Kernel Oops: NULL pointer dereference caused by hald

I forgot to mention -- I first saw this in 2.6.24-14, I never tried 2.6.24-13, but it was OK in 2.6.24-12.

The issue persists in 2.6.24-15

I would like to confirm this oops, both in 2.6.24-14 and 2.6.24-15, and confirm everything is working correctly in 2.6.24-12

[ 69.039165] BUG: unable to handle kernel NULL pointer dereference at virtual address 00000008
[ 69.039286] printing eip: f9a9ccd2 *pde = 00000000
[ 69.039403] Oops: 0000 [#1] SMP
[ 69.039515] Modules linked in: iptable_filter ip_tables x_tables aes_i586 dm_crypt ac w83627hf hwmon_vid lp usblp usbhid hid snd_intel8x0 snd_ac97_codec ac97_bus snd_seq_dummy evdev parport_pc parport serio_raw snd_seq_oss analog psmouse gameport cx88_alsa snd_pcm_oss snd_mixer_oss tuner tea5767 tda8290 tuner_simple mt20xx snd_seq_midi tea5761 snd_rawmidi snd_seq_midi_event snd_pcm cx8800 cx88xx snd_seq snd_timer snd_seq_device button ir_common i2c_algo_bit i2c_sis96x tveeprom pcspkr videodev compat_ioctl32 i2c_core sis_agp agpgart shpchp pci_hotplug snd soundcore v4l1_compat v4l2_common videobuf_dma_sg videobuf_core snd_page_alloc btcx_risc ext3 jbd mbcache sg sr_mod cdrom sd_mod floppy ehci_hcd ohci_hcd pata_sis pata_acpi ata_generic sis900 mii usbcore libata scsi_mod dm_mirror dm_snapshot dm_mod thermal processor fan fbcon tileblit font bitblit softcursor fuse
[ 69.042698]
[ 69.042745] Pid: 4945, comm: hald Not tainted (2.6.24-15-generic #1)
[ 69.042798] EIP: 0060:[<f9a9ccd2>] EFLAGS: 00010282 CPU: 0
[ 69.042877] EIP is at snd_pcm_info+0x82/0x110 [snd_pcm]
[ 69.042928] EAX: 0000005d EBX: dfa40000 ECX: 00000020 EDX: dfb1ae00
[ 69.042980] ESI: 00000000 EDI: dfb1af20 EBP: f7ca61d4 ESP: dfa7fe98
[ 69.043034] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 69.043086] Process hald (pid: 4945, ti=dfa7e000 task=dfb62000 task.ti=dfa7e000)
[ 69.043140] Stack: dfb1ae00 dfb1ae00 dfaa1720 f7ca61d4 f74fe250 f9a99d34 000040d0 df885f60
[ 69.043485] dfaa1720 df885f90 df885f60 00000000 f899f4a4 f7660be0 01a7ff30 ffffffff
[ 69.043825] f7cdef00 00000000 f7b8b2d0 f7660be0 c01c43e6 f7660be0 f7b8b2d0 00000000
[ 69.044171] Call Trace:
[ 69.044264] [<f9a99d34>] snd_pcm_proc_info_read+0x34/0x180 [snd_pcm]
[ 69.044362] [<f899f4a4>] snd_info_entry_open+0x114/0x280 [snd]
[ 69.044471] [<c01c43e6>] proc_reg_open+0x46/0x70
[ 69.044563] [<c018c41f>] __dentry_open+0xbf/0x1c0
[ 69.044651] [<c018c5d5>] nameidata_to_filp+0x35/0x40
[ 69.044734] [<c01c43a0>] proc_reg_open+0x0/0x70
[ 69.044817] [<c018c630>] do_filp_open+0x50/0x60
[ 69.044902] [<c0120aab>] check_pgt_cache+0x1b/0x20
[ 69.044994] [<c018c2d2>] get_unused_fd_flags+0x52/0xd0
[ 69.045081] [<c018c68c>] do_sys_open+0x4c/0xe0
[ 69.045167] [<c018c75c>] sys_open+0x1c/0x20
[ 69.045249] [<c01053c2>] sysenter_past_esp+0x6b/0xa9
[ 69.045344] =======================
[ 69.045393] Code: 50 00 00 00 8b 04 24 83 c0 50 e8 5a 7d 77 c6 0f b7 43 14 b9 20 00 00 00 8b 14 24 89 82 c0 00 00 00 0f b7 43 16 89 82 c4 00 00 00 <8b> 46 08 89 82 c8 00 00 00 8b 46 08 2b 46 0c 89 82 cc 00 00 00
[ 69.047511] EIP: [<f9a9ccd2>] snd_pcm_info+0x82/0x110 [snd_pcm] SS:ESP 0068:dfa7fe98
[ 69.047773] ---[ end trace 95c915ac6fd5385e ]---

