Repository navigation
check for null pointer dereferences while unloading topology #780
Description
Now that we also remove the topology components that were previously loaded in case of error while loading topology, we need to make sure the pointers are valid while unloading. An example as noted by @keyonjie below. host comp loading fails but while unloading topology, we run into a null pointer derefence in link_unload because the dai_config was never created.
[ 4.557335] sof-audio-pci 0000:00:0e.0: ipc tx: 0x30010000: GLB_TPLG_MSG: COMP_NEW
[ 4.557518] sof-audio-pci 0000:00:0e.0: error: ipc error for 0x30010000 size 20
[ 4.557522] sof-audio-pci 0000:00:0e.0: error: DSP failed to add widget id 0 type 23 name : PCM1P stream Passthrough Playback 1 reply -22
[ 4.557526] sof-audio-pci 0000:00:0e.0: ASoC: failed to load widget PCM1P
[ 4.557548] BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
[ 4.557550] #PF error: [normal kernel read fault]
[ 4.557551] PGD 0 P4D 0
[ 4.557554] Oops: 0000 [#1] SMP PTI
[ 4.557557] CPU: 0 PID: 12 Comm: kworker/0:1 Not tainted 5.0.0+ #194
[ 4.557559] Hardware name: Google Bobba/Bobba, BIOS Google_Bobba.11825.0.2019_03_06_2015 03/06/2019
[ 4.557566] Workqueue: events deferred_probe_work_func
[ 4.557575] RIP: 0010:sof_link_unload+0xc3/0x1a0 [snd_sof]
[ 4.557577] Code: ff ff 48 8b 55 d0 65 48 33 14 25 28 00 00 00 89 c8 0f 85 e5 00 00 00 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 43 60 <8b> 50 08 83 fa 01 0f 82 89 00 00 00 83 fa 02 76 c7 83 fa 03 89 4d
[ 4.557578] RSP: 0018:ffffb2c7800739f8 EFLAGS: 00010246
[ 4.557580] RAX: 0000000000000000 RBX: ffffa01e36fe9400 RCX: 0000000000000000
[ 4.557581] RDX: 0000000000000009 RSI: ffffffffc0bda98e RDI: ffffffffc0bda98e
[ 4.557582] RBP: ffffb2c780073a48 R08: 0000000000000000 R09: 00000000000004cd
[ 4.557584] R10: ffffb2c780e4d863 R11: ffffb2c780073738 R12: ffffa01e36ec8b60
[ 4.557585] R13: ffffffffc0bda983 R14: ffffffffc0bdbcc0 R15: ffffa01e36ec8818
[ 4.557586] FS: 0000000000000000(0000) GS:ffffa01e3fc00000(0000) knlGS:0000000000000000
[ 4.557588] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.557589] CR2: 0000000000000008 CR3: 00000001742a4000 CR4: 0000000000340ef0
[ 4.557590] Call Trace:
[ 4.557609] snd_soc_tplg_component_remove+0x4a6/0x4e0 [snd_soc_core]
[ 4.557613] ? assign_fw+0x6f/0x170
[ 4.557623] snd_soc_tplg_component_load+0xcc/0xe0 [snd_soc_core]
[ 4.557629] snd_sof_load_topology+0x6f/0xe0 [snd_sof]
[ 4.557634] sof_pcm_probe+0x53/0xc0 [snd_sof]
[ 4.557643] soc_probe_component+0x292/0x450 [snd_soc_core]
[ 4.557652] snd_soc_instantiate_card+0x5d4/0xe30 [snd_soc_core]
[ 4.557662] snd_soc_register_card+0x257/0x280 [snd_soc_core]
[ 4.557671] devm_snd_soc_register_card+0x41/0x80 [snd_soc_core]
[ 4.557675] broxton_audio_probe+0x18b/0x1b0 [snd_soc_sst_bxt_da7219_max98357a]
[ 4.557678] platform_drv_probe+0x3f/0xa0
[ 4.557680] ? driver_sysfs_add+0x7e/0xe0
[ 4.557682] really_probe+0xfe/0x3f0
[ 4.557684] driver_probe_device+0x11a/0x130
[ 4.557687] __device_attach_driver+0x86/0x100
[ 4.557689] ? __driver_attach+0x110/0x110
[ 4.557690] bus_for_each_drv+0x6b/0xb0
[ 4.557693] __device_attach+0xdd/0x160
[ 4.557695] device_initial_probe+0x13/0x20
[ 4.557697] bus_probe_device+0x95/0xa0
[ 4.557699] deferred_probe_work_func+0x79/0xc0
[ 4.557703] process_one_work+0x1f7/0x3f0
[ 4.557705] worker_thread+0x34/0x400
[ 4.557707] kthread+0x121/0x140
[ 4.557709] ? process_one_work+0x3f0/0x3f0
[ 4.557711] ? kthread_park+0x90/0x90
[ 4.557714] ret_from_fork+0x1f/0x40
