Re: hid-core: crash in v5.0-rc1

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, 8 Jan 2019, Pandruvada, Srinivas wrote:

> Hi Peter,
> 
> We are observing some random crashes in the latest kernel in the v5.0-
> rc1 kernel ( < 5% of times). This is pointing to a line 196, which is
> added by commit "HID: core: store the collections as a basic tree".
> We can't reproduce by reverting this and dependent patches.
> 
> 
> [    6.980413] BUG: unable to handle kernel paging request at
> 0000000100000019
> [    6.980441] #PF error: [normal kernel read fault]
> [    6.980455] PGD 0 P4D 0 
> [    6.980466] Oops: 0000 [#1] SMP PTI
> [    6.980478] CPU: 7 PID: 288 Comm: systemd-udevd Not tainted 5.0.0-
> rc1-intel-next+ #1
> [    6.980498] Hardware name: Intel Corporation Kabylake Client
> platform/Kabylake R DDR4 RVP, BIOS KBLSE2R1.R00.X127.P00.1804200616
> 04/20/2018
> [    6.980529] RIP: 0010:hid_parser_main+0xd2/0x300 [hid]
> [    6.980544] Code: 5d 41 5e 41 5f 5d c3 8b 83 e8 80 01 00 85 c0 0f 84
> e8 01 00 00 83 e8 01 89 83 e8 80 01 00 48 8b 83 f0 80 01 00 48 85 c0 74
> 0a <48> 8b 00 48 89 83 f0 80 01 00 45 31 e4 eb ad 31 f6 48 89 df e8 f5
> [    6.980584] RSP: 0018:ffffba03413a7930 EFLAGS: 00010202
> [    6.980599] RAX: 0000000100000019 RBX: ffffba03413c9000 RCX:
> 000000000000000c
> [    6.980618] RDX: 0000000000000000 RSI: ffffba03413a7978 RDI:
> ffffba03413c9000
> [    6.980637] RBP: ffffba03413a7958 R08: 000000000000000c R09:
> ffffba03413c90cc
> [    6.980655] R10: ffff9ed0a73b8000 R11: ffff9ed0a7e28000 R12:
> ffff9ed0a7e28000
> [    6.980674] R13: ffffba03413c9000 R14: ffff9ed0a6e70ded R15:
> ffff9ed0a6d39918
> [    6.980692] FS:  00007f92f5113680(0000) GS:ffff9ed0b6bc0000(0000)
> knlGS:0000000000000000
> [    6.980712] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    6.980728] CR2: 0000000100000019 CR3: 00000002a6cc4004 CR4:
> 00000000003606e0
> [    6.980746] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> 0000000000000000
> [    6.980765] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> 0000000000000400
> [    6.980783] Call Trace:
> [    6.980795]  hid_open_report+0x127/0x2b0 [hid]
> [    6.980811]  sensor_hub_probe+0x83/0x420 [hid_sensor_hub]
> [    6.980827]  ? hid_match_id+0x2f/0x50 [hid]
> [    6.980842]  hid_device_probe+0x10c/0x170 [hid]
> [    6.980858]  really_probe+0x22c/0x410
> [    6.980876]  driver_probe_device+0x11a/0x140
> [    6.980895]  __device_attach_driver+0x8f/0x100
> [    6.980917]  ? __driver_attach+0x120/0x120
> [    6.980951]  bus_for_each_drv+0x69/0xb0
> [    6.980971]  ? hid_destroy_device+0x60/0x60 [hid]
> [    6.980993]  __device_attach+0xdd/0x160
> [    6.981012]  ? __hid_register_driver+0x80/0x80 [hid]
> [    6.981034]  ? hid_destroy_device+0x60/0x60 [hid]
> [    6.981067]  device_attach+0x10/0x20
> [    6.981080]  bus_rescan_devices_helper+0x47/0x80
> [    6.981094]  device_reprobe+0x59/0x80
> [    6.981107]  __hid_bus_reprobe_drivers+0x63/0x70 [hid]
> [    6.981123]  bus_for_each_dev+0x6a/0xc0 linux-input@xxxxxxxxxxxxxxx
> [    6.981136]  __hid_bus_driver_added+0x2c/0x40 [hid]
> [    6.981150]  bus_for_each_drv+0x69/0xb0
> [    6.981163]  __hid_register_driver+0x6f/0x80 [hid]
> [    6.981178]  ? 0xffffffffc0129000
> [    6.981190]  sensor_hub_driver_init+0x23/0x1000 [hid_sensor_hub]
> [    6.981208]  do_one_initcall+0x52/0x1d7
> [    6.981222]  ? _cond_resched+0x1a/0x50
> [    6.981235]  ? kmem_cache_alloc_trace+0x170/0x1d0
> [    6.981250]  do_init_module+0x5f/0x221
> [    6.981263]  load_module+0x264b/0x2ae0
> [    6.981277]  __do_sys_finit_module+0xe5/0x120
> [    6.981290]  ? __do_sys_finit_module+0xe5/0x120
> [    6.981305]  __x64_sys_finit_module+0x1a/0x20
> [    6.981320]  do_syscall_64+0x5a/0x140
> [    6.981332]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> [    6.981347] RIP: 0033:0x7f92f4c1d839
