Bug 1338562 - [abrt] BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 [videobuf2_v4l2]
Summary: [abrt] BUG: unable to handle kernel NULL pointer dereference at 0000000000000...
Keywords:
Status: CLOSED UPSTREAM
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: 24
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kernel Maintainer List
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: abrt_hash:d3ba01f47475f2772e395464990...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-05-22 22:43 UTC by pzeppegno
Modified: 2016-05-24 07:33 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2016-05-24 07:33:15 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description pzeppegno 2016-05-22 22:43:31 UTC
Description of problem:
Using tvheadend with my 3 tv cards. it worked fine until the upgrade to fedora 24

Additional info:
reporter:       libreport-2.7.0
BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
IP: [<ffffffffa0476be5>] __verify_planes_array.isra.3+0x5/0x90 [videobuf2_v4l2]
PGD 0 
Oops: 0000 [#1] SMP 
Modules linked in: xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun xfs fuse ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_mangle ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_security ip6table_raw iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables rc_dib0700_rc5 raid456 async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq dvb_pll gpio_ich cx22702 cx88_dvb iTCO_wdt cx88_vp3054_i2c videobuf2_dvb iTCO_vendor_support ir_lirc_codec lirc_dev snd_hda_codec_analog snd_hda_codec_generic rc_cinergy_1400 coretemp kvm_intel kvm dm_thin_pool dm_persistent_data
 irqbypass dm_bio_prison libcrc32c dib7000p dvb_usb_dib0700 dib7000m joydev dib0090 dib0070 dib3000mc dibx000_common cx8800 snd_hda_intel cx8802 dvb_usb cx88xx snd_hda_codec dvb_core videobuf2_dma_sg videobuf2_v4l2 tveeprom videobuf2_memops videobuf2_core snd_hda_core snd_hwdep snd_seq rc_core v4l2_common snd_seq_device videodev snd_pcm i2c_i801 media lpc_ich asus_atk0110 snd_timer snd acpi_cpufreq tpm_tis shpchp soundcore tpm binfmt_misc nfsd auth_rpcgss nfs_acl lockd grace sunrpc ata_generic pata_acpi serio_raw nouveau firewire_ohci firewire_core skge crc_itu_t uas usb_storage video mxm_wmi wmi i2c_algo_bit drm_kms_helper hid_logitech ff_memless ttm drm pata_jmicron fjes
CPU: 1 PID: 3866 Comm: vb2-cx88[0] Not tainted 4.5.4-300.fc24.x86_64 #1
Hardware name: System manufacturer System Product Name/P5B-Deluxe, BIOS 1238    09/30/2008
task: ffff8801a0278000 ti: ffff8801a80b8000 task.ti: ffff8801a80b8000
RIP: 0010:[<ffffffffa0476be5>]  [<ffffffffa0476be5>] __verify_planes_array.isra.3+0x5/0x90 [videobuf2_v4l2]
RSP: 0018:ffff8801a80bbdd8  EFLAGS: 00010086
RAX: ffffffffa0476c70 RBX: ffff8801a39bf000 RCX: ffff8801a39bf1b8
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801a39bf014
RBP: ffff8801a80bbde0 R08: ffff8801a80bbe28 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8801b6c921d8
R13: 0000000000000202 R14: ffff8801a80bbe84 R15: ffff8801b6c92028
FS:  0000000000000000(0000) GS:ffff8801bfc80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000004 CR3: 00000001a0fee000 CR4: 00000000000006e0
Stack:
 ffffffffa0476c82 ffff8801a80bbe68 ffffffffa0468468 ffff8801a80bbe50
 ffffffff810166e2 ffff8801a39bf1b8 0000000000000000 ffff880100000000
 ffff8801a0278000 ffffffff810e89f0 ffff8801a80bbe28 ffff8801a80bbe28
Call Trace:
 [<ffffffffa0476c82>] ? __verify_planes_array_core+0x12/0x20 [videobuf2_v4l2]
 [<ffffffffa0468468>] vb2_core_dqbuf+0x1a8/0x4e0 [videobuf2_core]
 [<ffffffff810166e2>] ? __switch_to+0x242/0x490
 [<ffffffff810e89f0>] ? prepare_to_wait_event+0xf0/0xf0
 [<ffffffffa04689ab>] vb2_thread+0x20b/0x260 [videobuf2_core]
 [<ffffffffa04687a0>] ? vb2_core_dqbuf+0x4e0/0x4e0 [videobuf2_core]
 [<ffffffff810c4a28>] kthread+0xd8/0xf0
 [<ffffffff810c4950>] ? kthread_worker_fn+0x180/0x180
 [<ffffffff817d0bbf>] ret_from_fork+0x3f/0x70
 [<ffffffff810c4950>] ? kthread_worker_fn+0x180/0x180
Code: 8b 46 28 48 8b 56 30 48 89 87 d0 01 00 00 48 89 97 d8 01 00 00 5d c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 <8b> 46 04 8d 50 f7 31 c0 83 fa 01 76 01 c3 55 48 83 7e 40 00 48 
RIP  [<ffffffffa0476be5>] __verify_planes_array.isra.3+0x5/0x90 [videobuf2_v4l2]

