how to crash 2.4.4 w/SBLive

how to crash 2.4.4 w/SBLive

[John Lenton]

I found to my dismay that it's extremely easy to crash 2.4.4 if
it has a Live! in it. I have no way of getting at the oops, but
somebody out there probably has both this soundcard and a serial
console (or somethin').
I present it in the form of a script, but you'll probably have
no problem realizing where the problem is. The number of
"writers" never gets past 64. I guess the 65th should probably
get the same as the 2nd writer does on other cards...

As usual, let me know if this is useless without the lspci
--more-magic thing.

Cheers,
j.

----
#!/bin/sh

setup () {
	dd bs=1M count=10 </dev/urandom >/tmp/noise 2> /dev/null
}

noise () {
	cat /tmp/noise > /dev/dsp &
}

setup
i=0
while (noise); do
	i=$(( $i+1 ))
	echo $i
done
----


__________________________________________________
Do You Yahoo!?
Yahoo! Auctions - buy the things you want at great prices
http://auctions.yahoo.com/

Re: how to crash 2.4.4 w/SBLive

[Bill Pringlemeir]

>>>>> "John" == John Lenton <jlenton@yahoo.com> writes:

 John> I found to my dismay that it's extremely easy to crash 2.4.4 if
 John> it has a Live! in it. I have no way of getting at the oops, but
 John> somebody out there probably has both this soundcard and a
 John> serial console (or somethin').  I present it in the form of a
 John> script, but you'll probably have no problem realizing where the
 John> problem is. The number of "writers" never gets past 64. I guess
 John> the 65th should probably get the same as the 2nd writer does on
 John> other cards...

Extremely easy is relative.  At any rate, Alan Cox has some patches
that list fixes in the SBLive support (a memory leak).  I have ac13
installed and I ran your script.  I was able to get `Oops' messages,
and I found them in my dmesg.  I am unfamiliar with how I should use
ksyms to decode this for people... Are these physical addresses or
virtual?  I guess I should look at the source...  Anyways, the script
does *work* but not as advertised ;-)

fwiw,
Bill Pringlemeir.

inting eip:
c01caa92
*pde = 00000000
Oops: 0002
CPU:    0
EIP:    0010:[<c01caa92>]
EFLAGS: 00010097
eax: dfdfdfdf   ebx: ffffffff   ecx: c31f8f0c   edx: dfdfdfdf
esi: c11d8000   edi: c11d8000   ebp: 00000097   esp: c39e5f38
ds: 0018   es: 0018   ss: 0018
Process cat (pid: 3424, stackpage=c39e5000)
Stack: c31f8e00 c11d8000 c09c0d00 00000000 dfdfdfdf c01c7957 c11d8000 c31f8e78 
       c09c0d00 c31f8e00 c11d8000 c01c78fa c09c0d00 00000246 c31f8e00 00001000 
       c01c400a c09c0d00 ffffffea c278e7e0 00001000 00000000 00001000 c39e4000 
Call Trace: [<dfdfdfdf>] [<c01c7957>] [<c01c78fa>] [<c01c400a>] [<c0130196>] 
   [<c0106b73>] 

Code: 89 50 04 89 02 8b 97 70 40 00 00 8d b7 70 40 00 00 89 54 24 
 <1>Unable to handle kernel paging request at virtual address 00008004
 printing eip:
c01caa92
*pde = 00000000
Oops: 0002
CPU:    0
EIP:    0010:[<c01caa92>]
EFLAGS: 00010086
eax: 00008000   ebx: ffffffff   ecx: c365b10c   edx: 00000001
esi: c11d8000   edi: c11d8000   ebp: 00000086   esp: c301ff38
ds: 0018   es: 0018   ss: 0018
Process cat (pid: 3426, stackpage=c301f000)
Stack: c365b000 c11d8000 c09c0ce0 00000000 00000001 c01c7957 c11d8000 c365b078 
       c09c0ce0 c365b000 c11d8000 c01c78fa c09c0ce0 00000246 c365b000 00001000 
       c01c400a c09c0ce0 ffffffea c278e840 00001000 00000000 00001000 c301e000 
Call Trace: [<c01c7957>] [<c01c78fa>] [<c01c400a>] [<c0130196>] [<c0106b73>] 

Code: 89 50 04 89 02 8b 97 70 40 00 00 8d b7 70 40 00 00 89 54 24 
 <1>Unable to handle kernel NULL pointer dereference at virtual address 00000004
 

Re: how to crash 2.4.4 w/SBLive

[Bill Pringlemeir]

>>>>> "John" == John Lenton <jlenton@yahoo.com> writes:
 John> I found to my dismay that it's extremely easy to crash 2.4.4 if
 John> it has a Live! in it. I have no way of getting at the oops, but
 John> somebody out there probably has both this soundcard and a
 John> serial console (or somethin').  I present it in the form of a
 John> script, but you'll probably have no problem realizing where the
 John> problem is. The number of "writers" never gets past 64. I guess
 John> the 65th should probably get the same as the 2nd writer does on
 John> other cards...

I have retried this Oops with 2.4.4-ac17.  I have the ksymoops'ed file.
The error is happening in "linux/drivers/sound/emu10k1/timer.c".  The
function `emu10k1_timer_uninstall' has the following code,

          list_del(&timer->list);

Which are the generic kernel list manipulation functions.  The `next'
element is NULL and when the statement `next->prev = prev;' is
executed, the processor tries to access 4(NULL) in kernel mode.  My
guess is that some sort of race condition is happening and `next' is
NULL when it shouldn't be; but what do I know...

Here is an objdump --disassemble --source --line...

     174:   fa                      cli
    /usr/src/linux-2.4.4/include/linux/list.h:82
     * the prev/next entries already!
     */
    static __inline__ void __list_del(struct list_head * prev,
                                      struct list_head * next)
    {
     175:   8b 52 04                movl   0x4(%edx),%edx
     178:   89 54 24 10             movl   %edx,0x10(%esp,1)
     17c:   8b 54 24 1c             movl   0x1c(%esp,1),%edx
     180:   8b 02                   movl   (%edx),%eax
    /usr/src/linux-2.4.4/include/linux/list.h:83
            next->prev = prev;
     182:   8b 54 24 10             movl   0x10(%esp,1),%edx
     186:   89 50 04                movl   %edx,0x4(%eax)

***** Oops is here ^^^^^^^^^^

    /usr/src/linux-2.4.4/include/linux/list.h:84
            prev->next = next;
     189:   89 02                   movl   %eax,(%edx)
    /usr/src/linux-2.4.4/drivers/sound/emu10k1/timer.c:121

            list_del(&timer->list);

            list_for_each(entry, &card->timers) {
     18b:   8b 97 70 40 00 00       movl   0x4070(%edi),%edx
     191:   8d b7 70 40 00 00       leal   0x4070(%edi),%esi

I looked in list.h for a `safe' list delete, where next is checked for
NULL.  Should the driver check this before calling `list_delete'?

Here is the opps again,

 Unable to handle kernel NULL pointer dereference at virtual address 00000004
 printing eip: c01caa92
 *pde = 00000000
 Oops: 0002
 CPU:    0
 EIP:    0010:[emu10k1_timer_uninstall+50/236]
 EFLAGS: 00010097
 eax: 00000000   ebx: ffffffff   ecx: c3a9350c   edx: 00000000
 esi: c11d8000   edi: c11d8000   ebp: 00000097   esp: c3909f38
 ds: 0018   es: 0018   ss: 0018
 Process cat (pid: 872, stackpage=c3909000)
 Stack: c3a93400 c11d8000 c2089ba0 00000000 00000000 c01c7957 c11d8000 c3a93478
        c2089ba0 c3a93400 c11d8000 c01c78fa c2089ba0 00000246 c3a93400 00001000
        c01c400a c2089ba0 ffffffea c15d6200 00001000 00000000 00001000 c3908000
 Call Trace: [emu10k1_waveout_close+27/60]
             [emu10k1_waveout_open+102/168]
             [emu10k1_audio_write+190/456]
             [sys_write+142/196]
             [system_call+51/64]

 Code: 89 50 04 89 02 8b 97 70 40 00 00 8d b7 70 40 00 00 89 54 24

And the script,

     #!/bin/sh

     setup () {
             dd bs=1M count=10 </dev/urandom >/tmp/noise 2> /dev/null
     }

     noise () {
             cat /tmp/noise > /dev/dsp &
     }

     setup
     i=0
     while (noise); do
             i=$(( $i+1 ))
             echo $i
     done

thanks,
Bill

ps, There is no FAQ entry on how to generate a single object with `-g'.  I
ended up recompiling my whole tree!

Re: how to crash 2.4.4 w/SBLive

[Keith Owens]

On 28 May 2001 19:38:59 -0400, 
Bill Pringlemeir <bpringle@sympatico.ca> wrote:
>ps, There is no FAQ entry on how to generate a single object with `-g'.  I
>ended up recompiling my whole tree!