Relevant devices are:

00:02.7 Multimedia audio controller: Silicon Integrated Systems [SiS] AC'97 Sound Controller (rev a0...

dme

Same for me, oops in -15 and -12. 12 is working.

N,

My dmesg output looks the same.
All was O.K. with 2.6.24-13, problem started with 2.6.24-14 and persists with 2.6.24-15.

Oops disappears when uninstalling "linux-ubuntu-modules-2.6.24-14..."

After removing the cx88 card from my system, now I can boot up properly without error.

I have a feeling that this is an ALSA ABI issue. cx88-alsa from the ubuntu kernel is probably causing the problem. (I've noticed a cx88 board in everybody's dmesg dumps)

Hello,

I have a similar problem here with cx88_alsa:

HAL was not starting, one of the things to fix it was to add module cx88_alsa to /etc/modprobe.d/blacklist

After that I issued 'modprobe -v cx88_alsa' manually and got the following traceback:
(I issued the command twice; the second time modprobe hanged and was killed with <CTRL>-C)

uname -a
Linux zeus 2.6.24-15-generic #1 SMP Fri Apr 4 03:10:59 UTC 2008 x86_64 GNU/Linux

Apr 6 19:54:50 zeus -- MARK --
Apr 6 20:03:57 zeus kernel: [19869.662969] cx2388x alsa driver version 0.0.6 loaded
Apr 6 20:03:57 zeus kernel: [19869.663484] ACPI: PCI Interrupt 0000:04:00.1[A] -> GSI 20 (level, low) -> IRQ 20
Apr 6 20:03:57 zeus kernel: [19869.663686] cx88[0]/1: CX88x/0: ALSA support for cx2388x boards
Apr 6 20:03:57 zeus kernel: [19869.663929] PGD 3d926067 PUD 4254067 PMD 0
Apr 6 20:03:57 zeus kernel: [19869.663937] CPU 0
Apr 6 20:03:57 zeus kernel: [19869.663939] Modules linked in: cx88_alsa binfmt_misc rfcomm l2cap bluetooth ppdev cpufreq_ondemand cpufreq_stats freq_table cpufreq_conservative cpufreq_powersave cpufreq_userspace container sbs sbshc dock video output battery microcode iptable_filter ip_tables x_tables aes_x86_64 ipv6 dm_crypt dm_mod ac parport_pc lp parport loop af_packet tuner tea5767 tda8290 tuner_simple mt20xx tea5761 snd_hda_intel snd_hwdep snd_pcm_oss snd_pcm snd_page_alloc snd_mixer_oss cx8800 snd_seq_dummy cx88xx snd_seq_oss ir_common snd_seq_midi i2c_algo_bit snd_rawmidi snd_seq_midi_event tveeprom snd_seq usblp videodev v4l1_compat nvidia(P) compat_ioctl32 v4l2_common videobuf_dma_sg snd_timer snd_seq_device videobuf_core snd i2c_core iTCO_wdt iTCO_vendor_support btcx_risc pcspkr evdev button soundcore shpchp pci_hotplug intel_agp ext3 jbd mbcache usbhid hid sr_mod cdrom ata_generic usb_storage libusual sg sd_mod ata_piix pata_it821x pata_acpi libata scsi_mod ehci_hcd tg3 uhci_hcd usbcore raid10 raid
