Re: BUG: unable to handle kernel paging request at 6b6b6bcb (v4l2_device_disconnect+0x11/0x30)

[Dave Young]

On Fri, Sep 2, 2011 at 3:10 AM, Sitsofe Wheeler <sitsofe@xxxxxxxxx> wrote:
> On Thu, Sep 01, 2011 at 05:02:51PM +0800, Dave Young wrote:
>> On Tue, Aug 30, 2011 at 4:48 AM, Sitsofe Wheeler <sitsofe@xxxxxxxxx> wrote:
>> >
>> > I managed to produce an oops in 3.1.0-rc3-00270-g7a54f5e by unplugging a
>> > USB webcam. See below:
>>
>> Could you try the attached patch?
>
> This patch fixed the oops but extending the sequence (enable camera,
> start cheese, disable camera, watch cheese pause, enable camera, quit
> cheese, start cheese) causes the following "poison overwritten" warning
> to appear:

It seems another bug, I can reproduce this as well.

uvc_device is freed in uvc_delete,

struct v4l2_device vdev is the member of struct uvc_device, so vdev is
also freed. Later v4l2_device operations on vdev will overwrite the
poison memory area.

>
>
> [ Â191.240695] uvcvideo: Found UVC 1.00 device CNF7129 (04f2:b071)
> [ Â191.277965] input: CNF7129 as /devices/pci0000:00/0000:00:1d.7/usb1/1-8/1-8:1.0/input/input9
> [ Â220.287366] =============================================================================
> [ Â220.287379] BUG kmalloc-512: Poison overwritten
> [ Â220.287384] -----------------------------------------------------------------------------
> [ Â220.287387]
> [ Â220.287394] INFO: 0xec90f150-0xec90f150. First byte 0x6a instead of 0x6b
> [ Â220.287410] INFO: Allocated in uvc_probe+0x54/0xd50 age=210617 cpu=0 pid=16
> [ Â220.287421] ÂT.974+0x29d/0x5e0
> [ Â220.287427] Âkmem_cache_alloc+0x167/0x180
> [ Â220.287433] Âuvc_probe+0x54/0xd50
> [ Â220.287441] Âusb_probe_interface+0xd5/0x1d0
> [ Â220.287448] Âdriver_probe_device+0x80/0x1a0
> [ Â220.287455] Â__device_attach+0x41/0x50
> [ Â220.287460] Âbus_for_each_drv+0x53/0x80
> [ Â220.287466] Âdevice_attach+0x89/0xa0
> [ Â220.287472] Âbus_probe_device+0x25/0x40
> [ Â220.287478] Âdevice_add+0x5a9/0x660
> [ Â220.287484] Âusb_set_configuration+0x562/0x670
> [ Â220.287491] Âgeneric_probe+0x36/0x90
> [ Â220.287497] Âusb_probe_device+0x24/0x50
> [ Â220.287503] Âdriver_probe_device+0x80/0x1a0
> [ Â220.287509] Â__device_attach+0x41/0x50
> [ Â220.287515] Âbus_for_each_drv+0x53/0x80
> [ Â220.287522] INFO: Freed in uvc_delete+0xfe/0x110 age=22 cpu=0 pid=1645
> [ Â220.287530] Â__slab_free+0x1f8/0x300
> [ Â220.287536] Âkfree+0x100/0x140
> [ Â220.287541] Âuvc_delete+0xfe/0x110
> [ Â220.287547] Âuvc_release+0x25/0x30
> [ Â220.287555] Âv4l2_device_release+0x9d/0xc0
> [ Â220.287560] Âdevice_release+0x19/0x90
> [ Â220.287567] Âkobject_release+0x3c/0x90
> [ Â220.287573] Âkref_put+0x2c/0x60
> [ Â220.287578] Âkobject_put+0x1d/0x50
> [ Â220.287587] Âput_device+0xf/0x20
> [ Â220.287593] Âv4l2_release+0x56/0x60
> [ Â220.287599] Âfput+0xcc/0x220
> [ Â220.287605] Âfilp_close+0x44/0x70
> [ Â220.287613] Âput_files_struct+0x158/0x180
> [ Â220.287619] Âexit_files+0x40/0x50
> [ Â220.287626] Âdo_exit+0xec/0x660
> [ Â220.287632] INFO: Slab 0xef722180 objects=23 used=23 fp=0x Â(null) flags=0x4080
> [ Â220.287639] INFO: Object 0xec90f060 @offset=12384 fp=0xec90cac0
> [ Â220.287642]
> [ Â220.287647] Bytes b4 0xec90f050: Â6d 06 00 00 88 c8 fe ff 5a 5a 5a 5a 5a 5a 5a 5a m....ÃÃÃZZZZZZZZ
> [ Â220.287681] Â Object 0xec90f060: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287713] Â Object 0xec90f070: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287746] Â Object 0xec90f080: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287778] Â Object 0xec90f090: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287811] Â Object 0xec90f0a0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287843] Â Object 0xec90f0b0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287876] Â Object 0xec90f0c0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287908] Â Object 