Bug 591200

Summary: [RHEL6] snd-hda-intel crashing on sonata-02.lab.bos.redhat.com with CONFIG_SND_DEBUG enabled
Product: Red Hat Enterprise Linux 6 Reporter: Aristeu Rozanski <arozansk>
Component: kernelAssignee: Jaroslav Kysela <jkysela>
Status: CLOSED DUPLICATE QA Contact: Red Hat Kernel QE team <kernel-qe>
Severity: medium Docs Contact:
Priority: low    
Version: 6.0CC: jfeeney, jkysela
Target Milestone: rc   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2010-06-23 11:39:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 591083    
Bug Blocks:    
Attachments:
Description Flags
/proc/asound/ of sonata-02.lab.bos.redhat.com none

Description Aristeu Rozanski 2010-05-11 16:18:56 UTC
Created attachment 413186 [details]
/proc/asound/ of sonata-02.lab.bos.redhat.com

Description of problem:
while testing kernel-debug-2.6.32-25.el6 on sonata-02.lab.bos.redhat.com:

BUG: unable to handle kernel NULL pointer dereference at 00000037
IP: [<c05fa5cd>] strlen+0xd/0x20
*pdpt = 000000002f2b0001 *pde = 000000022de80067 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/module/snd_hda_intel/initstate
Modules linked in: snd_hda_codec_realtek(U) snd_hda_intel(+)(U) snd_hda_codec(U) snd_hwdep(U) snd_seq(U) snd_seq_device(U) snd_pcm(U) ppdev(U) parport_pc(U) parport(U) snd_timer(U) snd(U) soundcore(U) sr_mod(U) snd_page_alloc(U) i2c_piix4(U) r8169(U) cdrom(U) e1000(U) mii(U) serio_raw(U) sg(U) ext4(U) mbcache(U) jbd2(U) sd_mod(U) crc_t10dif(U) pata_acpi(U) ata_generic(U) firewire_ohci(U) firewire_core(U) crc_itu_t(U) pata_atiixp(U) ahci(U) radeon(U) ttm(U) drm_kms_helper(U) drm(U) i2c_algo_bit(U) i2c_core(U) dm_mod(U) [last unloaded: scsi_wait_scan]

Pid: 711, comm: modprobe Not tainted (2.6.32-25.el6.i686.debug #1) GA-MA78GM-S2H
EIP: 0060:[<c05fa5cd>] EFLAGS: 00010246 CPU: 2
EIP is at strlen+0xd/0x20
EAX: 00000000 EBX: 00000037 ECX: ffffffff EDX: 00000000
ESI: ee98bd30 EDI: 00000037 EBP: ee98bd14 ESP: ee98bd10
 DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
Process modprobe (pid: 711, ti=ee98a000 task=ee988960 task.ti=ee98a000)
Stack:
 ee98bd70 ee98bd80 f93da9ee f93d972f c0488a16 f1c04250 ef0b6cb0 f19a3360
<0> 00000000 00000002 00000000 00000000 00000000 00000000 00000000 00000000
<0> 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
Call Trace:
 [<f93da9ee>] ? _snd_hda_find_mixer_ctl+0x3e/0xb0 [snd_hda_codec]
 [<f93d972f>] ? snd_array_new+0x6f/0xf0 [snd_hda_codec]
 [<c0488a16>] ? debug_check_no_locks_freed+0xb6/0x140
 [<f93daa6a>] ? snd_hda_find_mixer_ctl+0xa/0x10 [snd_hda_codec]
 [<f948fa33>] ? alc_build_controls+0x2a3/0x470 [snd_hda_codec_realtek]
 [<f93dca9d>] ? snd_hda_codec_build_controls+0x3d/0x50 [snd_hda_codec]
 [<f93dcad7>] ? snd_hda_build_controls+0x27/0x80 [snd_hda_codec]
 [<f94210af>] ? azx_probe+0xa94/0xb40 [snd_hda_intel]
 [<f94200e0>] ? azx_send_cmd+0x0/0x280 [snd_hda_intel]
 [<f941fea0>] ? azx_get_response+0x0/0x240 [snd_hda_intel]
 [<f9420390>] ? azx_attach_pcm_stream+0x0/0x230 [snd_hda_intel]
 [<f941f0b0>] ? azx_bus_reset+0x0/0x70 [snd_hda_intel]
 [<f941eee0>] ? azx_power_notify+0x0/0x90 [snd_hda_intel]
 [<c060e41e>] ? local_pci_probe+0xe/0x10
 [<c060f230>] ? pci_device_probe+0x60/0x80
 [<c06bb7f7>] ? driver_probe_device+0x87/0x290
 [<c06bba79>] ? __driver_attach+0x79/0x80
 [<c06babc8>] ? bus_for_each_dev+0x48/0x70
 [<c06bb5e9>] ? driver_attach+0x19/0x20
 [<c06bba00>] ? __driver_attach+0x0/0x80
 [<c06baf6f>] ? bus_add_driver+0x1cf/0x320
 [<c060f170>] ? pci_device_remove+0x0/0x40
 [<c06bbd05>] ? driver_register+0x65/0x120
 [<c05fee62>] ? __spin_lock_init+0x32/0x60
 [<c060f464>] ? __pci_register_driver+0x54/0xc0
 [<f9426017>] ? alsa_card_azx_init+0x17/0x19 [snd_hda_intel]
 [<c040303d>] ? do_one_initcall+0x2d/0x1d0
 [<f9426000>] ? alsa_card_azx_init+0x0/0x19 [snd_hda_intel]
 [<c0497d43>] ? sys_init_module+0xb3/0x220
 [<c048890c>] ? trace_hardirqs_on_caller+0x12c/0x170
 [<c0409bab>] ? sysenter_do_call+0x12/0x38
Code: e5 56 89 c6 89 d0 88 c4 ac 38 e0 74 09 84 c0 75 f7 be 01 00 00 00 89 f0 48 5e 5d c3 66 90 55 b9 ff ff ff ff 89 e5 57 89 c7 31 c0 <f2> ae f7 d1 49 89 c8 5f 5d c3 89 f6 8d bc 27 00 00 00 00 55 89 
EIP: [<c05fa5cd>] strlen+0xd/0x20 SS:ESP 0068:ee98bd10
CR2: 0000000000000037
---[ end trace a0d72e4b3e333afd ]---
Kernel panic - not syncing: Fatal exception

Attached /proc/asound/ taken while using the regular kernel (without
CONFIG_SND_DEBUG)

Comment 2 RHEL Program Management 2010-05-11 17:57:39 UTC
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.

Comment 3 John Feeney 2010-05-12 22:23:23 UTC
Appears to have the same stack trace as bz577952.

Comment 4 Jaroslav Kysela 2010-05-14 06:32:42 UTC
I tried to boot kernel-debug rpm with patch from bug#591083 on sonata-02 and it does not oops. Marking in depends on and taking this bug.

Also, it seems that 'hda-intel: azx_get_response timeout, switching to polling mode: last cmd=0x000f0000' message goes away with update from bug#591083.

Comment 6 Jaroslav Kysela 2010-06-23 11:39:27 UTC
Marking as duplicate of bug#591083. Please, reopen, if this issue can be reproduced with the latest RHEL 6.0 kernel.

*** This bug has been marked as a duplicate of bug 591083 ***