Apr 6 20:03:57 zeus kernel: 56 async_xor async_memcpy async_tx xor raid1 raid0 multipath linear md_mod thermal processor fan fbcon tileblit font bitblit softcursor fuse
Apr 6 20:03:57 zeus kernel: [19869.664036] Pid: 12709, comm: modprobe Tainted: P 2.6.24-15-generic #1
Apr 6 20:03:57 zeus kernel: [19869.664039] RIP: 0010:[snd:snd_device_new+0x59/0xb0] [snd:snd_device_new+0x59/0xb0] :snd:snd_device_new+0x59/0xb0
Apr 6 20:03:57 zeus kernel: [19869.664051] RSP: 0018:ffff810013195b38 EFLAGS: 00010282
Apr 6 20:03:57 zeus kernel: [19869.664054] RAX: 0000000000000000 RBX: ffffffff88b5f350 RCX: 0000000000000000
Apr 6 20:03:57 zeus kernel: [19869.664056] RDX: ffff81001327fc40 RSI: 0000000000000000 RDI: ffff81001327fc80
Apr 6 20:03:57 zeus kernel: [19869.664058] RBP: 0000000000001003 R08: 000000000000004d R09: 0000000000000000
Apr 6 20:03:57 zeus kernel: [19869.664061] R10: ffff81001327fc40 R11: 0000000000000040 R12: ffff81001a3af600
Apr 6 20:03:57 zeus kernel: [19869.664063] R13: ffffffff88270620 R14: ffff810013195bb0 R15: ffffffff88b86e48
Apr 6 20:03:57 zeus kernel: [19869.664066] FS: 00007f9b5f4bb6e0(0000) GS:ffffffff805b1000(0000) knlGS:0000000000000000
Apr 6 20:03:57 zeus kernel: [19869.664068] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
Apr 6...

I have my own version of the v4l drivers compiled into one of my machines and it does not have this problem.
The other system with the stock v4l drivers (from the ubuntu-modules package) does have the problem.
Both are running 2.6.24-15. It seems as if the v4l developers have fixed the problem.

Paul,

In your functional case, are you using ALSA from linux-ubuntu-modules, and just v4l from v4l-dvb? I was looking over changelogs to cx88-alsa.c and didn't see anything sticking out that "should" resolve this. Of course it could be in another header used by cx88-alsa too...

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=history;f=drivers/media/video/cx88/cx88-alsa.c;h=316b106c3511b2a15981e692c6e4c7cd9884c6cd;hb=HEAD

