Repository navigation
kernel oops in hdac_hda with rmmod/modprobe machine driver #3537
Description
Forking issue #3535 to HDaudio problem.
When doing
rmmod snd_soc_sof_sdw
modprobe snd_soc_sof_sdw
we get a kernel oops after a very long time (likely codec probe delay?)
[ 300.721670] BUG: kernel NULL pointer dereference, address: 0000000000000010
[ 300.721679] #PF: supervisor read access in kernel mode
[ 300.721682] #PF: error_code(0x0000) - not-present page
[ 300.721686] PGD 0 P4D 0
[ 300.721690] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 300.721695] CPU: 7 PID: 1397 Comm: modprobe Not tainted 5.17.0-rc1-test-05172-gd0bcdd1bf37f #182
[ 300.721700] Hardware name: Dell Inc. Latitude 9520/020844, BIOS 88.26.9 08/14/2020
[ 300.721703] RIP: 0010:hdac_hda_codec_probe+0xba/0x200 [snd_soc_hdac_hda]
[ 300.721712] Code: 28 03 00 00 48 8b 93 58 01 00 00 48 8b 85 78 06 00 00 48 89 ef 48 8b 92 98 00 00 00 48 89 90 d8 06 00 00 48 8b 85 90 06 00 00 <48> 8b 70 10 e8 ed de 52 00 41 89 c4 85 c0 0f 88 3e 05 00 00 48 89
[ 300.721717] RSP: 0018:ffffae5780d97ab0 EFLAGS: 00010206
[ 300.721721] RAX: 0000000000000000 RBX: ffffa0f0d27a6a28 RCX: 0000000000000000
[ 300.721725] RDX: ffffa0f0e4f46000 RSI: ffffffff987a011c RDI: ffffa0f0d6c0b028
[ 300.721728] RBP: ffffa0f0d6c0b028 R08: 000000460468771d R09: 0000000000000000
[ 300.721730] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[ 300.721733] R13: ffffa0f0d586d780 R14: ffffa0f0d27a6a28 R15: ffffffffc0aaf0e0
[ 300.721736] FS: 00007fa043b9e740(0000) GS:ffffa0f43f600000(0000) knlGS:0000000000000000
[ 300.721740] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 300.721743] CR2: 0000000000000010 CR3: 0000000118720003 CR4: 0000000000770ee0
[ 300.721746] PKRU: 55555554
[ 300.721748] Call Trace:
[ 300.721752] <TASK>
[ 300.721757] snd_soc_component_probe+0x19/0x40 [snd_soc_core]
[ 300.721791] soc_probe_component+0x1cb/0x300 [snd_soc_core]
[ 300.721815] snd_soc_bind_card+0x4ff/0xcd0 [snd_soc_core]
[ 300.721834] ? is_module_address+0x3e/0x60
[ 300.721843] ? lockdep_init_map_type+0x51/0x240
[ 300.721850] ? debug_mutex_init+0x33/0x40
[ 300.721855] devm_snd_soc_register_card+0x3e/0x80 [snd_soc_core]
[ 300.721882] mc_probe+0xce7/0x1000 [snd_soc_sof_sdw]
[ 300.721895] platform_probe+0x4f/0xb0
[ 300.721901] really_probe+0x1ed/0x3d0
[ 300.721908] __driver_probe_device+0xf9/0x170
[ 300.721914] driver_probe_device+0x19/0x90
[ 300.721919] __driver_attach+0xbf/0x1c0
[ 300.721924] ? __device_attach_driver+0xd0/0xd0
[ 300.721930] ? __device_attach_driver+0xd0/0xd0
[ 300.721935] bus_for_each_dev+0x73/0xc0
[ 300.721941] bus_add_driver+0x147/0x1e0
[ 300.721946] driver_register+0x8a/0xe0
[ 300.721953] ? 0xffffffffc01f3000
[ 300.721956] do_one_initcall+0x6a/0x250
[ 300.721963] ? kmem_cache_alloc_trace+0x4a/0x210
[ 300.721969] do_init_module+0x56/0x240
[ 300.721975] __do_sys_finit_module+0xb4/0x120
[ 300.721983] do_syscall_64+0x38/0x90
[ 300.721991] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 300.721997] RIP: 0033:0x7fa043cddf6d
[ 300.722001] Code: 28 0d 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb de 0c 00 f7 d8 64 89 01 48
[ 300.722005] RSP: 002b:00007ffe96b63ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 300.722010] RAX: ffffffffffffffda RBX: 00007fa04516b0f0 RCX: 00007fa043cddf6d
[ 300.722013] RDX: 0000000000000000 RSI: 00007fa04516ccb0 RDI: 0000000000000003
[ 300.722015] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000
[ 300.722018] R10: 0000000000000003 R11: 0000000000000246 R12: 00007fa04516ccb0
[ 300.722020] R13: 0000000000000000 R14: 00007fa045163330 R15: 00007fa04516b0f0
[ 300.722025] </TASK>
