901] ?[<ffffffff8100c534>] die+0x55/0x5e
>> [ ?279.683901] ?[<ffffffff8100a26f>] do_general_protection+0x130/0x138
>> [ ?279.683901] ?[<ffffffff8146cc05>] general_protection+0x25/0x30
>> [ ?279.683901] ?[<ffffffffa004fbc5>] ? em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
>> [ ?279.683901] ?[<ffffffffa004fba2>] ? em28xx_isoc_copy_vbi+0x60b/0x812 [em28xx]
>> [ ?279.683901] ?[<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
>> [ ?279.683901] ?[<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
>> [ ?279.683901] ?[<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
>> [ ?279.683901] ?[<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
>> [ ?279.683901] ?[<ffffffff8136cd15>] ehci_work+0x504/0x8da
>> [ ?279.683901] ?[<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
>> [ ?279.683901] ?[<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
>> [ ?279.683901] ?[<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
>> [ ?279.683901] ?[<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
>> [ ?279.683901] ?[<ffffffff8100b241>] handle_irq+0x1f/0x2a
>> [ ?279.683901] ?[<ffffffff8100a884>] do_IRQ+0x5a/0xc1
>> [ ?279.683901] ?[<ffffffff8146c953>] ret_from_intr+0x0/0x11
>> [ ?279.683901] ?<EOI> ?[<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
>> [ ?279.683901] ?[<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
>> [ ?279.683901] ?[<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
>> [ ?279.683901] ?[<ffffffff81007868>] cpu_idle+0x51/0x84
>> [ ?279.683901] ?[<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5
>>
>>
>>
>>
>>
>> --
>> Sander






--
Best regards,
Sander mailto:[email protected]

2010-08-11 02:33:30

by Devin Heitmueller

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

On Tue, Aug 10, 2010 at 6:57 PM, Sander Eikelenboom
<[email protected]> wrote:
> Hello Devin,
>
> It's a k-world, which used to work fine (altough with another program, but I can't use that since it seems at least 2 other bugs prevent me from using my VM's :-)
> It's this model ?http://global.kworld-global.com/main/prod_in.aspx?mnuid=1248&modid=6&pcid=47&ifid=17&prodid=104
>
> Tried to grab with ffmpeg.

Is it reproducible? Or did it just happen once? If you have a
sequence to reproduce, can you provide the command line you used, etc?

Devin

--
Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com

2010-08-11 07:28:13

by Sander Eikelenboom

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

Hello Devin,

Yes it's completely reproducible for a change:

ffmpeg -f video4linux -r 25 -s 720x576 -i /dev/video0 out.flv
gave an error:



serveerstertje:/mnt/software/software# ffmpeg -f video4linux -r 25 -s 720x576 -i /dev/video0 out.flv
FFmpeg version r11872+debian_0.svn20080206-18+lenny1, Copyright (c) 2000-2008 Fa brice Bellard, et al.
configuration: --enable-gpl --enable-libfaad --enable-pp --enable-swscaler --e nable-x11grab --prefix=/usr --enable-libgsm --enable-libtheora --enable-libvorbi s --enable-pthreads --disable-strip --enable-libdc1394 --enable-shared --disable -static
libavutil version: 49.6.0
libavcodec version: 51.50.0
libavformat version: 52.7.0
libavdevice version: 52.0.0
built on Jan 25 2010 18:27:39, gcc: 4.3.2
Input #0, video4linux, from '/dev/video0':
Duration: N/A, start: 1281511364.644674, bitrate: 165888 kb/s
Stream #0.0: Video: rawvideo, yuyv422, 720x576 [PAR 0:1 DAR 0:1], 165888 kb/ s, 25.00 tb(r)
File 'out.flv' already exists. Overwrite ? [y/N] y
Output #0, flv, to 'out.flv':
Stream #0.0: Video: flv, yuv420p, 720x576 [PAR 0:1 DAR 0:1], q=2-31, 200 kb/ s, 25.00 tb(c)
Stream mapping:
Stream #0.0 -> #0.0
Press [q] to stop encoding
VIDIOCMCAPTURE: Invalid argument
frame= 1 fps= 0 q=3.0 Lsize= 38kB time=0.0 bitrate=7687.6kbits/s
video:37kB audio:0kB global headers:0kB muxing overhead 0.530927%



So I tried just:

ffmpeg -i /dev/video0 out.flv

That makes it oops allways and instantly.

