* [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams
@ 2012-07-08 16:25 Frank Schäfer
2012-07-08 17:43 ` Hans de Goede
0 siblings, 1 reply; 4+ messages in thread
From: Frank Schäfer @ 2012-07-08 16:25 UTC (permalink / raw)
To: linux-media
Hi,
running kernel 3.5.rc6 with the two gspca-sn9c20x webcams
0c45:62b3 Microdia PC Camera with Microphone (SN9C202 + OV9655)
0c45:6270 Microdia PC Camera (SN9C201 + MI0360/MT9V011 or
MI0360SOC/MT9V111) U-CAM PC Camera NE878, Whitcom WHC017, ...
I'm getting the following kernel oops when I start capturing with qv4l2
(and also Kopete and others):
[ 81.719973] gspca_sn9c20x: Set 640x480
[ 81.736805] BUG: unable to handle kernel NULL pointer dereference at
0000002c
[ 81.736877] IP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev]
[ 81.736901] *pdpt = 000000002c4fa001 *pde = 0000000000000000
[ 81.736922] Oops: 0000 [#1] PREEMPT SMP
[ 81.737055]
[ 81.737071] Pid: 4026, comm: qv4l2 Not tainted 3.4.0-0.1-desktop+ #19
System manufacturer System Product Name/M2N-VM DH
[ 81.737101] EIP: 0060:[<f7aebb59>] EFLAGS: 00010292 CPU: 1
[ 81.737130] EIP is at v4l2_ctrl_g_ctrl+0x9/0x50 [videodev]
[ 81.737147] EAX: 00000000 EBX: 00000000 ECX: f6c000c0 EDX: 00000001
[ 81.737165] ESI: 00000028 EDI: 00000028 EBP: f5af9c84 ESP: f5af9c7c
[ 81.737183] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[ 81.737200] CR0: 80050033 CR2: 0000002c CR3: 2c941000 CR4: 000007f0
[ 81.737219] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
[ 81.737236] DR6: ffff0ff0 DR7: 00000400
[ 81.737252] Process qv4l2 (pid: 4026, ti=f5af8000 task=f594c030
task.ti=f5af8000)
[ 81.737271] Stack:
[ 81.737290] 00000028 f61c2000 f5af9cd0 f7d1c74c 0000007f 00000000
f5af9ca4 c0586ba1
[ 81.737318] ef190444 0000007f 00000080 000001e0 00000280 00000002
00000000 02000100
[ 81.737346] 003c2800 00f000a0 f61c2000 00000000 00000000 f5af9d84
f7b682c0 f71d8bec
[ 81.737366] Call Trace:
[ 81.737390] [<f7d1c74c>] sd_start+0x2dc/0x450 [gspca_sn9c20x]
[ 81.737421] [<c0586ba1>] ? usb_alloc_coherent+0x21/0x30
[ 81.737448] [<f7b682c0>] gspca_init_transfer+0x260/0x420 [gspca_main]
[ 81.737479] [<c02ea322>] ? __alloc_pages_nodemask+0x142/0x7b0
[ 81.737504] [<f7b6926b>] vidioc_streamon+0x9b/0xb0 [gspca_main]
[ 81.737535] [<f7ae4919>] __video_do_ioctl+0x2ba9/0x5780 [videodev]
[ 81.737565] [<c031b7ee>] ? alloc_pages_current+0x8e/0x100
[ 81.737588] [<c0230998>] ? kmap_atomic_prot+0xe8/0x110
[ 81.737611] [<c04824ea>] ? __copy_from_user_ll+0x1a/0x30
[ 81.737630] [<c0482530>] ? _copy_from_user+0x30/0x50
[ 81.737656] [<f7ae1b0e>] video_usercopy+0x1de/0x270 [videodev]
[ 81.737679] [<c0309fc8>] ? mmap_region+0x1e8/0x4b0
[ 81.737706] [<f7ae1bb2>] video_ioctl2+0x12/0x20 [videodev]
[ 81.737725] [<f7ae1d70>] ? v4l2_norm_to_name+0x50/0x50 [videodev]
[ 81.737725] [<f7ae064a>] v4l2_ioctl+0xca/0x190 [videodev]
[ 81.737725] [<c030a401>] ? do_mmap_pgoff+0x171/0x2e0
[ 81.737725] [<f7ae0580>] ? v4l2_open+0x120/0x120 [videodev]
[ 81.737725] [<c0344074>] do_vfs_ioctl+0x74/0x2e0
[ 81.737725] [<c0344347>] sys_ioctl+0x67/0x80
[ 81.737725] [<c07242dd>] syscall_call+0x7/0xb
[ 81.737725] Code: 55 f0 89 02 8b 46 10 8b 40 14 e8 03 61 c3 c8 89 f8
83 c4 04 5b 5e 5f 5d c3 89 f6 8d bc 27 00 00 00 00 55 89 e5 53 89 c3 83
ec 04 <8b> 40 2c c7 45 f8 00 00 00 00 8d 50 fb 83 fa 02 77 09 80 b8 d3
[ 81.737725] EIP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev]
SS:ESP 0068:f5af9c7c
[ 81.737725] CR2: 000000000000002c
[ 81.743027] ---[ end trace 1c291740d69b151f ]---
This is a regression from kernel 3.4.x.
The causing commit seems to be
commit 63069da1c8ef0abcdb74b0ea1c461d23fb9181d9
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date: Sun May 6 09:28:29 2012 -0300
[media] gcpca_sn9c20x: Convert to the control framework
HdG: Small fix: don't register some controls for sensors which don't
have an implementation for them.
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Should I open a bug report at bugzilla, too ?
Regards,
Frank Schäfer
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams 2012-07-08 16:25 [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams Frank Schäfer @ 2012-07-08 17:43 ` Hans de Goede 2012-07-08 20:04 ` Frank Schäfer 0 siblings, 1 reply; 4+ messages in thread From: Hans de Goede @ 2012-07-08 17:43 UTC (permalink / raw) To: Frank Schäfer; +Cc: linux-media [-- Attachment #1: Type: text/plain, Size: 4280 bytes --] Hi, Thanks for reporting this! On 07/08/2012 06:25 PM, Frank Schäfer wrote: > Hi, > > running kernel 3.5.rc6 with the two gspca-sn9c20x webcams > > 0c45:62b3 Microdia PC Camera with Microphone (SN9C202 + OV9655) > 0c45:6270 Microdia PC Camera (SN9C201 + MI0360/MT9V011 or > MI0360SOC/MT9V111) U-CAM PC Camera NE878, Whitcom WHC017, ... > > I'm getting the following kernel oops when I start capturing with qv4l2 > (and also Kopete and others): > > [ 81.719973] gspca_sn9c20x: Set 640x480 > [ 81.736805] BUG: unable to handle kernel NULL pointer dereference at > 0000002c > [ 81.736877] IP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] > [ 81.736901] *pdpt = 000000002c4fa001 *pde = 0000000000000000 > [ 81.736922] Oops: 0000 [#1] PREEMPT SMP > [ 81.737055] > [ 81.737071] Pid: 4026, comm: qv4l2 Not tainted 3.4.0-0.1-desktop+ #19 > System manufacturer System Product Name/M2N-VM DH > [ 81.737101] EIP: 0060:[<f7aebb59>] EFLAGS: 00010292 CPU: 1 > [ 81.737130] EIP is at v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] > [ 81.737147] EAX: 00000000 EBX: 00000000 ECX: f6c000c0 EDX: 00000001 > [ 81.737165] ESI: 00000028 EDI: 00000028 EBP: f5af9c84 ESP: f5af9c7c > [ 81.737183] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 > [ 81.737200] CR0: 80050033 CR2: 0000002c CR3: 2c941000 CR4: 000007f0 > [ 81.737219] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 > [ 81.737236] DR6: ffff0ff0 DR7: 00000400 > [ 81.737252] Process qv4l2 (pid: 4026, ti=f5af8000 task=f594c030 > task.ti=f5af8000) > [ 81.737271] Stack: > [ 81.737290] 00000028 f61c2000 f5af9cd0 f7d1c74c 0000007f 00000000 > f5af9ca4 c0586ba1 > [ 81.737318] ef190444 0000007f 00000080 000001e0 00000280 00000002 > 00000000 02000100 > [ 81.737346] 003c2800 00f000a0 f61c2000 00000000 00000000 f5af9d84 > f7b682c0 f71d8bec > [ 81.737366] Call Trace: > [ 81.737390] [<f7d1c74c>] sd_start+0x2dc/0x450 [gspca_sn9c20x] > [ 81.737421] [<c0586ba1>] ? usb_alloc_coherent+0x21/0x30 > [ 81.737448] [<f7b682c0>] gspca_init_transfer+0x260/0x420 [gspca_main] > [ 81.737479] [<c02ea322>] ? __alloc_pages_nodemask+0x142/0x7b0 > [ 81.737504] [<f7b6926b>] vidioc_streamon+0x9b/0xb0 [gspca_main] > [ 81.737535] [<f7ae4919>] __video_do_ioctl+0x2ba9/0x5780 [videodev] > [ 81.737565] [<c031b7ee>] ? alloc_pages_current+0x8e/0x100 > [ 81.737588] [<c0230998>] ? kmap_atomic_prot+0xe8/0x110 > [ 81.737611] [<c04824ea>] ? __copy_from_user_ll+0x1a/0x30 > [ 81.737630] [<c0482530>] ? _copy_from_user+0x30/0x50 > [ 81.737656] [<f7ae1b0e>] video_usercopy+0x1de/0x270 [videodev] > [ 81.737679] [<c0309fc8>] ? mmap_region+0x1e8/0x4b0 > [ 81.737706] [<f7ae1bb2>] video_ioctl2+0x12/0x20 [videodev] > [ 81.737725] [<f7ae1d70>] ? v4l2_norm_to_name+0x50/0x50 [videodev] > [ 81.737725] [<f7ae064a>] v4l2_ioctl+0xca/0x190 [videodev] > [ 81.737725] [<c030a401>] ? do_mmap_pgoff+0x171/0x2e0 > [ 81.737725] [<f7ae0580>] ? v4l2_open+0x120/0x120 [videodev] > [ 81.737725] [<c0344074>] do_vfs_ioctl+0x74/0x2e0 > [ 81.737725] [<c0344347>] sys_ioctl+0x67/0x80 > [ 81.737725] [<c07242dd>] syscall_call+0x7/0xb > [ 81.737725] Code: 55 f0 89 02 8b 46 10 8b 40 14 e8 03 61 c3 c8 89 f8 > 83 c4 04 5b 5e 5f 5d c3 89 f6 8d bc 27 00 00 00 00 55 89 e5 53 89 c3 83 > ec 04 <8b> 40 2c c7 45 f8 00 00 00 00 8d 50 fb 83 fa 02 77 09 80 b8 d3 > [ 81.737725] EIP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] > SS:ESP 0068:f5af9c7c > [ 81.737725] CR2: 000000000000002c > [ 81.743027] ---[ end trace 1c291740d69b151f ]--- > > > This is a regression from kernel 3.4.x. > The causing commit seems to be > > > commit 63069da1c8ef0abcdb74b0ea1c461d23fb9181d9 > Author: Hans Verkuil <hans.verkuil@cisco.com> > Date: Sun May 6 09:28:29 2012 -0300 > > [media] gcpca_sn9c20x: Convert to the control framework > > HdG: Small fix: don't register some controls for sensors which don't > have an implementation for them. > > Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> > Signed-off-by: Hans de Goede <hdegoede@redhat.com> > Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> > > > Should I open a bug report at bugzilla, too ? That won't be necessary, the attached patch should fix this, can you give it a try please? Thanks, Hans [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #2: 