[ 300.722027] Modules linked in: snd_soc_sof_sdw(+) snd_soc_intel_hda_dsp_common snd_soc_intel_sof_maxim_common snd_sof_ipc_msg_injector snd_sof_ipc_flood_test snd_sof_probes snd_soc_rt715 snd_soc_rt711 snd_soc_rt1308_sdw regmap_sdw snd_hda_codec_hdmi snd_soc_dmic snd_sof_pci_intel_tgl snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_intel_hda snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_hdac_hda snd_hda_ext_core snd_soc_acpi_intel_match snd_soc_acpi soundwire_bus wmi_bmof snd_soc_core snd_compress snd_intel_dspcfg ax88179_178a snd_intel_sdw_acpi usbnet snd_hda_codec snd_hwdep snd_hda_core snd_pcm ledtrig_audio hid_multitouch snd_seq_midi x86_pkg_temp_thermal snd_seq_midi_event intel_powerclamp snd_rawmidi snd_seq snd_seq_device snd_timer iwlmvm snd mei_me soundcore mei iwlwifi i915 i2c_algo_bit processor_thermal_device_pci_legacy processor_thermal_device drm_kms_helper processor_thermal_rfim processor_thermal_mbox ttm
[ 300.722092] intel_soc_dts_iosf wmi int3403_thermal int340x_thermal_zone int3400_thermal intel_pmc_core acpi_thermal_rel squashfs drm fuse drm_panel_orientation_quirks efivarfs intel_ishtp_hid psmouse intel_lpss_pci intel_lpss idma64 xhci_pci intel_ish_ipc mfd_core i2c_hid_acpi xhci_hcd intel_ishtp vmd i2c_hid [last unloaded: snd_soc_sof_sdw]
[ 300.722124] CR2: 0000000000000010
[ 300.722128] ---[ end trace 0000000000000000 ]---
[ 300.722131] RIP: 0010:hdac_hda_codec_probe+0xba/0x200 [snd_soc_hdac_hda]
[ 300.722138] Code: 28 03 00 00 48 8b 93 58 01 00 00 48 8b 85 78 06 00 00 48 89 ef 48 8b 92 98 00 00 00 48 89 90 d8 06 00 00 48 8b 85 90 06 00 00 <48> 8b 70 10 e8 ed de 52 00 41 89 c4 85 c0 0f 88 3e 05 00 00 48 89
[ 300.722141] RSP: 0018:ffffae5780d97ab0 EFLAGS: 00010206
[ 300.722144] RAX: 0000000000000000 RBX: ffffa0f0d27a6a28 RCX: 0000000000000000
[ 300.722147] RDX: ffffa0f0e4f46000 RSI: ffffffff987a011c RDI: ffffa0f0d6c0b028
[ 300.722149] RBP: ffffa0f0d6c0b028 R08: 000000460468771d R09: 0000000000000000
[ 300.722152] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[ 300.722154] R13: ffffa0f0d586d780 R14: ffffa0f0d27a6a28 R15: ffffffffc0aaf0e0
[ 300.722157] FS: 00007fa043b9e740(0000) GS:ffffa0f43f600000(0000) knlGS:0000000000000000
[ 300.722160] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 300.722163] CR2: 0000000000000010 CR3: 0000000118720003 CR4: 0000000000770ee0
[ 300.722166] PKRU: 55555554
Trying to remove hdac_hda is not possible due to a very odd dependency list
root@plb-Latitude-9520:~# rmmod snd_soc_sof_sdw
root@plb-Latitude-9520:~# rmmod snd_soc_hdac_hda
rmmod: ERROR: Module snd_soc_hdac_hda is in use by: snd_sof_intel_hda_common
root@plb-Latitude-9520:~# rmmod snd_sof_intel_hda_common
rmmod: ERROR: Module snd_sof_intel_hda_common is in use by: snd_sof_pci_intel_tgl
The kernel oops was root caused by @bardliao:
The kernel NULL pointer dereference happens at snd_hda_codec_set_name(hcodec, hcodec->preset->name) where hcodec->preset is NULL.
@kv2019i we probably need your help on this one.
Activity
kv2019i commentedon Mar 23, 2022
@plbossart @bardliao hda_bind.c seems to have a separate check for validity of hcodec->preset. We may need to replicate the safeguard in hdac_hda.c. . Strange this has not surfaced before, we do test (and use) module reload extensively in HDA configurations.
ujfalusi commentedon Jan 14, 2025
I think this can be closed. @kv2019i ?
kv2019i commentedon May 28, 2025
Sorry @ujfalusi for late response. Need to figure out how to repro and retest, let's not close until confirmed.
ujfalusi commentedon May 28, 2025
@kv2019i, I can do (LNL-sdw laptop)
rmmod snd_soc_sof_sdw
modprobe snd_soc_sof_sdw
and I don't see the oops, but I have not waited 'very long time' on about a minute or two. I will update if I see an oops.
kv2019i commentedon May 28, 2025
I can't repro on a MTL-SDW laptop either. Let's close this and reopen if this resurfaces.