[ 4.557716] Modules linked in: snd_soc_sst_bxt_da7219_max98357a snd_soc_hdac_hdmi snd_soc_dmic hid_rmi(+) rmi_core spi_pxa2xx_platform 8250_dw joydev nls_iso8859_1 intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel arc4 kvm irqbypass crc32_pclmul aesni_intel sof_pci_dev aes_x86_64 snd_sof_intel_hda_common crypto_simd iwlmvm cryptd snd_sof_intel_hda glue_helper snd_soc_acpi_intel_match snd_sof uvcvideo snd_soc_max98357a mac80211 snd_sof_xtensa_dsp snd_soc_da7219 snd_soc_acpi btusb snd_hda_ext_core videobuf2_vmalloc btrtl serio_raw videobuf2_memops snd_seq_midi snd_hda_core btbcm btintel snd_seq_midi_event videobuf2_v4l2 snd_soc_core bluetooth lpc_ich videobuf2_common asix snd_pcm_dmaengine snd_rawmidi usbnet videodev mii input_leds media snd_pcm ecdh_generic iwlwifi snd_seq cfg80211 snd_seq_device idma64 virt_dma cros_ec_lpcs snd_timer processor_thermal_device intel_lpss_pci intel_lpss cros_ec_core snd intel_soc_dts_iosf acpi_als kfifo_buf soundcore int3403_thermal
[ 4.557757] elants_i2c gpio_keys elan_i2c industrialio int340x_thermal_zone mac_hid int3400_thermal acpi_thermal_rel intel_pmc_ipc chromeos_pstore sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 hid_generic usbhid mmc_block sdhci_pci cqhci sdhci i2c_hid hid i915 video i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm
[ 4.557781] CR2: 0000000000000008
[ 4.557784] ---[ end trace 2bf34be106566261 ]---
[ 4.557789] RIP: 0010:sof_link_unload+0xc3/0x1a0 [snd_sof]
[ 4.557791] Code: ff ff 48 8b 55 d0 65 48 33 14 25 28 00 00 00 89 c8 0f 85 e5 00 00 00 48 83 c4 28 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 43 60 <8b> 50 08 83 fa 01 0f 82 89 00 00 00 83 fa 02 76 c7 83 fa 03 89 4d
[ 4.557792] RSP: 0018:ffffb2c7800739f8 EFLAGS: 00010246
[ 4.557794] RAX: 0000000000000000 RBX: ffffa01e36fe9400 RCX: 0000000000000000
[ 4.557795] RDX: 0000000000000009 RSI: ffffffffc0bda98e RDI: ffffffffc0bda98e
[ 4.557796] RBP: ffffb2c780073a48 R08: 0000000000000000 R09: 00000000000004cd
[ 4.557798] R10: ffffb2c780e4d863 R11: ffffb2c780073738 R12: ffffa01e36ec8b60
[ 4.557799] R13: ffffffffc0bda983 R14: ffffffffc0bdbcc0 R15: ffffa01e36ec8818
[ 4.557801] FS: 0000000000000000(0000) GS:ffffa01e3fc00000(0000) knlGS:0000000000000000
[ 4.557802] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.557803] CR2: 0000000000000008 CR3: 00000001742a4000 CR4: 0000000000340ef0
Activity
stripes416 commentedon Apr 12, 2019
@ranj063 How can I reproduce this? Are you using GLK?
ranj063 commentedon Apr 12, 2019
@stripes416 you can reproduce this error is by introducing a fake error in all the load callbacks in topology.c and see if we hit the null pointer dereference when the tplg is unloaded because of the error.
stripes416 commentedon Apr 12, 2019
@ranj063 Thanks!
ClarexZhou commentedon May 14, 2019
Error occurred on CML laptop during modules reloaded stress test, after 39 times modules reload. sof_pci_dev Used is changed to -1. And dmesg as below:
reloadDmesg.log
Environment
Rander UCM https://github.com/RanderWang/intel-UCM
Kernel repo：3cfd789 https://github.com/thesofproject/linux/tree/release/sof-v5.0
Firmware repo: 3f1b929 https://github.com/thesofproject/sof/commits/master |
Topology: https://github.com/thesofproject/sof/commits/master . Same as above SOF repo
file: tools/topology/sof-hda-generic.m4, sof-hda-generic-2ch.tplg
plbossart commentedon Jan 17, 2020
@ranj063 @ClarexZhou that looks like an obsolete issue with all the asoc core cleanups? Can we close?
ClarexZhou commentedon Jan 17, 2020
Close. For original issue not seen on both sof-dev and release/sof-v5.0 fb3a8e4.
net: pktgen: fix code style (WARNING: Missing a blank line after decl…