0001-gspca_sn9c20x-Fix-NULL-pointer-dereference.patch --] [-- Type: text/x-patch; name="0001-gspca_sn9c20x-Fix-NULL-pointer-dereference.patch", Size: 1850 bytes --] >From e3d5933cf00270768b202041adf463ffc4fc9544 Mon Sep 17 00:00:00 2001 From: Hans de Goede <hdegoede@redhat.com> Date: Sun, 8 Jul 2012 19:41:14 +0200 Subject: [PATCH] gspca_sn9c20x: Fix NULL pointer dereference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Don't call v4l2_ctrl_g_ctrl on ctrls which the model cam in question does not have. Reported-by: Frank Schäfer <fschaefer.oss@googlemail.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> --- drivers/media/video/gspca/sn9c20x.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c index 6c31e46..b9c6f17 100644 --- a/drivers/media/video/gspca/sn9c20x.c +++ b/drivers/media/video/gspca/sn9c20x.c @@ -2070,10 +2070,13 @@ static int sd_start(struct gspca_dev *gspca_dev) set_gamma(gspca_dev, v4l2_ctrl_g_ctrl(sd->gamma)); set_redblue(gspca_dev, v4l2_ctrl_g_ctrl(sd->blue), v4l2_ctrl_g_ctrl(sd->red)); - set_gain(gspca_dev, v4l2_ctrl_g_ctrl(sd->gain)); - set_exposure(gspca_dev, v4l2_ctrl_g_ctrl(sd->exposure)); - set_hvflip(gspca_dev, v4l2_ctrl_g_ctrl(sd->hflip), - v4l2_ctrl_g_ctrl(sd->vflip)); + if (sd->gain) + set_gain(gspca_dev, v4l2_ctrl_g_ctrl(sd->gain)); + if (sd->exposure) + set_exposure(gspca_dev, v4l2_ctrl_g_ctrl(sd->exposure)); + if (sd->hflip) + set_hvflip(gspca_dev, v4l2_ctrl_g_ctrl(sd->hflip), + v4l2_ctrl_g_ctrl(sd->vflip)); reg_w1(gspca_dev, 0x1007, 0x20); reg_w1(gspca_dev, 0x1061, 0x03); @@ -2176,7 +2179,7 @@ static void sd_dqcallback(struct gspca_dev *gspca_dev) struct sd *sd = (struct sd *) gspca_dev; int avg_lum; - if (!v4l2_ctrl_g_ctrl(sd->autogain)) + if (sd->autogain == NULL || !v4l2_ctrl_g_ctrl(sd->autogain)) return; avg_lum = atomic_read(&sd->avg_lum); -- 1.7.10.4 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams 2012-07-08 17:43 ` Hans de Goede @ 2012-07-08 20:04 ` Frank Schäfer 2012-07-09 8:38 ` [PATCH-3.5 ] Fix sn9c20x regression (was [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams) Hans de Goede 0 siblings, 1 reply; 4+ messages in thread From: Frank Schäfer @ 2012-07-08 20:04 UTC (permalink / raw) To: Hans de Goede; +Cc: linux-media Am 08.07.2012 19:43, schrieb Hans de Goede: > Hi, > > Thanks for reporting this! > > On 07/08/2012 06:25 PM, Frank Schäfer wrote: >> Hi, >> >> running kernel 3.5.rc6 with the two gspca-sn9c20x webcams >> >> 0c45:62b3 Microdia PC Camera with Microphone (SN9C202 + OV9655) >> 0c45:6270 Microdia PC Camera (SN9C201 + MI0360/MT9V011 or >> MI0360SOC/MT9V111) U-CAM PC Camera NE878, Whitcom WHC017, ... >> >> I'm getting the following kernel oops when I start capturing with qv4l2 >> (and also Kopete and others): >> >> [ 81.719973] gspca_sn9c20x: Set 640x480 >> [ 81.736805] BUG: unable to handle kernel NULL pointer dereference at >> 0000002c >> [ 81.736877] IP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] >> [ 81.736901] *pdpt = 000000002c4fa001 *pde = 0000000000000000 >> [ 81.736922] Oops: 0000 [#1] PREEMPT SMP >> [ 81.737055] >> [ 81.737071] Pid: 4026, comm: qv4l2 Not tainted 3.4.0-0.1-desktop+ #19 >> System manufacturer System Product Name/M2N-VM DH >> [ 81.737101] EIP: 0060:[<f7aebb59>] EFLAGS: 00010292 CPU: 1 >> [ 81.737130] EIP is at v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] >> [ 81.737147] EAX: 00000000 EBX: 00000000 ECX: f6c000c0 EDX: 00000001 >> [ 81.737165] ESI: 00000028 EDI: 00000028 EBP: f5af9c84 ESP: f5af9c7c >> [ 81.737183] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 >> [ 81.737200] CR0: 80050033 CR2: 0000002c CR3: 2c941000 CR4: 000007f0 >> [ 81.737219] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 >> [ 81.737236] DR6: ffff0ff0 DR7: 00000400 >> [ 81.737252] Process qv4l2 (pid: 4026, ti=f5af8000 task=f594c030 >> task.ti=f5af8000) >> [ 81.737271] Stack: >> [ 81.737290] 00000028 f61c2000 f5af9cd0 f7d1c74c 0000007f 00000000 >> f5af9ca4 c0586ba1 >> [ 81.737318] ef190444 0000007f 00000080 000001e0 00000280 00000002 >> 00000000 02000100 >> [ 81.737346] 003c2800 00f000a0 f61c2000 00000000 00000000 f5af9d84 >> f7b682c0 f71d8bec >> [ 81.737366] Call Trace: >> [ 81.737390] [<f7d1c74c>] sd_start+0x2dc/0x450 [gspca_sn9c20x] >> [ 81.737421] [<c0586ba1>] ? usb_alloc_coherent+0x21/0x30 >> [ 81.737448] [<f7b682c0>] gspca_init_transfer+0x260/0x420 >> [gspca_main] >> [ 81.737479] [<c02ea322>] ? __alloc_pages_nodemask+0x142/0x7b0 >> [ 81.737504] [<f7b6926b>] vidioc_streamon+0x9b/0xb0 [gspca_main] >> [ 81.737535] [<f7ae4919>] __video_do_ioctl+0x2ba9/0x5780 [videodev] >> [ 81.737565] [<c031b7ee>] ? alloc_pages_current+0x8e/0x100 >> [ 81.737588] [<c0230998>] ? kmap_atomic_prot+0xe8/0x110 >> [ 81.737611] [<c04824ea>] ? __copy_from_user_ll+0x1a/0x30 >> [ 81.737630] [<c0482530>] ? _copy_from_user+0x30/0x50 >> [ 81.737656] [<f7ae1b0e>] video_usercopy+0x1de/0x270 [videodev] >> [ 81.737679] [<c0309fc8>] ? mmap_region+0x1e8/0x4b0 >> [ 81.737706] [<f7ae1bb2>] video_ioctl2+0x12/0x20 [videodev] >> [ 81.737725] [<f7ae1d70>] ? v4l2_norm_to_name+0x50/0x50 [videodev] >> [ 81.737725] [<f7ae064a>] v4l2_ioctl+0xca/0x190 [videodev] >> [ 81.737725] [<c030a401>] ? do_mmap_pgoff+0x171/0x2e0 >> [ 81.737725] [<f7ae0580>] ? v4l2_open+0x120/0x120 [videodev] >> [ 81.737725] [<c0344074>] do_vfs_ioctl+0x74/0x2e0 >> [ 81.737725] [<c0344347>] sys_ioctl+0x67/0x80 >> [ 81.737725] [<c07242dd>] syscall_call+0x7/0xb >> [ 81.737725] Code: 55 f0 89 02 8b 46 10 8b 40 14 e8 03 61 c3 c8 89 f8 >> 83 c4 04 5b 5e 5f 5d c3 89 f6 8d bc 27 00 00 00 00 55 89 e5 53 89 c3 83 >> ec 04 <8b> 40 2c c7 45 f8 00 00 00 00 8d 50 fb 83 fa 02 77 09 80 b8 d3 >> [ 81.737725] EIP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] >> SS:ESP 0068:f5af9c7c >> [ 81.737725] CR2: 000000000000002c >> [ 81.743027] ---[ end trace 1c291740d69b151f ]--- >> >> >> This is a regression from kernel 3.4.x. >> The causing commit seems to be >> >> >> commit 63069da1c8ef0abcdb74b0ea1c461d23fb9181d9 >> Author: Hans Verkuil <hans.verkuil@cisco.com> >> Date: Sun May 6 09:28:29 2012 -0300 >> >> [media] gcpca_sn9c20x: Convert to the control framework >> >> HdG: Small fix: don't register some controls for sensors which >> don't >> have an implementation for them. >> >> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> >> Signed-off-by: Hans de Goede <hdegoede@redhat.com> >> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> >> >> >> Should I open a bug report at bugzilla, too ? > > That won't be necessary, the attached patch should fix this, can you > give it a try please? Thank you Hans, I can confirm that your patch fixes the oops for both devices. Regards, Frank > > Thanks, > > Hans ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH-3.5 ] Fix sn9c20x regression (was [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams) 2012-07-08 20:04 ` Frank Schäfer @ 2012-07-09 8:38 ` Hans de Goede 0 siblings, 0 replies; 4+ messages in thread From: Hans de Goede @ 2012-07-09 8:38 UTC (permalink / raw) To: Linus Torvalds; +Cc: Frank Schäfer, linux-media, Mauro Carvalho Chehab [-- Attachment #1: Type: text/plain, Size: 4895 bytes --] Hi Linus, I'm sending this patch (attached) directly to you, since it fixes a regression in 3.5-rc6, and Mauro is on vacation. Please add this to the next 3.5 rc. Thanks & Regards, Hans On 07/08/2012 10:04 PM, Frank Schäfer wrote: > Am 08.07.2012 19:43, schrieb Hans de Goede: >> Hi, >> >> Thanks for reporting this! >> >> On 07/08/2012 06:25 PM, Frank Schäfer wrote: >>> Hi, >>> >>> running kernel 3.5.rc6 with the two gspca-sn9c20x webcams >>> >>> 0c45:62b3 Microdia PC Camera with Microphone (SN9C202 + OV9655) >>> 0c45:6270 Microdia PC Camera (SN9C201 + MI0360/MT9V011 or >>> MI0360SOC/MT9V111) U-CAM PC Camera NE878, Whitcom WHC017, ... >>> >>> I'm getting the following kernel oops when I start capturing with qv4l2 >>> (and also Kopete and others): >>> >>> [ 81.719973] gspca_sn9c20x: Set 640x480 >>> [ 81.736805] BUG: unable to handle kernel NULL pointer dereference at >>> 0000002c >>> [ 81.736877] IP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] >>> [ 81.736901] *pdpt = 000000002c4fa001 *pde = 0000000000000000 >>> [ 81.736922] Oops: 0000 [#1] PREEMPT SMP >>> [ 81.737055] >>> [ 81.737071] Pid: 4026, comm: qv4l2 Not tainted 3.4.0-0.1-desktop+ #19 >>> System manufacturer System Product Name/M2N-VM DH >>> [ 81.737101] EIP: 0060:[<f7aebb59>] EFLAGS: 00010292 CPU: 1 >>> [ 81.737130] EIP is at v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] >>> [ 81.737147] EAX: 00000000 EBX: 00000000 ECX: f6c000c0 EDX: 00000001 >>> [ 81.737165] ESI: 00000028 EDI: 00000028 EBP: f5af9c84 ESP: f5af9c7c >>> [ 81.737183] DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068 >>> [ 81.737200] CR0: 80050033 CR2: 0000002c CR3: 2c941000 CR4: 000007f0 >>> [ 81.737219] DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000 >>> [ 81.737236] DR6: ffff0ff0 DR7: 00000400 >>> [ 81.737252] Process qv4l2 (pid: 4026, ti=f5af8000 task=f594c030 >>> task.ti=f5af8000) >>> [ 81.737271] Stack: >>> [ 81.737290] 00000028 f61c2000 f5af9cd0 f7d1c74c 0000007f 00000000 >>> f5af9ca4 c0586ba1 >>> [ 81.737318] ef190444 0000007f 00000080 000001e0 00000280 00000002 >>> 00000000 02000100 >>> [ 81.737346] 003c2800 00f000a0 f61c2000 00000000 00000000 f5af9d84 >>> f7b682c0 f71d8bec >>> [ 81.737366] Call Trace: >>> [ 81.737390] [<f7d1c74c>] sd_start+0x2dc/0x450 [gspca_sn9c20x] >>> [ 81.737421] [<c0586ba1>] ? usb_alloc_coherent+0x21/0x30 >>> [ 81.737448] [<f7b682c0>] gspca_init_transfer+0x260/0x420 >>> [gspca_main] >>> [ 81.737479] [<c02ea322>] ? __alloc_pages_nodemask+0x142/0x7b0 >>> [ 81.737504] [<f7b6926b>] vidioc_streamon+0x9b/0xb0 [gspca_main] >>> [ 81.737535] [<f7ae4919>] __video_do_ioctl+0x2ba9/0x5780 [videodev] >>> [ 81.737565] [<c031b7ee>] ? alloc_pages_current+0x8e/0x100 >>> [ 81.737588] [<c0230998>] ? kmap_atomic_prot+0xe8/0x110 >>> [ 81.737611] [<c04824ea>] ? __copy_from_user_ll+0x1a/0x30 >>> [ 81.737630] [<c0482530>] ? _copy_from_user+0x30/0x50 >>> [ 81.737656] [<f7ae1b0e>] video_usercopy+0x1de/0x270 [videodev] >>> [ 81.737679] [<c0309fc8>] ? mmap_region+0x1e8/0x4b0 >>> [ 81.737706] [<f7ae1bb2>] video_ioctl2+0x12/0x20 [videodev] >>> [ 81.737725] [<f7ae1d70>] ? v4l2_norm_to_name+0x50/0x50 [videodev] >>> [ 81.737725] [<f7ae064a>] v4l2_ioctl+0xca/0x190 [videodev] >>> [ 81.737725] [<c030a401>] ? do_mmap_pgoff+0x171/0x2e0 >>> [ 81.737725] [<f7ae0580>] ? v4l2_open+0x120/0x120 [videodev] >>> [ 81.737725] [<c0344074>] do_vfs_ioctl+0x74/0x2e0 >>> [ 81.737725] [<c0344347>] sys_ioctl+0x67/0x80 >>> [ 81.737725] [<c07242dd>] syscall_call+0x7/0xb >>> [ 81.737725] Code: 55 f0 89 02 8b 46 10 8b 40 14 e8 03 61 c3 c8 89 f8 >>> 83 c4 04 5b 5e 5f 5d c3 89 f6 8d bc 27 00 00 00 00 55 89 e5 53 89 c3 83 >>> ec 04 <8b> 40 2c c7 45 f8 00 00 00 00 8d 50 fb 83 fa 02 77 09 80 b8 d3 >>> [ 81.737725] EIP: [<f7aebb59>] v4l2_ctrl_g_ctrl+0x9/0x50 [videodev] >>> SS:ESP 0068:f5af9c7c >>> [ 81.737725] CR2: 000000000000002c >>> [ 81.743027] ---[ end trace 1c291740d69b151f ]--- >>> >>> >>> This is a regression from kernel 3.4.x. >>> The causing commit seems to be >>> >>> >>> commit 63069da1c8ef0abcdb74b0ea1c461d23fb9181d9 >>> Author: Hans Verkuil <hans.verkuil@cisco.com> >>> Date: Sun May 6 09:28:29 2012 -0300 >>> >>> [media] gcpca_sn9c20x: Convert to the control framework >>> >>> HdG: Small fix: don't register some controls for sensors which >>> don't >>> have an implementation for