I would say "read the source, Luke" but Makefile and Rules.make is so
convoluted and twisted that it gives you a headache following the rule
interactions.  Edit drivers/sound/emu10k1/Makefile

CFLAGS_timer.o += -g	 for one file or
EXTRA_CFLAGS += -g	 for all files in the directory.

With the 2.5 makefile rewrite you will be able to do

make EXTRA_CFLAGS_drivers/sound/emu10k1.o=-g	 for just one file or
make EXTRA_CFLAGS_drivers/sound=-g		 for all files in directory.

No need to edit the Makefiles to set temporary flags, althought you can
if you wish.

Re: how to crash 2.4.4 w/SBLive

[David Raufeisen]

May 24 10:58:05 prototype kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000004
May 24 10:58:05 prototype kernel:  printing eip:
May 24 10:58:05 prototype kernel: c01bcb40
May 24 10:58:05 prototype kernel: *pde = 00000000
May 24 10:58:05 prototype kernel: Oops: 0002
May 24 10:58:05 prototype kernel: CPU:    0
May 24 10:58:05 prototype kernel: EIP:    0010:[emu10k1_timer_uninstall+48/240]
May 24 10:58:05 prototype kernel: EFLAGS: 00210097
May 24 10:58:05 prototype kernel: eax: 00000000   ebx: ffffffff   ecx: c1c68a78   edx: 00000000
May 24 10:58:05 prototype kernel: esi: c1254070   edi: c1250000   ebp: 00200097   esp: c1c4bf34
May 24 10:58:05 prototype kernel: ds: 0018   es: 0018   ss: 0018
May 24 10:58:05 prototype kernel: Process cat (pid: 378, stackpage=c1c4b000)
May 24 10:58:05 prototype kernel: Stack: c1c68a00 c1250000 c1cb1300 c1c4a000 c1250000 c01b8b8b c1250000 c1c68a78
May 24 10:58:05 prototype kernel:        c1cb1300 c1c68a00 c1250000 c01b8b36 c1cb1300 00200246 c1c68a00 00001000
May 24 10:58:05 prototype kernel:        c01b541f c1cb1300 c1ca58c0 ffffffea 00000000 00001000 00001000 00000000
May 24 10:58:05 prototype kernel: Call Trace: [emu10k1_waveout_close+27/64] [emu10k1_waveout_open+102/160] [emu10k1_audio_write+207/464] [sys_write+150/208] [system
_call+51/56]

-- 
David Raufeisen <david@fortyoz.org>
Cell: (604) 818-3596

Re: how to crash 2.4.4 w/SBLive

[rui.sousa]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 1614 bytes --]


Thank you for the trace. Patch attached, please test it out.

Rui Sousa

P.S: in the future always CC emu10k1-devel, or instead of a 7 day delay in
getting something fixed the message might just get lost.

On Thu, 24 May 2001, David Raufeisen wrote:

> May 24 10:58:05 prototype kernel: Unable to handle kernel NULL pointer dereference at virtual address 00000004
> May 24 10:58:05 prototype kernel:  printing eip:
> May 24 10:58:05 prototype kernel: c01bcb40
> May 24 10:58:05 prototype kernel: *pde = 00000000
> May 24 10:58:05 prototype kernel: Oops: 0002
> May 24 10:58:05 prototype kernel: CPU:    0
> May 24 10:58:05 prototype kernel: EIP:    0010:[emu10k1_timer_uninstall+48/240]
> May 24 10:58:05 prototype kernel: EFLAGS: 00210097
> May 24 10:58:05 prototype kernel: eax: 00000000   ebx: ffffffff   ecx: c1c68a78   edx: 00000000
> May 24 10:58:05 prototype kernel: esi: c1254070   edi: c1250000   ebp: 00200097   esp: c1c4bf34
> May 24 10:58:05 prototype kernel: ds: 0018   es: 0018   ss: 0018
> May 24 10:58:05 prototype kernel: Process cat (pid: 378, stackpage=c1c4b000)
> May 24 10:58:05 prototype kernel: Stack: c1c68a00 c1250000 c1cb1300 c1c4a000 c1250000 c01b8b8b c1250000 c1c68a78
> May 24 10:58:05 prototype kernel:        c1cb1300 c1c68a00 c1250000 c01b8b36 c1cb1300 00200246 c1c68a00 00001000
> May 24 10:58:05 prototype kernel:        c01b541f c1cb1300 c1ca58c0 ffffffea 00000000 00001000 00001000 00000000
> May 24 10:58:05 prototype kernel: Call Trace: [emu10k1_waveout_close+27/64] [emu10k1_waveout_open+102/160] [emu10k1_audio_write+207/464] [sys_write+150/208] [system
> _call+51/56]
>
>

[-- Attachment #2: emu10k1 patch --]
[-- Type: TEXT/PLAIN, Size: 503 bytes --]

Index: audio.c
===================================================================
RCS file: /usr/local/cvsroot/emu10k1/audio.c,v
retrieving revision 1.166
diff -u -r1.166 audio.c
--- audio.c	2001/04/22 15:44:25	1.166
+++ audio.c	2001/05/31 08:47:25
@@ -1231,6 +1231,7 @@
 		woinst->buffer.ossfragshift = 0;
 		woinst->buffer.numfrags = 0;
 		woinst->device = (card->audio_dev1 == minor);
+		woinst->timer.state = TIMER_STATE_UNINSTALLED;
 
 		init_waitqueue_head(&woinst->wait_queue);
 

Re: how to crash 2.4.4 w/SBLive

[David Raufeisen]

Hi,

I used this patch on 2.4.5, still oops's ..

Warning (compare_maps): ksyms_base symbol __VERSIONED_SYMBOL(shmem_file_setup) not found in System.map.  Ignoring ksyms_base entry
Code: 0f b7 a8 84 40 00 00 8d 7d 04 89 54 24 18 8d b4 26 00 00 00 
Using defaults from ksymoops -t elf32-i386 -a i386

Code;  00000000 Before first symbol
00000000 <_EIP>:
Code;  00000000 Before first symbol
   0:   0f b7 a8 84 40 00 00      movzwl 0x4084(%eax),%ebp
Code;  00000007 Before first symbol
   7:   8d 7d 04                  lea    0x4(%ebp),%edi
Code;  0000000a Before first symbol
   a:   89 54 24 18               mov    %edx,0x18(%esp,1)
Code;  0000000e Before first symbol
   e:   8d b4 26 00 00 00 00      lea    0x0(%esi,1),%esi

Unable to handle kernel paging request at virtual address 3320b9e5
c01b91eb
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:[<c01b91eb>]
EFLAGS: 00210002
eax: 33207961   ebx: 00000000   ecx: c1250000   edx: 00000020
esi: c2879f0c   edi: 33207961   ebp: 33207991   esp: c2879edc
ds: 0018   es: 0018   ss: 0018
Process cat (pid: 1550, stackpage=c2879000)
Stack: 00000000 c287e804 33207961 33207991 c02614f8 00000012 c02614d4 00200082 
       c01bc853 33207961 00000020 00000012 00000000 00000003 0000ffff 10100001 
       00000000 00000002 0000ffff 00000000 00000000 00000000 c287e800 c1250000 
Call Trace: [<c01bc853>] [<c01b86c4>] [<c01b8666>] [<c01b4f4f>] [<c012cf46>] [<c0106bab>] 
Warning (Oops_read): Code line not seen, dumping what data is available

>>EIP; c01b91eb <sblive_writeptr_tag+2b/c0>   <=====
Trace; c01bc853 <emu10k1_voice_free+43/80>
Trace; c01b86c4 <emu10k1_waveout_close+24/40>
Trace; c01b8666 <emu10k1_waveout_open+66/a0>
Trace; c01b4f4f <emu10k1_audio_write+cf/1d0>
Trace; c012cf46 <sys_write+96/d0>
Trace; c0106bab <system_call+33/38>


3 warnings issued.  Results may not be reliable.

On Thursday, 31 May 2001, at 12:01:05 (+0200),
rui.sousa@mindspeed.com wrote:

> 
> Thank you for the trace. Patch attached, please test it out.
> 
> Rui Sousa
> 
> P.S: in the future always CC emu10k1-devel, or instead of a 7 day delay in
> getting something fixed the message might just get lost.
> 

-- 
David Raufeisen <david@fortyoz.org>
Cell: (604) 818-3596

Re: [Emu10k1-devel] Re: how to crash 2.4.4 w/SBLive

[rui.sousa]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 801 bytes --]

On Thu, 31 May 2001, David Raufeisen wrote:

> Hi,
>
> I used this patch on 2.4.5, still oops's ..