> [    6.981360] Code: 00 f3 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00
> 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24
> 08around 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 1f f6 2c 00 f7 d8
> 64 89 01 48
> [    6.981399] RSP: 002b:00007ffd6be39ff8 EFLAGS: 00000246 ORIG_RAX:
> 0000000000000139HID: core: store the collections as a basic tree
> [    6.981419] RAX: ffffffffffffffda RBX: 000055bd0d69d940 RCX:
> 00007f92f4c1d839
> [    6.981437] RDX: 0000000000000000 RSI: 00007f92f48fc0e5 RDI:
> 0000000000000005
> [    6.981455] RBP: 00007f92f48fc0e5 R08: 0000000000000000 R09:
> 00007ffd6be3a110
> [    6.981473] R10: 0000000000000005 R11: 0000000000000246 R12:
> 0000000000000000
> [    6.981492] R13: 000055bd0d697db0 R14: 0000000000020000 R15:
> 000055bd0d69d940
> [    6.981510] Modules linked in: hid_sensor_hub(+) intel_ishtp_hid
> hid_generic intel_ish_ipc ahci sdhci_pci cqhci e1000e usbhid libahci
> sdhci hid intel_ishtp wmi pinctrl_sunrisepoint pinctrl_intel
> [    6.981553] CR2: 0000000100000019
> [    6.981565] ---[ end trace fbbd8d33ebb5ae31 ]---
> [    6.981580] RIP: 0010:hid_parser_main+0xd2/0x300 [hid]
> [    6.981595] Code: 5d 41 5e 41 5f 5d c3 8b 83 e8 80 01 00 85 c0 0f 84
> e8 01 00 00 83 e8 01 89 83 e8 80 01 00 48 8b 83 f0 80 01 00 48 85 c0 74
> 0a <48> 8b 00 48 89 83 f0 80 01 00 45 31 e4 eb ad 31 f6 48 89 df e8 f5
> [    6.981635] RSP: 0018:ffffba03413a7930 EFLAGS: 00010202
> [    6.981649] RAX: 0000000100000019 RBX: ffffba03413c9000 RCX:
> 000000000000000c
> [    6.981668] RDX: 0000000000000000 RSI: ffffba03413a7978 RDI:
> ffffba03413c9000
> [    6.981686] RBP: ffffba03413a7958 R08: 000000000000000c R09: HID:
> core: store the collections as a basic treeffffba03413c90cc
> [    6.981705] R10: ffff9ed0a73b8000 R11: ffff9ed0a7e28000 R12:
> ffff9ed0a7e28000
> [    6.981723] R13: ffffba03413c9000 R14: ffff9ed0a6e70ded R15:
> ffff9ed0a6d39918
> [    6.981742] FS:  00007f92f5113680(0000) GS:ffff9ed0b6bc0000(0000)
> knlGS:0000000000000000
> [    6.981762] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [    6.981778] CR2: 0000000100000019 CR3: 00000002a6cc4004 CR4:
> 00000000003606e0
> [    6.981796] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
> 0000000000000000
> [    6.981815] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7:
> 0000000000000400
> [    6.997410] EXT4-fs (nvme0n1p2): mounted filesystem with ordered
> data mode. Opts: (null)

This is by no way meant as a final fix, but just to verify whether this is 
the race condition I think it is -- does the patch below cure the 
symptoms?

Thanks.


diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index f41d5fe51abe..b0fc95e6a0b7 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -123,7 +123,7 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned
 
 static int open_collection(struct hid_parser *parser, unsigned type)
 {
-	struct hid_collection *collection;
+i	struct hid_collection *collection, *old_collection;
 	unsigned usage;
 
 	usage = parser->local.usage[0];
@@ -159,9 +159,11 @@ static int open_collection(struct hid_parser *parser, unsigned type)
 		memset(collection + parser->device->collection_size, 0,
 			sizeof(struct hid_collection) *
 			parser->device->collection_size);
-		kfree(parser->device->collection);
+		old_collection = parser->device->collection;
 		parser->device->collection = collection;
 		parser->device->collection_size *= 2;
+		parser->active_collection = collection;
+		kfree(old_collection);
 	}
 
 	parser->collection_stack[parser->collection_stack_ptr++] =

-- 
Jiri Kosina
SUSE Labs




[Index of Archives]     [Linux Media Devel]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Linux Wireless Networking]     [Linux Omap]

  Powered by Linux