"Kernel Panic" run 'soft/kmod_scripts/sof_bootone.sh' cause kernel panic on BYT with sof-byt-rt5651.tplg

System Environment:
Kernel repo: topic/sof-dev: 46b7b64
soft repo: topic/master: cfff9e0
using the tplg: sof-byt-rt5651.tplg

Reproduce step:
run the "soft/kmod_scripts/sof_bootone.sh" script, that means do the module reload one time.
the panic will be hit.

the log:
dmesg.txt

Are you saying the kernel oops happens in the chunk of code below?
If yes, can you try and protect the dereferences when kcontrols is NULL?

if (dobj->widget.kcontrol_type == SND_SOC_TPLG_TYPE_ENUM) {
/* enumerated widget mixer */
for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) {
struct snd_kcontrol *kcontrol = w->kcontrols[i];
struct soc_enum *se =
(struct soc_enum *)kcontrol->private_value;
int j;

		snd_ctl_remove(card, kcontrol);

		kfree(se->dobj.control.dvalues);
		for (j = 0; j < se->items; j++)
			kfree(se->dobj.control.dtexts[j]);

		kfree(se);
		kfree(w->kcontrol_news[i].name);
	}
} else {
	/* volume mixer or bytes controls */
	for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) {
		struct snd_kcontrol *kcontrol = w->kcontrols[i];

		if (dobj->widget.kcontrol_type
		    == SND_SOC_TPLG_TYPE_MIXER)
			kfree(kcontrol->tlv.p);

		/* Private value is used as struct soc_mixer_control
		 * for volume mixers or soc_bytes_ext for bytes
		 * controls.
		 */
		kfree((void *)kcontrol->private_value);
		snd_ctl_remove(card, kcontrol);
		kfree(w->kcontrol_news[i].name);
	}
}

Thanks. Since this is going to touch non-SOF code in soc-topology, we'll have to be more generic and check what happens for other widgets as well, not just the control ones.
Alternatively we'd want to bail when the unknown binding is found, that might actually be a better way of doing things?

@zhigang-wu

@zhigang-wu please try and switch on the kernel memory debugging tools (under kconfig debug options). This will mean a kernel rebuild, but it does help to shed light on any double frees or use after free issues.

@stevyan

@stevyan @markyang Could you help to check if this issue is gone with fixing of #144 by #311?

Summary:
This issue cannot be reproduced on BYT with ALC5651 using the build on Dec 7
There is no Kernel Panic, both arecord and aplay worked fine.

Test steps:

kmod_scripts/sof_bootone.sh
arecord -Dhw:0,0 -c2 -fS16_LE -vv -i ~/mytest.wav #OK
aplay -Dhw:0,0 -c2 -fS16_LE -vv -i ~/mytest.wav #OK

Test env:
sof master: b5d6c71 #Dec 7
kernel sof-dev: a71221d #Dec 7
tplg: test-ssp2-mclk-0-I2S-volume-s16le-s16le-48k-19200k-codec.tplg

btrfs: discard: add missing put when grabbing block group from unused…

mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish()

can: isotp: isotp_sendmsg(): add result check for wait_event_interrup…

ASoC: dwc: move DMA init to snd_soc_dai_driver probe()

drm/v3d: Free the job and assign it to NULL if initialization fails

Merge pull request thesofproject#68 from namjaejeon/cifsd-for-next

spi: spi-imx: fix sparse warning: add identifier name to function def…

ARM: 9277/1: Make the dumped instructions are consistent with the dis…

netlink: avoid infinite retry looping in netlink_unicast()

Navigation Menu

Repository navigation

"Kernel Panic" run 'soft/kmod_scripts/sof_bootone.sh' cause kernel panic on BYT with sof-byt-rt5651.tplg #68

6 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

"Kernel Panic" run 'soft/kmod_scripts/sof_bootone.sh' cause kernel panic on BYT with sof-byt-rt5651.tplg #68

Description

Activity

plbossart commented on Aug 8, 2018

plbossart commented on Aug 8, 2018

lgirdwood commented on Aug 8, 2018

6 remaining items

mengdonglin commented on Dec 11, 2018

markyang commented on Dec 12, 2018

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions