Description of problem: twinkle VOIP is unusable in 3.6.2 kernel. Starting a call in twinkle instantly starts a cascade of list debugging warnings beginning with "list_del corruption." Version-Release number of selected component (if applicable): kernel-3.6.2-1.fc16.i686 How reproducible: 100% (reproduced 3 times on 3 attempts. Not reproducible on kernel-3.4.11-1.fc16.i686.) Steps to Reproduce: 1. Start twinkle using USB headset as audio device for call. 2. Make a call. Actual results: An apparently endless stream of ehci_irq list-debug warnings; kernel becomes unusable. Initial warning: WARNING: at lib/list_debug.c:59 __list_del_entry+0xac/0xe0() Hardware name: Dell DXP051 list_del corruption. prev->next Modules linked in: sha256_generic dm_crypt fuse ebtable_nat ebtables bridge nfs\ v3 stp llc nfsv4 nfs fscache dns_resolver tpm_bios nf_conntrack_netbios_ns nf_c\ onntrack_broadcast xt_physdev xt_LOG xt_limit ipt_MASQUERADE ip6t_REJECT iptabl\ e_nat nf_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 \ xt_state nf_conntrack xt_CHECKSUM ip6table_filter iptable_mangle ip6_tables be2\ iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi cxgb3 mdio i\ b_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi_tcp \ libiscsi scsi_transport_iscsi snd_usb_audio snd_usbmidi_lib snd_rawmidi joydev \ snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device \ snd_pcm snd_timer snd soundcore snd_page_alloc i2c_i801 gpio_ich iTCO_wdt iTCO_\ vendor_support e1000e lpc_ich dcdbas serio_raw microcode vhost_net macvtap macv\ lan tun kvm_intel kvm nfsd binfmt_misc uinput lockd nfs_acl auth_rpcgss sunrpc \ usb_storage nouveau ttm drm_kms_helper drm i2c_algo_bit i2c_core mxm_wmi video \ wmi Pid: 2267, comm: Xorg Not tainted 3.6.2-1.fc16.i686 #1 Call Trace: [<c043c822>] warn_slowpath_common+0x72/0xa0 [<c06758ec>] ? __list_del_entry+0xac/0xe0 [<c06758ec>] ? __list_del_entry+0xac/0xe0 [<c043c8f3>] warn_slowpath_fmt+0x33/0x40 [<c06758ec>] __list_del_entry+0xac/0xe0 [<c07993c7>] usb_hcd_unlink_urb_from_ep+0x27/0x40 [<c07ada27>] ehci_urb_done+0x47/0x90 [<c07b0e8b>] ehci_work+0x65b/0x900 [<c07b1342>] ehci_irq+0x182/0x3c0 [<f7dce9c0>] ? nouveau_gem_ioctl_new+0x130/0x130 [nouveau] [<c0406481>] ? unmask_8259A+0x21/0x40 [<c07989a2>] usb_hcd_irq+0x32/0x50 [<c04bb46c>] handle_irq_event_percpu+0x4c/0x200 [<c04bb653>] handle_irq_event+0x33/0x60 [<c04be10b>] handle_fasteoi_irq+0x4b/0xd0 [<c0404fcb>] handle_irq+0x5b/0xe0 [<c0404b92>] do_IRQ+0x42/0xc0 [<c04ad71e>] ? __audit_syscall_exit+0x36e/0x3a0 [<c0958f70>] common_interrupt+0x30/0x38 Additional info: This has been 100% reproducible on 3.6.2 but I have never seen it on an older kernel. This appears to be the F16/i686 version of the same issue reported on the F17/x86_64 kernel in bug 863953: https://bugzilla.redhat.com/show_bug.cgi?id=863953 Twinkle call crash - list_del corruption USB audio output does not appear to cause the problem: other playback-only apps (mplayer) do not trigger it. Unsure whether it's something twinkle does to the output stream, or the opening of an input stream for voice record, which is the cause. The kernel continues to log additional WARNINGs: WARNING: at lib/list_debug.c:59 __list_del_entry+0xac/0xe0() Hardware name: Dell DXP051 list_del corruption. prev->next should be f2e53794, but was f6ace3d0 all with usb_hcd_unlink_urb_from_ep+0x27/0x40 just before __list_del_entry on the stack trace.
There's an upstream report for this too: https://lkml.org/lkml/2012/10/20/35 https://bugzilla.kernel.org/show_bug.cgi?id=49181 which includes identical call traces in the attachment: https://bugzilla.kernel.org/attachment.cgi?id=84221 Bisecting now, but it will take a while to finish, I've got 14 steps to narrow down and can only reproduce this on a desktop that is in use for other things most of the time. I've tried reproducing with the same networking/software setup, same kernel and same USB headset on a different desktop, but it works fine there; it appears hardware-dependent.
This is probably the same bug that's affecting me, which also involves full duplex USB audio -- specifically while using Guitarix and JACK. Here's my call trace FWIW. I'm running Fedora 17, current on all updates, kernel.x86_64 3.6.3-1.fc17 Oct 31 09:26:38 tom kernel: [ 4415.263227] WARNING: at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0() Oct 31 09:26:38 tom kernel: [ 4415.263228] Hardware name: TZ68K+ Oct 31 09:26:38 tom kernel: [ 4415.263230] list_del corruption. prev->next should be ffff880231261020, but was ffff8801cdeff120 Oct 31 09:26:38 tom kernel: [ 4415.263232] Modules linked in: snd_hrtimer snd_seq_dummy fuse ebtable_nat ebtables ipt_MASQUERADE iptable_nat nf_nat xt_CHECKSUM iptable_mangle lockd sunrpc bridge stp llc bnep bluetooth be2iscsi iscsi_boot_sysfs bnx2i cnic uio cxgb4i cxgb4 cxgb3i cxgb3 mdio libcxgbi ib_iser rdma_cm ib_addr iw_cm ib_cm ib_sa ib_mad ib_core iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack ip6table_filter ip6_tables snd_hda_codec_hdmi snd_hda_codec_realtek snd_usb_audio snd_usbmidi_lib snd_rawmidi snd_hda_intel snd_hda_codec snd_hwdep snd_seq snd_seq_device snd_pcm arc4 snd_page_alloc snd_timer snd ath9k_htc iTCO_wdt iTCO_vendor_support lpc_ich ath9k_common ath9k_hw mei ath coretemp microcode joydev soundcore mfd_core i2c_i801 r8169 mii mac80211 cfg80211 rfkill vhost_net tun macvtap macvlan kvm uinput crc32c_intel ghash_clmulni_intel i915 video i2c_algo_bit drm_kms_helper drm i2c_core Oct 31 09:26:38 tom kernel: [ 4415.263308] Pid: 0, comm: swapper/2 Not tainted 3.6.3-1.fc17.x86_64 #1 Oct 31 09:26:38 tom kernel: [ 4415.263309] Call Trace: Oct 31 09:26:38 tom kernel: [ 4415.263311] <IRQ> [<ffffffff8105b81f>] warn_slowpath_common+0x7f/0xc0 Oct 31 09:26:38 tom kernel: [ 4415.263320] [<ffffffff8105b916>] warn_slowpath_fmt+0x46/0x50 Oct 31 09:26:38 tom kernel: [ 4415.263324] [<ffffffff812ed151>] __list_del_entry+0xa1/0xd0 Oct 31 09:26:38 tom kernel: [ 4415.263329] [<ffffffff81437350>] usb_hcd_unlink_urb_from_ep+0x30/0x50 Oct 31 09:26:38 tom kernel: [ 4415.263334] [<ffffffff8144f777>] ehci_urb_done+0x67/0xc0 Oct 31 09:26:38 tom kernel: [ 4415.263338] [<ffffffff8145201e>] ehci_work+0x65e/0x900 Oct 31 09:26:38 tom kernel: [ 4415.263343] [<ffffffff81095fde>] ? update_cfs_shares+0xbe/0x120 Oct 31 09:26:38 tom kernel: [ 4415.263347] [<ffffffff81452506>] ehci_irq+0x1a6/0x490 Oct 31 09:26:38 tom kernel: [ 4415.263351] [<ffffffff812e0d74>] ? timerqueue_add+0x74/0xc0 Oct 31 09:26:38 tom kernel: [ 4415.263356] [<ffffffff81082e79>] ? enqueue_hrtimer+0x29/0x90 Oct 31 09:26:38 tom kernel: [ 4415.263359] [<ffffffff8143694c>] usb_hcd_irq+0x3c/0x60 Oct 31 09:26:38 tom kernel: [ 4415.263363] [<ffffffff810e7774>] handle_irq_event_percpu+0x54/0x1f0 Oct 31 09:26:38 tom kernel: [ 4415.263366] [<ffffffff810e7951>] handle_irq_event+0x41/0x70 Oct 31 09:26:38 tom kernel: [ 4415.263370] [<ffffffff810eaa99>] handle_fasteoi_irq+0x59/0x100 Oct 31 09:26:38 tom kernel: [ 4415.263375] [<ffffffff8101510f>] handle_irq+0xbf/0x150 Oct 31 09:26:38 tom kernel: [ 4415.263380] [<ffffffff81620eb2>] ? __atomic_notifier_call_chain+0x12/0x20 Oct 31 09:26:38 tom kernel: [ 4415.263384]Oct 31 09:30:50 tom kernel: imklog 5.8.10, log source = /proc/kmsg started.
Still a problem with kernel-3.6.5. wrt comment #2: yes, this looks like exactly the same issue.
Thanks for the info. FYI for anyone searching for a workaround: try "yum install kernel-3.3*" (I don't know why 3.4 and 3.5 aren't available in the repositories, but oh well, this works for me)
And... we have a solution! Just posted upstream to lkml: https://lkml.org/lkml/2012/11/8/49 I've tried a scratch upstream kernel with Fedora config locally and this fixes the problem for me. It's not yet in Linus's tree.
(In reply to comment #5) > And... we have a solution! Just posted upstream to lkml: > > https://lkml.org/lkml/2012/11/8/49 > > I've tried a scratch upstream kernel with Fedora config locally and this > fixes the problem for me. It's not yet in Linus's tree. From what I understand of the upstream discussion, we probably want both of the below semi-related patches as well: http://article.gmane.org/gmane.linux.usb.general/74493 http://article.gmane.org/gmane.linux.usb.general/74438
kernel-3.6.6-9.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/kernel-3.6.6-9.fc18
Package kernel-3.6.6-9.fc18: * should fix your issue, * was pushed to the Fedora 18 testing repository, * should be available at your local mirror within two days. Update it with: # su -c 'yum update --enablerepo=updates-testing kernel-3.6.6-9.fc18' as soon as you are able to, then reboot. Please go to the following url: https://admin.fedoraproject.org/updates/FEDORA-2012-18361/kernel-3.6.6-9.fc18 then log in and leave karma (feedback).
3.6.6-9 hasn't been built for f16, but I tried 3.6.7-1.fc16 and that seems to be working fine. No sign of it in the updates system yet but I'll give it karma when either version appears there.
kernel-3.6.7-1.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/kernel-3.6.7-1.fc18
kernel-3.6.7-2.fc16 has been submitted as an update for Fedora 16. https://admin.fedoraproject.org/updates/kernel-3.6.7-2.fc16
kernel-3.6.7-2.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/kernel-3.6.7-2.fc17
*** Bug 863953 has been marked as a duplicate of this bug. ***
kernel-3.6.7-5.fc18 has been submitted as an update for Fedora 18. https://admin.fedoraproject.org/updates/kernel-3.6.7-5.fc18
kernel-3.6.7-4.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/kernel-3.6.7-4.fc17
kernel-3.6.7-4.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
I'm still having problems on 3.6.7-4.fc17.x86_64 Not catastrophic like before, but still pretty annoying... my audio is cutting out every ~15 minutes, even just listening to music with plain ALSA output, no JACK or Pulse servers running. Here's my dmesg output... notice that the USB device number increments after each disconnect/reconnect (I'm not unplugging it or anything BTW). Also, this is the first time I've noticed the drm:__gen6_gt_force_wake_get error (apparently an issue with the Intel GPU driver)... it repeats every few seconds. [36665.889829] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36666.199415] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36668.875927] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36669.317549] [drm:__gen6_gt_force_wake_get] *ERROR* Force wake wait timed out [36670.164248] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36670.483831] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36673.070441] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36673.629732] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36676.226475] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36678.343588] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36678.423483] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36679.641895] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36682.148639] ALSA sound/usb/pcm.c:1187 delay: estimated 89, actual 0 [36682.175372] usb 2-1.8: USB disconnect, device number 26 [36682.375462] usb 2-1.8: new full-speed USB device number 27 using ehci_hcd [36682.464194] usb 2-1.8: New USB device found, idVendor=08bb, idProduct=29b0 [36682.464196] usb 2-1.8: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [36682.464198] usb 2-1.8: Product: USB Audio CODEC [36682.464199] usb 2-1.8: Manufacturer: Burr-Brown from TI [36682.468068] ALSA sound/usb/mixer.c:887 3:0: cannot get min/max values for control 2 (id 3) [36682.468714] input: Burr-Brown from TI USB Audio CODEC as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.8/2-1.8:1.3/input/input22 [36682.468778] hid-generic 0003:08BB:29B0.0014: input,hidraw1: USB HID v1.00 Device [Burr-Brown from TI USB Audio CODEC ] on usb-0000:00:1d.0-1.8/input3 [36704.162670] usb 2-1.8: USB disconnect, device number 27 [36704.353938] usb 2-1.8: new full-speed USB device number 28 using ehci_hcd [36704.442681] usb 2-1.8: New USB device found, idVendor=08bb, idProduct=29b0 [36704.442684] usb 2-1.8: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [36704.442685] usb 2-1.8: Product: USB Audio CODEC [36704.442687] usb 2-1.8: Manufacturer: Burr-Brown from TI [36704.446546] ALSA sound/usb/mixer.c:887 3:0: cannot get min/max values for control 2 (id 3) [36704.447192] input: Burr-Brown from TI USB Audio CODEC as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.8/2-1.8:1.3/input/input23 [36704.447247] hid-generic 0003:08BB:29B0.0015: input,hidraw1: USB HID v1.00 Device [Burr-Brown from TI USB Audio CODEC ] on usb-0000:00:1d.0-1.8/input3 [36705.440996] usb 2-1.8: USB disconnect, device number 28 [36705.633255] usb 2-1.8: new full-speed USB device number 29 using ehci_hcd [36705.722256] usb 2-1.8: New USB device found, idVendor=08bb, idProduct=29b0 [36705.722259] usb 2-1.8: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [36705.722260] usb 2-1.8: Product: USB Audio CODEC [36705.722261] usb 2-1.8: Manufacturer: Burr-Brown from TI [36705.726128] ALSA sound/usb/mixer.c:887 3:0: cannot get min/max values for control 2 (id 3) [36705.726899] input: Burr-Brown from TI USB Audio CODEC as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.8/2-1.8:1.3/input/input24 [36705.726953] hid-generic 0003:08BB:29B0.0016: input,hidraw1: USB HID v1.00 Device [Burr-Brown from TI USB Audio CODEC ] on usb-0000:00:1d.0-1.8/input3
kernel-3.6.7-5.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.
kernel-3.6.7-4.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
kernel-3.6.8-2.fc17 has been submitted as an update for Fedora 17. https://admin.fedoraproject.org/updates/kernel-3.6.8-2.fc17
*** Bug 876268 has been marked as a duplicate of this bug. ***
*** Bug 871008 has been marked as a duplicate of this bug. ***
kernel-3.6.8-2.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.