--

Sander




Wednesday, August 11, 2010, 4:33:28 AM, you wrote:

> On Tue, Aug 10, 2010 at 6:57 PM, Sander Eikelenboom
> <[email protected]> wrote:
>> Hello Devin,
>>
>> It's a k-world, which used to work fine (altough with another program, but I can't use that since it seems at least 2 other bugs prevent me from using my VM's :-)
>> It's this model ?http://global.kworld-global.com/main/prod_in.aspx?mnuid=1248&modid=6&pcid=47&ifid=17&prodid=104
>>
>> Tried to grab with ffmpeg.

> Is it reproducible? Or did it just happen once? If you have a
> sequence to reproduce, can you provide the command line you used, etc?

> Devin




--
Best regards,
Sander mailto:[email protected]

2010-08-11 16:05:25

by Pete Eberlein

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

On Wed, 2010-08-11 at 09:25 +0200, Sander Eikelenboom wrote:
> Hello Devin,
>
> Yes it's completely reproducible for a change:
>
> ffmpeg -f video4linux -r 25 -s 720x576 -i /dev/video0 out.flv
> gave an error:

Use -f video4linux2.

The -f video4linux option uses the old video4linux1 API. I have seen
similar strange behavior when I used that ffmpeg option with a v4l2
driver I am developing. Also, ffmpeg does not use libv4l.


> serveerstertje:/mnt/software/software# ffmpeg -f video4linux -r 25 -s 720x576 -i /dev/video0 out.flv
> FFmpeg version r11872+debian_0.svn20080206-18+lenny1, Copyright (c) 2000-2008 Fa brice Bellard, et al.
> configuration: --enable-gpl --enable-libfaad --enable-pp --enable-swscaler --e nable-x11grab --prefix=/usr --enable-libgsm --enable-libtheora --enable-libvorbi s --enable-pthreads --disable-strip --enable-libdc1394 --enable-shared --disable -static
> libavutil version: 49.6.0
> libavcodec version: 51.50.0
> libavformat version: 52.7.0
> libavdevice version: 52.0.0
> built on Jan 25 2010 18:27:39, gcc: 4.3.2
> Input #0, video4linux, from '/dev/video0':
> Duration: N/A, start: 1281511364.644674, bitrate: 165888 kb/s
> Stream #0.0: Video: rawvideo, yuyv422, 720x576 [PAR 0:1 DAR 0:1], 165888 kb/ s, 25.00 tb(r)
> File 'out.flv' already exists. Overwrite ? [y/N] y
> Output #0, flv, to 'out.flv':
> Stream #0.0: Video: flv, yuv420p, 720x576 [PAR 0:1 DAR 0:1], q=2-31, 200 kb/ s, 25.00 tb(c)
> Stream mapping:
> Stream #0.0 -> #0.0
> Press [q] to stop encoding
> VIDIOCMCAPTURE: Invalid argument
> frame= 1 fps= 0 q=3.0 Lsize= 38kB time=0.0 bitrate=7687.6kbits/s
> video:37kB audio:0kB global headers:0kB muxing overhead 0.530927%
>
>
>
> So I tried just:
>
> ffmpeg -i /dev/video0 out.flv
>
> That makes it oops allways and instantly.
>
> --
>
> Sander
>
>
>
>
> Wednesday, August 11, 2010, 4:33:28 AM, you wrote:
>
> > On Tue, Aug 10, 2010 at 6:57 PM, Sander Eikelenboom
> > <[email protected]> wrote:
> >> Hello Devin,
> >>
> >> It's a k-world, which used to work fine (altough with another program, but I can't use that since it seems at least 2 other bugs prevent me from using my VM's :-)
> >> It's this model http://global.kworld-global.com/main/prod_in.aspx?mnuid=1248&modid=6&pcid=47&ifid=17&prodid=104
> >>
> >> Tried to grab with ffmpeg.
>
> > Is it reproducible? Or did it just happen once? If you have a
> > sequence to reproduce, can you provide the command line you used, etc?
>
> > Devin
>
>
>
>