0xec90f0d0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287941] Â Object 0xec90f0e0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.287973] Â Object 0xec90f0f0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288006] Â Object 0xec90f100: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f110: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f120: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f130: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f140: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f150: Â6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b jkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f160: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f170: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f180: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f190: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f1a0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f1b0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f1c0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f1d0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f1e0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f1f0: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f200: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f210: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f220: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f230: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f240: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
> [ Â220.288012] Â Object 0xec90f250: Â6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkkkkkkkkkkÂ
> [ Â220.288012] ÂRedzone 0xec90f260: Âbb bb bb bb                   ÂÂÂÂ
> [ Â220.288012] ÂPadding 0xec90f308: Â5a 5a 5a 5a 5a 5a 5a 5a             ZZZZZZZZ
> [ Â220.288012] Pid: 1450, comm: metacity Not tainted 3.1.0-rc4-00131-g9e79e3e-dirty #488
> [ Â220.288012] Call Trace:
> [ Â220.288012] Â[<b0192c3e>] print_trailer+0xee/0x140
> [ Â220.288012] Â[<b0193157>] check_bytes_and_report+0xd7/0x160
> [ Â220.288012] Â[<b0194a98>] check_object+0x1d8/0x220
> [ Â220.288012] Â[<b0192fe3>] ? check_slab+0x63/0x100
> [ Â220.288012] Â[<b0194f67>] alloc_debug_processing+0xb7/0x130
> [ Â220.288012] Â[<b019602d>] T.974+0x29d/0x5e0
> [ Â220.288012] Â[<b044c466>] ? sock_alloc_send_pskb+0x176/0x290
> [ Â220.288012] Â[<b044c466>] ? sock_alloc_send_pskb+0x176/0x290
> [ Â220.288012] Â[<b0198551>] ? create_object+0x191/0x240
> [ Â220.288012] Â[<b01979f5>] __kmalloc_track_caller+0x1d5/0x1f0
> [ Â220.288012] Â[<b044c466>] ? sock_alloc_send_pskb+0x176/0x290
> [ Â220.288012] Â[<b044ff2d>] __alloc_skb+0x4d/0x140
> [ Â220.288012] Â[<b044c466>] sock_alloc_send_pskb+0x176/0x290
> [ Â220.288012] Â[<b055d98a>] ? __mutex_unlock_slowpath+0x9a/0x110
> [ Â220.288012] Â[<b044c598>] sock_alloc_send_skb+0x18/0x20
> [ Â220.288012] Â[<b04b7957>] unix_stream_sendmsg+0x2b7/0x3d0
> [ Â220.288012] Â[<b0448913>] sock_aio_write+0x133/0x170
> [ Â220.288012] Â[<b019b285>] do_sync_readv_writev+0x95/0xc0
> [ Â220.288012] Â[<b0274328>] ? _copy_from_user+0x38/0x180
> [ Â220.288012] Â[<b019b133>] ? rw_copy_check_uvector+0x73/0xf0
> [ Â220.288012] Â[<b019bf1b>] do_readv_writev+0x9b/0x180
> [ Â220.288012] Â[<b04487e0>] ? sock_destroy_inode+0x30/0x30
> [ Â220.288012] Â[<b019c562>] ? fget_light+0xb2/0x130
> [ Â220.288012] Â[<b019c576>] ? fget_light+0xc6/0x130
> [ Â220.288012] Â[<b019c045>] vfs_writev+0x45/0x60
> [ Â220.288012] Â[<b019c131>] sys_writev+0x41/0x80
> [ Â220.288012] Â[<b055ff57>] sysenter_do_call+0x12/0x36
> [ Â220.288012] Â[<b0550000>] ? rfkill_alloc+0xe0/0x110
> [ Â220.288012] FIX kmalloc-512: Restoring 0xec90f150-0xec90f150=0x6b
> [ Â220.288012]
> [ Â220.288012] FIX kmalloc-512: Marking all objects used
>
> --
> Sitsofe | http://sucs.org/~sits/
>



-- 
Regards
Yang RuiRui
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/