[ 57.892507] BUG: unable to handle kernel NULL pointer dereference at virtual address 00000008
[ 57.892622] printing eip: f8a5ecd2 *pde = 00000000
[ 57.892752] Oops: 0000 [#1] SMP
[ 57.892879] Modules linked in: video output sbs sbshc dock container battery nfs lockd nfs_acl sunrpc iptable_filter ip_tables x_tables ipv6 ac eeprom i2c_i801 parport_pc lp parport ide_generic ide_disk ide_cd ide_core af_packet snd_intel8x0 snd_ac97_codec ac97_bus dvb_pll lgdt330x snd_seq_dummy usblp cx88_dvb cx88_vp3054_i2c snd_seq_oss snd_seq_midi tuner tea5767 tda8290 tuner_simple cx88_alsa snd_rawmidi mt20xx tea5761 snd_pcm_oss snd_mixer_oss snd_seq_midi_event serio_raw videobuf_dvb dvb_core snd_pcm snd_seq button cx8800 compat_ioctl32 cx8802 cx88xx ir_common i2c_algo_bit tveeprom i2c_core videodev snd_timer snd_seq_device intel_agp dcdbas v4l2_common v4l1_compat btcx_risc videobuf_dma_sg videobuf_core agpgart evdev snd soundcore shpchp pci_hotplug iTCO_wdt iTCO_vendor_support snd_page_alloc psmouse pcspkr ext3 jbd mbcache sg sr_mod sd_mod cdrom usb_storage libusual ata_piix pata_acpi ata_generic libata scsi_mod e100 mii ehci_hcd uhci_hcd usbcore dm_mirror dm_snapshot dm_mod thermal processor fan fbcon tileblit font bitblit softcursor fuse
[ 57.897536]
[ 57.897586] Pid: 5610, comm: hald Not tainted (2.6.24-15-generic #1)
[ 57.897639] EIP: 0060:[<f8a5ecd2>] EFLAGS: 00010282 CPU: 0
[ 57.897703] EIP is at snd_pcm_info+0x82/0x110 [snd_pcm]
[ 57.897755] EAX: 0000005d EBX: f7cf4800 ECX: 00000020 EDX: f7fd9400
[ 57.897808] ESI: 00000000 EDI: f7fd9520 EBP: f6543dd4 ESP: f7667e98
[ 57.897862] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 57.897914] Process hald (pid: 5610, ti=f7666000 task=f652eb40 task.ti=f7666000)
[ 57.897968] Stack: f7fd9400 f7fd9400 f6633ee0 f6543dd4 f65b3d40 f8a5bd34 000040d0 f7798ba0
[ 57.898376] f6633ee0 f7798bd0 f7798ba0 00000000 f89f24a4 f7638000 01667f30 ffffffff
[ 57.898783] f76cf900 00000000 f612d170 f7638000 c01c43e6 f7638000 f612d170 00000000
[ 57.899190] Call Trace:
[ 57.899302] [<f8a5bd34>] snd_pcm_proc_info_read+0x34/0x180 [snd_pcm]
[ 57.899422] [<f89f24a4>] snd_info_entry_open+0x114/0x280 [snd]
[ 57.899546] [<c01c43e6>] proc_reg_open+0x46/0x70
[ 57.899652] [<c018c41f>] __dentry_open+0xbf/0x1c0
[ 57.899759] [<c018c5d5>] nameidata_to_filp+0x35/0x40
[ 57.899853] [<c01c43a0>] proc_reg_open+0x0/0x70
[ 57.899947] [<c018c630>] do_filp_open+0x50/0x60
[ 57.900056] [<c0120aab>] check_pgt_cache+0x1b/0x20
[ 57.900180] [<c018c2d2>] get_unused_fd_flags+0x52/0xd0
[ 57.900289] [<c018c68c>] do_sys_open+0x4c/0xe0
[ 57.900399] [<c018c75c>] sys_open+0x1c/0x20
[ 57.900492] [<c01053c2>] sysenter_past_esp+0x6b/0xa9
[ 57.900610] [<c0310000>] sigd_send+0x80/0x2f0
[ 57.900725] =======================
[ 57.900774] Code: 50 00 00 00 8b 04 24 83 c0 50 e8 5a 5d 7b c7 0f b7 43 14 b9 20 00 00 00 8b 14 24 89 82 c0 00 00 00 0f b7 43 16 89 82 c4 00 00 00 <8b> 46 08 89 82 c8 00 00 00 8b 46 08 2b 46 0c 89 82 cc 00 00 00
[ 57.903350] EIP: [<f8a5ecd2>] snd_pcm_info+0x82/0x110 [snd_pcm] SS:ESP 0068:f7667e98
[ 57.903568] ---[ end trace b38de329eb00ee1d ]---

$ uname -r
2.6....

Mario,
I downloaded from their repository a version that I needed to apply a patch to the cx88 driver for the DVB4000 card, so I could use both -S & -T simultaneously. I then installed all the 4vl modules and removed the ones from the ubuntu modules. Everything then work fine.

I'm not at my machine until tonight, so I'll check to make sure that the cx88-alsa module is loaded.

I downloaded the mfe-7285.diff from http://dev.kewl.org/hauppauge/ and also downloaded the .bz2 archive from their mercurial repository for that revision.