2010-08-11 16:46:30

by Mauro Carvalho Chehab

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

Em 11-08-2010 12:58, Pete Eberlein escreveu:
> On Wed, 2010-08-11 at 09:25 +0200, Sander Eikelenboom wrote:
>> Hello Devin,
>>
>> Yes it's completely reproducible for a change:
>>
>> ffmpeg -f video4linux -r 25 -s 720x576 -i /dev/video0 out.flv
>> gave an error:
>
> Use -f video4linux2.
>
> The -f video4linux option uses the old video4linux1 API. I have seen
> similar strange behavior when I used that ffmpeg option with a v4l2
> driver I am developing. Also, ffmpeg does not use libv4l.

Still, we have a bug to fix. The driver shouldn't generating a PANIC if accessed
via V4L1 API.

Cheers,
Mauro.

2010-08-11 18:31:59

by Devin Heitmueller

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

On Wed, Aug 11, 2010 at 12:46 PM, Mauro Carvalho Chehab
<[email protected]> wrote:
> Em 11-08-2010 12:58, Pete Eberlein escreveu:
>> On Wed, 2010-08-11 at 09:25 +0200, Sander Eikelenboom wrote:
>>> Hello Devin,
>>>
>>> Yes it's completely reproducible for a change:
>>>
>>> ffmpeg -f video4linux -r 25 -s 720x576 -i /dev/video0 out.flv
>>> gave an error:
>>
>> Use -f video4linux2.
>>
>> The -f video4linux option uses the old video4linux1 API. ?I have seen
>> similar strange behavior when I used that ffmpeg option with a v4l2
>> driver I am developing. ?Also, ffmpeg does not use libv4l.
>
> Still, we have a bug to fix. The driver shouldn't generating a PANIC if accessed
> via V4L1 API.

I agree with Mauro completely. There is nothing userland should be
able to do which results in a panic (and I have no reason to believe
Pete was suggesting otherwise). That said, it's really useful to know
that this is some sort of v4l1 backward compatibility problem.

I'll see if I can reproduce this here.

Thanks,

Devin

--
Devin J. Heitmueller - Kernel Labs
http://www.kernellabs.com

2010-08-11 20:56:16

by Sander Eikelenboom

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

Hello Devin,

Yes i can confirm it was my mistake, with video4linux2 it works.

--
Sander

Wednesday, August 11, 2010, 8:31:56 PM, you wrote:

> On Wed, Aug 11, 2010 at 12:46 PM, Mauro Carvalho Chehab
> <[email protected]> wrote:
>> Em 11-08-2010 12:58, Pete Eberlein escreveu:
>>> On Wed, 2010-08-11 at 09:25 +0200, Sander Eikelenboom wrote:
>>>> Hello Devin,
>>>>
>>>> Yes it's completely reproducible for a change:
>>>>
>>>> ffmpeg -f video4linux -r 25 -s 720x576 -i /dev/video0 out.flv
>>>> gave an error:
>>>
>>> Use -f video4linux2.
>>>
>>> The -f video4linux option uses the old video4linux1 API. ?I have seen
>>> similar strange behavior when I used that ffmpeg option with a v4l2
>>> driver I am developing. ?Also, ffmpeg does not use libv4l.
>>
>> Still, we have a bug to fix. The driver shouldn't generating a PANIC if accessed
>> via V4L1 API.

> I agree with Mauro completely. There is nothing userland should be
> able to do which results in a panic (and I have no reason to believe
> Pete was suggesting otherwise). That said, it's really useful to know
> that this is some sort of v4l1 backward compatibility problem.