Comment 1 pzeppegno 2016-05-23 07:21:59 UTC
Description of problem:
Using tvheadend with my 3 tv cards. it worked fine until the upgrade to fedora 24

Version-Release number of selected component:
kernel

Additional info:
reporter:       libreport-2.7.0
cmdline:        BOOT_IMAGE=/vmlinuz-4.5.4-300.fc24.x86_64 root=/dev/mapper/vg_zorro00-lv_root ro rd.md=0 rd.dm=0 rd.lvm.lv=vg_zorro00/lv_swap rd.lvm.lv=vg_zorro00/lv_root rd.luks=0 vconsole.keymap=it vconsole.font=latarcyrheb-sun16 LANG=en_US.utf8 rhgb quiet
kernel:         4.5.4-300.fc24.x86_64
pkg_fingerprint: 73BD E983 81B4 6521
pkg_vendor:     Fedora Project
reproducible:   Not sure how to reproduce the problem
runlevel:       unknown
type:           Kerneloops

Truncated backtrace:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000004
IP: [<ffffffffa0476be5>] __verify_planes_array.isra.3+0x5/0x90 [videobuf2_v4l2]
PGD 0 
Oops: 0000 [#1] SMP 
Modules linked in: xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun xfs fuse ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_mangle ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_security ip6table_raw iptable_mangle iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_security iptable_raw ebtable_filter ebtables ip6table_filter ip6_tables rc_dib0700_rc5 raid456 async_raid6_recov async_memcpy async_pq async_xor xor async_tx raid6_pq dvb_pll gpio_ich cx22702 cx88_dvb iTCO_wdt cx88_vp3054_i2c videobuf2_dvb iTCO_vendor_support ir_lirc_codec lirc_dev snd_hda_codec_analog snd_hda_codec_generic rc_cinergy_1400 coretemp kvm_intel kvm dm_thin_pool dm_persistent_data
 irqbypass dm_bio_prison libcrc32c dib7000p dvb_usb_dib0700 dib7000m joydev dib0090 dib0070 dib3000mc dibx000_common cx8800 snd_hda_intel cx8802 dvb_usb cx88xx snd_hda_codec dvb_core videobuf2_dma_sg videobuf2_v4l2 tveeprom videobuf2_memops videobuf2_core snd_hda_core snd_hwdep snd_seq rc_core v4l2_common snd_seq_device videodev snd_pcm i2c_i801 media lpc_ich asus_atk0110 snd_timer snd acpi_cpufreq tpm_tis shpchp soundcore tpm binfmt_misc nfsd auth_rpcgss nfs_acl lockd grace sunrpc ata_generic pata_acpi serio_raw nouveau firewire_ohci firewire_core skge crc_itu_t uas usb_storage video mxm_wmi wmi i2c_algo_bit drm_kms_helper hid_logitech ff_memless ttm drm pata_jmicron fjes
CPU: 1 PID: 3866 Comm: vb2-cx88[0] Not tainted 4.5.4-300.fc24.x86_64 #1
Hardware name: System manufacturer System Product Name/P5B-Deluxe, BIOS 1238    09/30/2008
task: ffff8801a0278000 ti: ffff8801a80b8000 task.ti: ffff8801a80b8000
RIP: 0010:[<ffffffffa0476be5>]  [<ffffffffa0476be5>] __verify_planes_array.isra.3+0x5/0x90 [videobuf2_v4l2]
RSP: 0018:ffff8801a80bbdd8  EFLAGS: 00010086