Cheers
Paul

Also, I downloaded the 7285 revision v4l DVB drivers from http://linuxtv.org/hg/v4l-dvb

Looks like this may be a result of bug 202065.

Yes it is. They added the cx88-alsa module because it was missing. Perhaps it was missing for a reason :-)

Mario,
I just checked my machine that I built the v4l drivers on and they do not build the cx88-alsa module either.
I think I sense a pattern here :-)

It looks like theres a fix in the works
https://bugs.launchpad.net/ubuntu/+source/alsa-driver/+bug/212960

This is kind of a big deal, since I got my computer completely useless after this, without internet, nor access to usb disk drives as it usually does :\

Hi Everyone,

As Paul noted, bug 212960 recently pulled in a fix which should hopefully resolve this issue. We've received confirmation from that reporter that the patch does fix the problem:

http://kernel.ubuntu.com/git?p=ubuntu/ubuntu-hardy-lum.git;a=commit;h=607ab6f78fa5d51b4dab72d218455a858c499c6f

For those of you here who are comfortable building and booting your own kernel, it would be nice to get confirmation from you as well that this patch does resolve the issue. Otherwise please wait for the next linux-ubuntu-modules upload to test and verify. We apologize for any inconvenience this may have caused and appreciate your patience as we get the fix released to you. Thanks.

Hello!
I have a similar problem here with saa7134: could not initialize (lib)hal context

0.000000] Linux version 2.6.24-15-generic (buildd@palmer) (gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7)) #1 SMP Tue Apr 8 00:33:51 UTC 2008 (Ubuntu 2.6.24-15.27-generic)

48.843603] tuner 0-0043: chip found @ 0x86 (saa7134[0])
48.843652] tda9887 0-0043: tda988[5/6/7] found @ 0x43 (tuner)
48.843655] tuner 0-0043: type set to tda9887
48.851593] tuner 0-0061: chip found @ 0xc2 (saa7134[0])
48.851619] tuner-simple 0-0061: type set to 51 (Philips PAL/SECAM_D (FM 1256 I-H3))
48.851623] tuner 0-0061: type set to Philips PAL/SECAM_D
48.851628] tuner-simple 0-0061: type set to 51 (Philips PAL/SECAM_D (FM 1256 I-H3))
48.851632] tuner 0-0061: type set to Philips PAL/SECAM_D
48.854206] saa7134[0]: registered device video0 [v4l2]
48.854236] saa7134[0]: registered device vbi0
48.854268] saa7134[0]: registered device radio0
48.972143] saa7134 ALSA driver for DMA sound loaded
48.972185] saa7134[0]/alsa: saa7134[0] at 0xfdcff000 irq 20 registered as card -2
48.972289] BUG: unable to handle kernel NULL pointer dereference at virtual address 00000001
48.972297] printing eip: f90cc745 *pde = 00000000
48.972304] Oops: 0000 [#1] SMP
48.972310] Modules linked in: saa7134_alsa tuner tea5767 tda8290 tuner_simple mt20xx tea5761 snd_pcm snd_page_alloc snd_hwdep nvidia(P) saa7134 snd_seq_dummy compat_ioctl32 videobuf_dma_sg snd_seq_oss videobuf_core ir_kbd_i2c i2c_core snd_seq_midi ir_common snd_rawmidi videodev snd_seq_midi_event v4l2_common v4l1_compat snd_seq snd_timer snd_seq_device iTCO_wdt iTCO_vendor_support button shpchp snd pci_hotplug soundcore pcspkr intel_agp agpgart ext3 jbd mbcache sg sr_mod sd_mod cdrom ata_generic usbhid hid ata_piix pata_acpi floppy libata scsi_mod ehci_hcd tg3 uhci_hcd usbcore thermal processor fan fuse vesafb fbcon tileblit font bitblit softcursor
48.972378]
48.972382] Pid: 3350, comm: modprobe Tainted: P (2.6.24-15-generic #1)
48.972386] EIP: 0060:[<f90cc745>] EFLAGS: 00010246 CPU: 0
48.972403] EIP is at snd_pcm_timer_init+0x25/0x170 [snd_pcm]
48.972406] EAX: 00000001 EBX: dfbd7000 ECX: dfa63ddc EDX: 00000000
48.972410] ESI: dfbd71d4 EDI: dfadc234 EBP: 00000018 ESP: dfa63dc4
48.972413] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
48.972416] Process modprobe (pid: 3350, ti=dfa62000 task=df9c2b40 task.ti=dfa62000)
48.972419] Stack: 00000000 00000001 dfadc800 00000000 dfadc800 00000000 00000003 00000000
48.972429] dfbd7000 00000018 f8fec20c 00000000 dfbd71d4 dfadc200 f90c467f f90d592c
48.972439] dfadc200 dfa63e18 dfadc400 00000001 f90cd5f4 436d6370 63304431 ffffff00
48.972449] Call Trace:
48.972467] [<f8fec20c>] snd_add_device_sysfs_file+0x3c/0x70 [snd]
48.972488] [<f90c467f>] snd_pcm_dev_register+0xef/0x200 [snd_pcm]
48.972527] [<f8ff0e4d>] snd_device_register_all+0x2d/0x60 [snd]
48.972548] [<f8feca1e>] snd_card_register+0x1e/0x320 [snd]
48.972576] [<f907e31a>] alsa_device_init+0x23a/0x280 [saa7134_alsa]
48.972600] [<f907e3cb>] saa7134_alsa_init+0x6b/0xc0 [saa7134_alsa]
48.972612] [sys_init_module+0x126/0x19c0] sys_init_module+0x126/0x19c0
48.972673] [<f90cca80>] snd_pcm_format_width+0x0/0x20 [snd_pcm]
48.972713] ...