> I'll see if I can reproduce this here.

> Thanks,

> Devin




--
Best regards,
Sander mailto:[email protected]

2010-08-11 23:04:00

by Andy Walls

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

On Wed, 2010-08-11 at 00:12 +0200, Sander Eikelenboom wrote:
> Hi,
>
> While trying to test try and report about some other bugs, i ran into this kernel panic when trying to grab video from my usb 2.0 em28xx videgrabber connected to a usb 2.0 port.
> Complete serial log attachted.
>
>
> [ 279.680018] general protection fault: 0000 [#1] SMP
> [ 279.683901] last sysfs file: /sys/devices/pci0000:00/0000:00:12.2/usb1/1-5/i2c-0/name
> [ 279.683901] CPU 5
> [ 279.683901] Modules linked in: xt_multiport ipt_REJECT xt_recent xt_limit xt_tcpudp powernow_k8 mperf xt_state ipt_MA
> SQUERADE ipt_LOG iptable_mangle iptable_filter iptable_nat ip_tables nf_nat x_tables nf_conntrack_ipv4 nf_conntrack nf_d
> efrag_ipv4 fuse hwmon_vid loop saa7115 snd_cmipci gameport snd_opl3_lib snd_hwdep snd_mpu401_uart snd_rawmidi em28xx v4l
> 2_common snd_hda_codec_atihdmi snd_hda_intel snd_hda_codec snd_pcm snd_seq_device videodev snd_timer snd v4l1_compat v4l
> 2_compat_ioctl32 videobuf_vmalloc videobuf_core psmouse tpm_tis joydev evdev tveeprom serio_raw shpchp edac_core i2c_pii
> x4 soundcore pcspkr i2c_core pci_hotplug wmi snd_page_alloc processor button sd_mod r8169 thermal fan thermal_sys [last
> unloaded: scsi_wait_scan]
> [ 279.683901]
> [ 279.683901] Pid: 0, comm: swapper Not tainted 2.6.352.6.35-vanilla-xhci-isoc+ #6 890FXA-GD70 (MS-7640) /MS-7640
> [ 279.683901] RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
> [ 279.683901] RSP: 0018:ffff880001b43c68 EFLAGS: 00010082
> [ 279.683901] RAX: dead000000200200 RBX: 0000000000000804 RCX: ffff880229625818
> [ 279.683901] RDX: dead000000100100 RSI: 0000000000000003 RDI: ffff880229625868
^^^^^^^^^^^^^^^^

List poison.

arch/x86/Kconfig:
config ILLEGAL_POINTER_VALUE
hex
default 0 if X86_32
default 0xdead000000000000 if X86_64

include/linux/poison.h:
#ifdef CONFIG_ILLEGAL_POINTER_VALUE
# define POISON_POINTER_DELTA _AC(CONFIG_ILLEGAL_POINTER_VALUE, UL)
#else
# define POISON_POINTER_DELTA 0
#endif

/*
* These are non-NULL pointers that will result in page faults
* under normal circumstances, used to verify that nobody uses
* non-initialized list entries.
*/
#define LIST_POISON1 ((void *) 0x00100100 + POISON_POINTER_DELTA)
#define LIST_POISON2 ((void *) 0x00200200 + POISON_POINTER_DELTA)

So at least one uninitialized list entry was accessed.

