| Summary: | [abrt] kernel: BUG: unable to handle kernel NULL pointer dereference at 00000068: TAINTED G I | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Michal Ambroz <rebus> |
| Component: | kernel | Assignee: | Mauro Carvalho Chehab <mchehab> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 16 | CC: | gansalmon, itamar, jonathan, kernel-maint, lemenkov, lwang, madhu.chinakonda |
| Target Milestone: | --- | Keywords: | Reopened |
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Unspecified | ||
| Whiteboard: | abrt_hash:002fb226508d43f8fda343bea758a4e2857de6c0 | ||
| Fixed In Version: | kernel-3.1.0-1.fc16 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2011-10-25 03:21:58 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Michal Ambroz
2011-10-16 23:25:16 UTC
BTW with clean reboot the camera works when it is connected for the first time. The opps happens when it is disconnected. drivers/media/video/v4l2-dev.c:184:
if (v4l2_dev->release == NULL)
v4l2_dev = NULL;
v4l2_dev is already NULL here, so we get a null dereference trying to test ->release
Caused by commit 8280b662df96f4172c4972b14a4aec0daf272b8f "[media] v4l: Fix use-after-free case in v4l2_device_release", which was added in 3.1-rc9
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff_plain;h=e58fced201ad6e6cb673f07499919c3b20792d94 fixed in 3.1.0-0.rc10.git0.1.fc16.i686.PAE Thank you. I am sorry ... I was too fast with retesting. Unfortunately the issue persists in 3.1.0-0.rc10.git0.1.fc16.i686.PAE BUG: unable to handle kernel NULL pointer dereference at 00000068 IP: [<faf69a05>] v4l2_device_release+0x9b/0xbf [videodev] *pdpt = 0000000036805001 *pde = 000000007190d067 Oops: 0000 [#1] SMP Modules linked in: snd_usb_audio snd_usbmidi_lib snd_rawmidi gspca_sonixj gspca_main videodev media vfat fat usb_storage uas ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat xt_CHECKSUM iptable_mangle tun bridge stp llc lockd rfcomm bnep ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_netbios_ns nf_conntrack_broadcast ip6table_filter nf_conntrack_ipv4 nf_defrag_ipv4 ip6_tables xt_state nf_conntrack fuse virtio_net kvm snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm arc4 iwlagn sunrpc mac80211 snd_timer snd cfg80211 soundcore btusb bluetooth iTCO_wdt ppdev hp_wmi sparse_keymap binfmt_misc uinput snd_page_alloc microcode iTCO_vendor_support rfkill parport_pc parport tpm_infineon hp_accel lis3lv02d input_polldev serio_raw e1000e joydev xts gf128mul pata_pcmcia dm_crypt sdhci_pci sdhci mmc_core firewire_ohci yenta_socket firewire_core crc_itu_t wmi pata_acpi ata_generic i915 drm_kms_helper drm i2c_algo_bit i2c_cor e video [last unloaded: scsi_wait_scan] Pid: 22, comm: khubd Not tainted 3.1.0-0.rc10.git0.1.fc16.i686.PAE #1 Hewlett-Packard HP EliteBook 6930p/30DB EIP: 0060:[<faf69a05>] EFLAGS: 00010246 CPU: 0 EIP is at v4l2_device_release+0x9b/0xbf [videodev] EAX: 00000000 EBX: edab5054 ECX: 0040003a EDX: 00000000 ESI: 00000000 EDI: edab5000 EBP: f467bd48 ESP: f467bd3c DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068 Process khubd (pid: 22, ti=f467a000 task=f453b240 task.ti=f467a000) Stack: f0466c00 edab505c c0ab0db0 f467bd64 c067e4b3 c05d117e f467bd7c c0541a1e f467bd98 edab5078 f467bd98 c05d1149 f00c7680 f0405ed0 f2d8155c c05d1028 f0a8621c f467bd90 ec8696c0 f2d81540 edab5078 c05d1028 f0a8621c f467bda8 Call Trace: [<c067e4b3>] device_release+0x3f/0x77 [<c05d117e>] ? kobject_release+0x156/0x15e [<c0541a1e>] ? sysfs_addrm_finish+0x87/0x99 [<c05d1149>] kobject_release+0x121/0x15e [<c05d1028>] ? kobject_del+0x2c/0x2c [<c05d1028>] ? kobject_del+0x2c/0x2c [<c05d22a7>] kref_put+0x39/0x42 [<c05d0faa>] kobject_put+0x46/0x4c [<c067e2fd>] ? put_device+0x14/0x16 [<c067e9d8>] ? device_del+0x131/0x136 [<c067e2fd>] put_device+0x14/0x16 [<c067ea2f>] device_unregister+0x52/0x57 [<c082541f>] ? _cond_resched+0xd/0x21 [<c0825cd4>] ? mutex_lock+0x11/0x2a [<faf69aed>] video_unregister_device+0x3d/0x40 [videodev] [<fafd6e39>] gspca_disconnect+0x90/0x96 [gspca_main] [<c06d5d9f>] usb_unbind_interface+0x44/0xf8 [<c0681144>] __device_release_driver+0x66/0x9c [<c0681197>] device_release_driver+0x1d/0x28 [<c0680d89>] bus_remove_device+0xa2/0xaf [<c067e88a>] ? device_remove_attrs+0x2f/0x4c [<c067e99c>] device_del+0xf5/0x136 [<c06d4259>] usb_disable_device+0xa4/0x1c4 [<c0434d8c>] ? should_resched+0xd/0x27 [<c06cd579>] usb_disconnect+0xd8/0x13d [<c06cf4d7>] hub_thread+0x7e6/0x11d0 [<c0438b57>] ? finish_task_switch+0x6d/0xa0 [<c082536e>] ? __schedule+0x609/0x670 [<c045fdbd>] ? remove_wait_queue+0x2c/0x2c [<c06cecf1>] ? usb_remote_wakeup+0x60/0x60 [<c045f8b8>] kthread+0x67/0x6c [<c045f851>] ? kthread_worker_fn+0x11d/0x11d [<c082ca7e>] kernel_thread_helper+0x6/0x10 Code: ff b8 88 69 f7 fa e8 c6 c0 8b c5 8b 83 60 01 00 00 85 c0 74 16 83 78 04 00 74 10 83 bb 8c 01 00 00 03 74 07 89 f8 e8 1d d6 26 fd kernel-3.1.0-1.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/kernel-3.1.0-1.fc16 kernel-3.1.0-1.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. |