Alexandr,
You have exactly the same problem as the cx88-alsa.ko module.
As noted above it looks like a fix is available in 212960, if you are happy to build your own kernel you could try the patch and report back.

Hi All,

Just giving you an update that the patch in bug 212960 has been reverted as it was causing some boot issues: https://edge.launchpad.net/ubuntu/+source/linux-ubuntu-modules-2.6.24

Developers are still working on resolving this issue. Thanks for your patience.

The issue persists in 2.6.24-16-generic

Hi Leann,

I think that I see three issues on my box:

  1. The "cx22702 no longer works"-issue where cx22702_{readreg|writereg} is failing.
      According to the info in another bug this is because a gpio is mis-configured accidently.

  2. snd_pcm_proc_info_read+0x34/0x180 [snd_pcm] to crash with an uninitialized pointer.
      Maybe this happens due to incomplete error handling for 1.?

and finally
  3. Locking issue in sound/core/devices.c where a list is destroyed when it is not locked.

I am of the opinion that 3. is not related to the other two, because the patch for 3. just solved issue 3 for me.
Problem 1. and 2. do still exist on my system. I have found the time to test the gpio fix yet.

Frank

Closing 'linux' task as this was already appropriately opened against linux-ubuntu-modules-2.6.24.

Hi All,

Just wanted to give another update. In bug 212271 Stefan has provided a fix which is currently being uploaded to linux-ubuntu-modules. Please keep an eye out for the next upload of lum (https://edge.launchpad.net/ubuntu/+source/linux-ubuntu-modules-2.6.24/) and test accordingly. Thanks.

linux-ubuntu-modules-2.6.24-16.23 should contain a fix: https://edge.launchpad.net/ubuntu/+source/linux-ubuntu-modules-2.6.24 . Please test. Thanks.

Per a decision made by the Ubuntu Kernel Team, bugs will longer be assigned to the ubuntu-kernel-team in Launchpad as part of the bug triage process. The ubuntu-kernel-team is being unassigned from this bug report. Refer to https://wiki.ubuntu.com/KernelTeamBugPolicies for more information. Thanks.