> [ 279.683901] RBP: ffff880001b43d08 R08: 0000000000000000 R09: 0000000000000804
> [ 279.683901] R10: ffff880229597000 R11: 0000000000000000 R12: 0000000000000000
> [ 279.683901] R13: ffff88022f158820 R14: ffff880229597000 R15: 0000000000000344
> [ 279.683901] FS: 00007fa4bd3706e0(0000) GS:ffff880001b40000(0000) knlGS:0000000000000000
> [ 279.683901] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 279.683901] CR2: 00007fa4bd35f000 CR3: 000000022a9ad000 CR4: 00000000000006e0
> [ 279.683901] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 279.683901] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [ 279.683901] Process swapper (pid: 0, threadinfo ffff880237d4a000, task ffff880237d2f7a0)
> [ 279.683901] Stack:
> [ 279.683901] ffffffff8103d7a3 ffff880001b43cb0 0000000000000082 ffff8802375e2188
> [ 279.683901] <0> 0000000000000804 ffff880229625818 ffff880229597a40 ffff880229597a90
> [ 279.683901] <0> ffffc90010b72000 0000000000000000 0000002237d20000 ffff880229597000
> [ 279.683901] Call Trace:
> [ 279.683901] <IRQ>
> [ 279.683901] [<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
> [ 279.683901] [<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
> [ 279.683901] [<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
> [ 279.683901] [<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
> [ 279.683901] [<ffffffff8136cd15>] ehci_work+0x504/0x8da
> [ 279.683901] [<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
> [ 279.683901] [<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
> [ 279.683901] [<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
> [ 279.683901] [<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
> [ 279.683901] [<ffffffff8100b241>] handle_irq+0x1f/0x2a
> [ 279.683901] [<ffffffff8100a884>] do_IRQ+0x5a/0xc1
> [ 279.683901] [<ffffffff8146c953>] ret_from_intr+0x0/0x11
> [ 279.683901] <EOI>
> [ 279.683901] [<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
> [ 279.683901] [<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
> [ 279.683901] [<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
> [ 279.683901] [<ffffffff81007868>] cpu_idle+0x51/0x84
> [ 279.683901] [<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5
> [ 279.683901] Code: 83 ef 80 e8 69 39 01 e1 48 8b 4d 88 49 c7 86 18 0b 00 00 00 00 00 00 be 03 00 00 00 48 8b 51 40 48
> 8b 41 48 48 89 cf 48 83 c7 50 <48> 89 42 08 48 89 10 48 b8 00 01 10 00 00 00 ad de 48 89 41 40
> [ 279.683901] RIP [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

603: 83 ef 80 sub $0xffffffffffffff80,%edi <--- &buf->vb.ts
606: e8 69 39 01 e1 callq 0xffffffffe1013f74 <--- do_gettimeofday()
60b: 48 8b 4d 88 mov -0x78(%rbp),%rcx <--- ?
60f: 49 c7 86 18 0b 00 00 movq $0x0,0xb18(%r14) <--- dev->isoc_ctl.vbi_buf = NULL ?
616: 00 00 00 00
61a: be 03 00 00 00 mov $0x3,%esi <--- move TASK_NORMAL into a register for the wake_up() macro
61f: 48 8b 51 40 mov 0x40(%rcx),%rdx <--- Fetch the list pointers ?
623: 48 8b 41 48 mov 0x48(%rcx),%rax <--- Fetch the list pointers ?
627: 48 89 cf mov %rcx,%rdi <--- ?
62a: 48 83 c7 50 add $0x50,%rdi <--- ?
62e: 48 89 42 08 mov %rax,0x8(%rdx) <----Ooops is here, dereferencing the poisoned list ptrs
632: 48 89 10 mov %rdx,(%rax) (These lines & a few preceeding look like list_del() inlined)
635: 48 b8 00 01 10 00 00 mov $0xdead000000100100,%rax <--- Inlined list code, setting LIST_POISON1.
63c: 00 ad de
63f: 48 89 41 40 mov %rax,0x40(%rcx)

It's hard to tell if the Ooops is happening in
em28xx-video.c:buffer_filled() or em28xx-video.c:vbi_buffer_filled() but
I'm pretty sure it's one of them. em28xx_isoc_copy_vbi() is a long
function and the *buffer_filled() functions are inlined (what's up with
that?). I'd need an objdump disassembly of your actual em28xx-video.o
binary to figure out which one conclusively.

