Repository navigation
SoundWire: kernel oops on COMP_NEW IPC fail. #3641
Description
While running experiments with a modified SoundWire driver to allow for driver bind/unbind and the following script:
set -e
echo "removing machine driver"
modprobe -r snd-soc-sof-sdw
sleep 1
echo "removing mic"
modprobe -r snd_soc_rt715_sdca
sleep 1
echo "adding mic"
modprobe snd_soc_rt715_sdca
sleep 1
echo "adding machine driver"
modprobe snd-soc-sof-sdw
sleep 1
I ended-up with a kernel oops on an IPC error.
The IPC error is bad enough in itself, the kernel oops cannot happen.
[ 459.060320] sof-audio-pci-intel-tgl 0000:00:1f.3: ipc tx error for 0x30010000 (msg/reply size: 92/20): -22
[ 459.060336] sof-audio-pci-intel-tgl 0000:00:1f.3: Failed to setup widget PCM7P
[ 459.060353] BUG: kernel NULL pointer dereference, address: 0000000000000078
[ 459.060359] #PF: supervisor read access in kernel mode
[ 459.060364] #PF: error_code(0x0000) - not-present page
[ 459.060370] PGD 0 P4D 0
[ 459.060377] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 459.060385] CPU: 1 PID: 1603 Comm: modprobe Not tainted 5.18.0-rc2-test-05255-g3ba5af85a845-dirty #179
[ 459.060393] Hardware name: Dell Inc. Latitude 9420/0208BI, BIOS 99.1.42 08/21/2020
[ 459.060397] RIP: 0010:sof_widget_free+0x13/0x270 [snd_sof]
[ 459.060441] Code: ff ff ff 0f 1f 40 00 0f 1f 44 00 00 be 01 00 00 00 e9 31 ff ff ff 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 83 ec 08 <48> 83 7e 78 00 0f 84 a0 01 00 00 48 8b 87 78 03 00 00 49 89 ff 48
[ 459.060449] RSP: 0018:ffffa81d0196f948 EFLAGS: 00010296
[ 459.060457] RAX: 0000000000000028 RBX: ffff9f3405839e80 RCX: ffff9f34148db928
[ 459.060461] RDX: 0000000000000164 RSI: 0000000000000000 RDI: ffff9f340e18c828
[ 459.060465] RBP: ffffffffc09674c0 R08: ffffffffa5f62d68 R09: 0000000000009ffb
[ 459.060468] R10: 000000000000197e R11: ffffffffa5f32d80 R12: 00000000ffffffea
[ 459.060471] R13: ffff9f340e18c828 R14: 0000000000000000 R15: 0000000000000000
[ 459.060475] FS: 00007f69171d1540(0000) GS:ffff9f377ea00000(0000) knlGS:0000000000000000
[ 459.060479] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 459.060483] CR2: 0000000000000078 CR3: 0000000142242004 CR4: 0000000000770ee0
[ 459.060486] PKRU: 55555554
[ 459.060489] Call Trace:
[ 459.060495] <TASK>
[ 459.060502] sof_widget_setup+0x28c/0x330 [snd_sof]
[ 459.060524] sof_ipc3_set_up_all_pipelines+0x91/0x1c0 [snd_sof]
[ 459.060547] ? soc_tplg_check_elem_count+0x40/0x40 [snd_soc_core]
[ 459.060584] snd_soc_tplg_component_load+0x23d/0x280 [snd_soc_core]
[ 459.060616] snd_sof_load_topology+0x5b/0xd0 [snd_sof]
[ 459.060638] sof_pcm_probe+0x4f/0x70 [snd_sof]
[ 459.060656] snd_soc_component_probe+0x1e/0x40 [snd_soc_core]
[ 459.060689] soc_probe_component+0x1d0/0x300 [snd_soc_core]
[ 459.060715] snd_soc_bind_card+0x504/0xce0 [snd_soc_core]
[ 459.060738] ? is_module_address+0x43/0x70
[ 459.060750] ? lockdep_init_map_type+0x51/0x240
[ 459.060757] ? debug_mutex_init+0x33/0x40
[ 459.060764] devm_snd_soc_register_card+0x43/0x80 [snd_soc_core]
[ 459.060796] mc_probe+0x9bb/0x1060 [snd_soc_sof_sdw]
[ 459.060813] platform_probe+0x54/0xb0
[ 459.060823] really_probe+0x199/0x380
[ 459.060831] __driver_probe_device+0xfe/0x180
[ 459.060838] driver_probe_device+0x1e/0x90
[ 459.060844] __driver_attach+0xc4/0x1d0
[ 459.060850] ? __device_attach_driver+0xe0/0xe0
[ 459.060856] ? __device_attach_driver+0xe0/0xe0
[ 459.060862] bus_for_each_dev+0x78/0xc0
[ 459.060869] bus_add_driver+0x14c/0x1f0
[ 459.060876] driver_register+0x8f/0xe0
[ 459.060884] ? 0xffffffffc0248000
[ 459.060889] do_one_initcall+0x6f/0x270
[ 459.060898] ? kmem_cache_alloc_trace+0x4f/0x210
[ 459.060907] do_init_module+0x4c/0x240
[ 459.060916] __do_sys_finit_module+0xb4/0x120
[ 459.060932] do_syscall_64+0x38/0x90
[ 459.060945] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 459.060955] RIP: 0033:0x7f691731376d
[ 459.060962] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d f3 36 0d 00 f7 d8 64 89 01 48