them. >>> >>> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> >>> Signed-off-by: Hans de Goede <hdegoede@redhat.com> >>> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com> >>> >>> >>> Should I open a bug report at bugzilla, too ? >> >> That won't be necessary, the attached patch should fix this, can you >> give it a try please? > > Thank you Hans, I can confirm that your patch fixes the oops for both > devices. > > Regards, > Frank > > > >> >> Thanks, >> >> Hans > > [-- Warning: decoded text below may be mangled, UTF-8 assumed --] [-- Attachment #2: 0001-gspca_sn9c20x-Fix-NULL-pointer-dereference.patch --] [-- Type: text/x-patch; name="0001-gspca_sn9c20x-Fix-NULL-pointer-dereference.patch", Size: 1850 bytes --] >From e3d5933cf00270768b202041adf463ffc4fc9544 Mon Sep 17 00:00:00 2001 From: Hans de Goede <hdegoede@redhat.com> Date: Sun, 8 Jul 2012 19:41:14 +0200 Subject: [PATCH] gspca_sn9c20x: Fix NULL pointer dereference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Don't call v4l2_ctrl_g_ctrl on ctrls which the model cam in question does not have. Reported-by: Frank Schäfer <fschaefer.oss@googlemail.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> --- drivers/media/video/gspca/sn9c20x.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c index 6c31e46..b9c6f17 100644 --- a/drivers/media/video/gspca/sn9c20x.c +++ b/drivers/media/video/gspca/sn9c20x.c @@ -2070,10 +2070,13 @@ static int sd_start(struct gspca_dev *gspca_dev) set_gamma(gspca_dev, v4l2_ctrl_g_ctrl(sd->gamma)); set_redblue(gspca_dev, v4l2_ctrl_g_ctrl(sd->blue), v4l2_ctrl_g_ctrl(sd->red)); - set_gain(gspca_dev, v4l2_ctrl_g_ctrl(sd->gain)); - set_exposure(gspca_dev, v4l2_ctrl_g_ctrl(sd->exposure)); - set_hvflip(gspca_dev, v4l2_ctrl_g_ctrl(sd->hflip), - v4l2_ctrl_g_ctrl(sd->vflip)); + if (sd->gain) + set_gain(gspca_dev, v4l2_ctrl_g_ctrl(sd->gain)); + if (sd->exposure) + set_exposure(gspca_dev, v4l2_ctrl_g_ctrl(sd->exposure)); + if (sd->hflip) + set_hvflip(gspca_dev, v4l2_ctrl_g_ctrl(sd->hflip), + v4l2_ctrl_g_ctrl(sd->vflip)); reg_w1(gspca_dev, 0x1007, 0x20); reg_w1(gspca_dev, 0x1061, 0x03); @@ -2176,7 +2179,7 @@ static void sd_dqcallback(struct gspca_dev *gspca_dev) struct sd *sd = (struct sd *) gspca_dev; int avg_lum; - if (!v4l2_ctrl_g_ctrl(sd->autogain)) + if (sd->autogain == NULL || !v4l2_ctrl_g_ctrl(sd->autogain)) return; avg_lum = atomic_read(&sd->avg_lum); -- 1.7.10.4 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-07-09 8:37 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-07-08 16:25 [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams Frank Schäfer 2012-07-08 17:43 ` Hans de Goede 2012-07-08 20:04 ` Frank Schäfer 2012-07-09 8:38 ` [PATCH-3.5 ] Fix sn9c20x regression (was [regression 3.4->3.5, bisected] kernel oops when starting capturing from gspca-sn9c20x webcams) Hans de Goede
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.