RAX: ffffffffa0476c70 RBX: ffff8801a39bf000 RCX: ffff8801a39bf1b8
RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff8801a39bf014
RBP: ffff8801a80bbde0 R08: ffff8801a80bbe28 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff8801b6c921d8
R13: 0000000000000202 R14: ffff8801a80bbe84 R15: ffff8801b6c92028
FS:  0000000000000000(0000) GS:ffff8801bfc80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 0000000000000004 CR3: 00000001a0fee000 CR4: 00000000000006e0
Stack:
 ffffffffa0476c82 ffff8801a80bbe68 ffffffffa0468468 ffff8801a80bbe50
 ffffffff810166e2 ffff8801a39bf1b8 0000000000000000 ffff880100000000
 ffff8801a0278000 ffffffff810e89f0 ffff8801a80bbe28 ffff8801a80bbe28
Call Trace:
 [<ffffffffa0476c82>] ? __verify_planes_array_core+0x12/0x20 [videobuf2_v4l2]
 [<ffffffffa0468468>] vb2_core_dqbuf+0x1a8/0x4e0 [videobuf2_core]
 [<ffffffff810166e2>] ? __switch_to+0x242/0x490
 [<ffffffff810e89f0>] ? prepare_to_wait_event+0xf0/0xf0
 [<ffffffffa04689ab>] vb2_thread+0x20b/0x260 [videobuf2_core]
 [<ffffffffa04687a0>] ? vb2_core_dqbuf+0x4e0/0x4e0 [videobuf2_core]
 [<ffffffff810c4a28>] kthread+0xd8/0xf0
 [<ffffffff810c4950>] ? kthread_worker_fn+0x180/0x180
 [<ffffffff817d0bbf>] ret_from_fork+0x3f/0x70
 [<ffffffff810c4950>] ? kthread_worker_fn+0x180/0x180
Code: 8b 46 28 48 8b 56 30 48 89 87 d0 01 00 00 48 89 97 d8 01 00 00 5d c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 <8b> 46 04 8d 50 f7 31 c0 83 fa 01 76 01 c3 55 48 83 7e 40 00 48 
RIP  [<ffffffffa0476be5>] __verify_planes_array.isra.3+0x5/0x90 [videobuf2_v4l2]

Comment 2 pzeppegno 2016-05-23 07:23:32 UTC
The crash is reproducible. My machine consistently crashes with the fedora 24 kernel. I am now running fedora 24 with the last fedora 23 kernel.

Comment 3 Josh Boyer 2016-05-23 14:10:10 UTC
This is likely due to a change that was pulled into the stable trees in the last releases.  I believe it is being reverted upstream.

Comment 4 pzeppegno 2016-05-23 18:14:41 UTC
This?

https://marc.ttias.be/linux-kernel/2016-05/msg10439.php

Comment 5 Josh Boyer 2016-05-23 18:24:29 UTC
(In reply to pzeppegno from comment #4)
> This?
> 
> https://marc.ttias.be/linux-kernel/2016-05/msg10439.php

Yes.  That's the revert, which is included in 4.5.5.  That was filed as an update today, so testing would be appreciated.

Comment 6 pzeppegno 2016-05-23 18:29:49 UTC
Yeah, I will try it as soon as 4.5.5 comes out. Right now it's still not available for me.

Comment 7 pzeppegno 2016-05-24 07:33:15 UTC
4.5.5 fixed it for me. After the upgrade I can use tvheadend and minisatip while in 4.5.4 the system would freeze in about a minute.
Thanks


Note You need to log in before you can comment on or make changes to this bug.