But now it progressed a bit more ;)

>
> >>EIP; c01b91eb <sblive_writeptr_tag+2b/c0>   <=====
> Trace; c01bc853 <emu10k1_voice_free+43/80>
> Trace; c01b86c4 <emu10k1_waveout_close+24/40>
> Trace; c01b8666 <emu10k1_waveout_open+66/a0>
> Trace; c01b4f4f <emu10k1_audio_write+cf/1d0>
> Trace; c012cf46 <sys_write+96/d0>
> Trace; c0106bab <system_call+33/38>
>


New patch attached.

>
> On Thursday, 31 May 2001, at 12:01:05 (+0200),
> rui.sousa@mindspeed.com wrote:
>
> >
> > Thank you for the trace. Patch attached, please test it out.
> >
> > Rui Sousa
> >
> > P.S: in the future always CC emu10k1-devel, or instead of a 7 day delay in
> > getting something fixed the message might just get lost.
> >

[-- Attachment #2: emu10k1 patch --]
[-- Type: TEXT/PLAIN, Size: 1051 bytes --]

diff -u -r1.166 audio.c
--- audio.c	2001/04/22 15:44:25	1.166
+++ audio.c	2001/05/31 17:23:03
@@ -1231,6 +1231,9 @@
 		woinst->buffer.ossfragshift = 0;
 		woinst->buffer.numfrags = 0;
 		woinst->device = (card->audio_dev1 == minor);
+		woinst->timer.state = TIMER_STATE_UNINSTALLED;
+		woinst->voice.usage = VOICE_USAGE_FREE;
+		woinst->buffer.emupageindex = -1;
 
 		init_waitqueue_head(&woinst->wait_queue);
 
Index: cardwo.c
===================================================================
RCS file: /usr/local/cvsroot/emu10k1/cardwo.c,v
retrieving revision 1.129
diff -u -r1.129 cardwo.c
--- cardwo.c	2001/05/02 07:58:31	1.129
+++ cardwo.c	2001/05/31 17:23:04
@@ -143,8 +143,10 @@
 	if (woinst->format.bitsperchannel == 16)
 		voice->flags |= VOICE_FLAGS_16BIT;
 
-	if (emu10k1_voice_alloc(card, voice) < 0)
+	if (emu10k1_voice_alloc(card, voice) < 0) {
+		voice->usage = VOICE_USAGE_FREE;
 		return -1;
+	}
 
 	/* Calculate pitch */
 	voice->initial_pitch = (u16) (srToPitch(woinst->format.samplingrate) >> 8);

Re: [Emu10k1-devel] Re: how to crash 2.4.4 w/SBLive

[David Raufeisen]

Great,

No more oops.

Thanks

On Thursday, 31 May 2001, at 20:33:54 (+0200),
rui.sousa@mindspeed.com wrote:

> On Thu, 31 May 2001, David Raufeisen wrote:
> 
> But now it progressed a bit more ;)
> 
> New patch attached.
> 

-- 
David Raufeisen <david@fortyoz.org>
Cell: (604) 818-3596

Re: how to crash 2.4.4 w/SBLive

[John R Lenton]

[-- Attachment #1: Type: text/plain, Size: 1121 bytes --]

On Thu, May 31, 2001 at 12:01:05PM +0200, rui.sousa@mindspeed.com wrote:
Content-Description: emu10k1 patch
> Index: audio.c
> ===================================================================
> RCS file: /usr/local/cvsroot/emu10k1/audio.c,v
> retrieving revision 1.166
> diff -u -r1.166 audio.c
> --- audio.c	2001/04/22 15:44:25	1.166
> +++ audio.c	2001/05/31 08:47:25
> @@ -1231,6 +1231,7 @@
>  		woinst->buffer.ossfragshift = 0;
>  		woinst->buffer.numfrags = 0;
>  		woinst->device = (card->audio_dev1 == minor);
> +		woinst->timer.state = TIMER_STATE_UNINSTALLED;
>  
>  		init_waitqueue_head(&woinst->wait_queue);

the closest I can find (in 2.4.5) is

             woinst->buffer.fragment_size = 0;
             woinst->buffer.ossfragshift = 0;
             woinst->buffer.numfrags = 0;
             woinst->device = (card->audio1_num == minor);

             init_waitqueue_head(&woinst->wait_queue);

at lines 1111--1116...

-- 
John Lenton (john@grulic.org.ar) -- Random fortune:
New York... when civilization falls apart, remember, we were way ahead of you.
- David Letterman

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]