But that's probably not needed. There's an obvious uninitialized list
object being used in the em28xx driver with its interaction with
videobuf. I'll bail out at this point and let someone else, who knows
more than I about both of those, audit the code. :P


Regards,
Andy

> [ 279.683901] RSP <ffff880001b43c68>
> [ 279.683901] ---[ end trace 0f55a03076b067cf ]---
> [ 279.683901] Kernel panic - not syncing: Fatal exception in interrupt
> [ 279.683901] Pid: 0, comm: swapper Tainted: G D 2.6.352.6.35-vanilla-xhci-isoc+ #6
> [ 279.683901] Call Trace:
> [ 279.683901] <IRQ> [<ffffffff81469cf9>] panic+0xb1/0x12a
> [ 279.683901] [<ffffffff81043b90>] ? kmsg_dump+0x126/0x140
> [ 279.683901] [<ffffffff8100c354>] oops_end+0x89/0x96
> [ 279.683901] [<ffffffff8100c534>] die+0x55/0x5e
> [ 279.683901] [<ffffffff8100a26f>] do_general_protection+0x130/0x138
> [ 279.683901] [<ffffffff8146cc05>] general_protection+0x25/0x30
> [ 279.683901] [<ffffffffa004fbc5>] ? em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]
> [ 279.683901] [<ffffffffa004fba2>] ? em28xx_isoc_copy_vbi+0x60b/0x812 [em28xx]
> [ 279.683901] [<ffffffff8103d7a3>] ? enqueue_task+0x77/0x87
> [ 279.683901] [<ffffffffa0053398>] em28xx_irq_callback+0x7e/0xfe [em28xx]
> [ 279.683901] [<ffffffff81359415>] usb_hcd_giveback_urb+0x84/0xb8
> [ 279.683901] [<ffffffff8136b51b>] ehci_urb_done+0xcf/0xe4
> [ 279.683901] [<ffffffff8136cd15>] ehci_work+0x504/0x8da
> [ 279.683901] [<ffffffff81370fda>] ehci_irq+0x19c/0x1ce
> [ 279.683901] [<ffffffff81358bd1>] usb_hcd_irq+0x3e/0x83
> [ 279.683901] [<ffffffff8108782c>] handle_IRQ_event+0x58/0x136
> [ 279.683901] [<ffffffff81089414>] handle_fasteoi_irq+0x92/0xd2
> [ 279.683901] [<ffffffff8100b241>] handle_irq+0x1f/0x2a
> [ 279.683901] [<ffffffff8100a884>] do_IRQ+0x5a/0xc1
> [ 279.683901] [<ffffffff8146c953>] ret_from_intr+0x0/0x11
> [ 279.683901] <EOI> [<ffffffffa0044740>] ? acpi_idle_enter_simple+0x130/0x168 [processor]
> [ 279.683901] [<ffffffffa004473c>] ? acpi_idle_enter_simple+0x12c/0x168 [processor]
> [ 279.683901] [<ffffffff813ad822>] cpuidle_idle_call+0x9b/0xfd
> [ 279.683901] [<ffffffff81007868>] cpu_idle+0x51/0x84
> [ 279.683901] [<ffffffff81466d1b>] start_secondary+0x1c0/0x1c5
>
>
>
>
>
> --
> Sander

2010-08-17 18:11:27

by Maciej Rutecki

[permalink] [raw]
Subject: Re: [2.6.35] usb 2.0 em28xx kernel panic general protection fault: 0000 [#1] SMP RIP: 0010:[<ffffffffa004fbc5>] [<ffffffffa004fbc5>] em28xx_isoc_copy_vbi+0x62e/0x812 [em28xx]

https://bugzilla.kernel.org/show_bug.cgi?id=16614On środa, 11 sierpnia 2010 o
00:12:57 Sander Eikelenboom wrote:
> Hi,
>
> While trying to test try and report about some other bugs, i ran into this
> kernel panic when trying to grab video from my usb 2.0 em28xx videgrabber
> connected to a usb 2.0 port. Complete serial log attachted.
>

I created a Bugzilla entry at
https://bugzilla.kernel.org/show_bug.cgi?id=16614
for your bug report, please add your address to the CC list in there, thanks!

--
Maciej Rutecki
http://www.maciek.unixy.pl