[ 459.060969] RSP: 002b:00007fff3d42b458 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 459.060977] RAX: ffffffffffffffda RBX: 00005584561c49c0 RCX: 00007f691731376d
[ 459.060982] RDX: 0000000000000000 RSI: 00005584561cc9e0 RDI: 0000000000000004
[ 459.060987] RBP: 0000000000040000 R08: 0000000000000000 R09: 0000000000000000
[ 459.060991] R10: 0000000000000004 R11: 0000000000000246 R12: 00005584561cc9e0
[ 459.060996] R13: 0000000000000000 R14: 00005584561c4af0 R15: 00005584561c49c0
[ 459.061004] </TASK>
[ 459.061007] Modules linked in: snd_soc_sof_sdw(+) snd_soc_intel_sof_maxim_common snd_soc_rt715_sdca snd_soc_rt711_sdca fuse snd_ctl_led ledtrig_audio snd_soc_rt1316_sdw regmap_sdw_mbq regmap_sdw snd_sof_probes snd_soc_dmic snd_sof_ipc_flood_test snd_sof_ipc_msg_injector snd_sof_pci_intel_tgl snd_sof_intel_hda_common soundwire_intel soundwire_generic_allocation soundwire_cadence snd_sof_pci snd_sof_xtensa_dsp snd_sof snd_sof_utils snd_soc_acpi_intel_match snd_soc_acpi soundwire_bus snd_soc_core snd_compress wmi_bmof snd_hda_intel snd_intel_dspcfg snd_intel_sdw_acpi snd_hda_codec snd_hwdep snd_hda_core ax88179_178a usbnet snd_pcm x86_pkg_temp_thermal snd_seq_midi snd_seq_midi_event intel_powerclamp snd_rawmidi snd_seq snd_seq_device snd_timer snd soundcore iwlmvm mei_me iwlwifi hid_multitouch mei i915 i2c_algo_bit drm_buddy processor_thermal_device_pci_legacy drm_dp_helper processor_thermal_device drm_kms_helper processor_thermal_rfim ttm processor_thermal_mbox intel_soc_dts_iosf wmi
[ 459.061130] int3403_thermal int340x_thermal_zone int3400_thermal intel_pmc_core acpi_thermal_rel squashfs drm drm_panel_orientation_quirks efivarfs intel_ishtp_hid spi_pxa2xx_platform psmouse intel_lpss_pci xhci_pci intel_lpss idma64 intel_ish_ipc mfd_core xhci_hcd intel_ishtp vmd i2c_hid_acpi i2c_hid [last unloaded: snd_soc_rt715_sdca]
[ 459.061176] CR2: 0000000000000078
[ 459.061182] ---[ end trace 0000000000000000 ]---
[ 459.061186] RIP: 0010:sof_widget_free+0x13/0x270 [snd_sof]
[ 459.061211] Code: ff ff ff 0f 1f 40 00 0f 1f 44 00 00 be 01 00 00 00 e9 31 ff ff ff 90 0f 1f 44 00 00 41 57 41 56 41 55 41 54 55 53 48 83 ec 08 <48> 83 7e 78 00 0f 84 a0 01 00 00 48 8b 87 78 03 00 00 49 89 ff 48
[ 459.061215] RSP: 0018:ffffa81d0196f948 EFLAGS: 00010296
[ 459.061219] RAX: 0000000000000028 RBX: ffff9f3405839e80 RCX: ffff9f34148db928
[ 459.061224] RDX: 0000000000000164 RSI: 0000000000000000 RDI: ffff9f340e18c828
[ 459.061229] RBP: ffffffffc09674c0 R08: ffffffffa5f62d68 R09: 0000000000009ffb
[ 459.061233] R10: 000000000000197e R11: ffffffffa5f32d80 R12: 00000000ffffffea
[ 459.061236] R13: ffff9f340e18c828 R14: 0000000000000000 R15: 0000000000000000
[ 459.061239] FS: 00007f69171d1540(0000) GS:ffff9f377ea00000(0000) knlGS:0000000000000000
[ 459.061243] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 459.061248] CR2: 0000000000000078 CR3: 0000000142242004 CR4: 0000000000770ee0
[ 459.061253] PKRU: 55555554
Activity
plbossart commentedon May 12, 2022
Another IPC error
plbossart commentedon May 16, 2022
Looks like we have 2 IPC issues, one on PIPE_NEW tracked by #3652 and the other on COMP_NEW:
sof-logger throws the following errors:
[-]SoundWire: kernel oops on IPC fail.[/-][+]SoundWire: kernel oops on COMP_NEW IPC fail.[/+]plbossart commentedon May 16, 2022
KASAN traces are not super helpful
plbossart commentedon May 16, 2022
Additional traces show that we are attempting to free a NULL swidget on IPC error
Returning -EINVAL is enough to avoid the kernel oops - but the question is why we have an IPC failure in the first place.
plbossart commentedon May 19, 2022
I cannot reproduce this with the latest changes in PR #3642
plbossart commentedon May 19, 2022
What solves this problem is the commit e760c99
ASoC: soc-component: make sure device is resumed before probe/remove
Wow. @ranj063 any ideas?
plbossart commentedon Jun 22, 2022
fixed