Bug#735202: speakup freezes system when trying to paste

[Jarek Czekalski]

I have Debian unstable with kernel 3.12.8-1 and cannot reproduce the 
issue. What should I change in my system to make it reproduce? Here are 
my steps:


1. boot debian into console prompt
2. login as root
3. modprobe speakup_soft
4. service espeakup start
5. type "test"
6. mark "tes" using speakup hot keys
7. paste "tes" using Ins-/
7. execute "cat"
8. paste "tes" using Ins-/

All works, nothing hangs. The only strange thing is that inside "cat" it 
does not show the text until I press enter.


Does the issue reproduce with any speakup synthesizer? Including dummy, 
none and soft?


Jarek


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#735202: speakup freezes system when trying to paste

[Ben Hutchings]

On Sat, 2014-03-01 at 17:23 +0100, Jarek Czekalski wrote:
> I have Debian unstable with kernel 3.12.8-1 and cannot reproduce the 
> issue. What should I change in my system to make it reproduce? Here are 
> my steps:
> 
> 1. boot debian into console prompt
> 2. login as root
> 3. modprobe speakup_soft
> 4. service espeakup start
> 5. type "test"
> 6. mark "tes" using speakup hot keys
> 7. paste "tes" using Ins-/
> 7. execute "cat"
> 8. paste "tes" using Ins-/

Thanks for the hints.

> All works, nothing hangs. The only strange thing is that inside "cat" it 
> does not show the text until I press enter.
> 
> Does the issue reproduce with any speakup synthesizer? Including dummy, 
> none and soft?

I can't reproduce the hang, but when I do the above the kernel does
report 'scheduling while atomic' (full log below) and that means there
is the potential for a hang.

I'm working on a patch for this.

Ben.

[  553.085884] BUG: scheduling while atomic: swapper/0/0/0x1001
[  553.087285] Modules linked in: speakup_soft(C) speakup(C) ip6table_filter 
ip6_tables iptable_filter ip_tables ebtable_nat ebtables x_tables parport_pc 
ppdev lp bnep parport rfcomm bluetooth snd_hrtimer cpufreq_powersave cpu
freq_conservative cpufreq_stats cpufreq_userspace binfmt_misc nfsv3 nfsd 
auth_rpcgss oid_registry nfs_acl nfs lockd fscache sunrpc fuse nls_utf8 
nls_cp437 vfat fat loop x86_pkg_temp_thermal intel_powerclamp joydev 
snd_hda_code
c_hdmi coretemp kvm_intel snd_hda_codec_realtek kvm snd_hda_intel snd_hda_codec 
snd_hwdep i915 iTCO_wdt iTCO_vendor_support crct10dif_pclmul crc32_pclmul 
lpc_ich crc32c_intel snd_pcm mfd_core ghash_clmulni_intel drm_kms_helper
 drm efi_pstore i2c_algo_bit i2c_i801 i2c_core efivars eeepc_wmi aesni_intel 
asus_wmi aes_x86_64 snd_page_alloc pcspkr psmouse snd_seq snd_seq_device 
snd_timer snd mei_me lrw sparse_keymap mei rfkill soundcore gf128mul process
or glue_helper video serio_raw evdev ablk_helper wmi button cryptd ext4 crc16 
mbcache jbd2 dm_mod sr_mod cdrom hid_generic hid_lenovo_tpkbd usbhid hid 
usb_storage sg sd_mod crc_t10dif crct10dif_common aic7xxx scsi_transport_sp
i ahci libahci ehci_pci ehci_hcd xhci_hcd libata scsi_mod fan usbcore 
usb_common thermal thermal_sys r8169 mii
[  553.087367] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G C   
3.12-0.bpo.1-amd64 #1 Debian 3.12.9-1~bpo70+1
[  553.087369] Hardware name: System manufacturer System Product Name/P8Z68-V 
LX, BIOS 4003 08/22/2012
[  553.087371]   81813480 814be0b3 
88021f214300
[  553.087375]  814baf3b  814c1c78 
88021f203a96
[  553.087378]   81801fd8 81801fd8 
81801fd8
[  553.087381] Call Trace:
[  553.087383][] ? dump_stack+0x41/0x51
[  553.087392]  [] ? __schedule_bug+0x45/0x55
[  553.087396]  [] ? __schedule+0x768/0x780
[  553.087401]  [] ? __cond_resched+0x1d/0x30
[  553.087404]  [] ? _cond_resched+0x30/0x40
[  553.087407]  [] ? down_read+0x9/0x19
[  553.087411]  [] ? n_tty_receive_buf+0x28/0xa0
[  553.087417]  [] ? speakup_paste_selection+0x13e/0x160 
[speakup]
[  553.087421]  [] ? try_to_wake_up+0x280/0x280
[  553.087425]  [] ? speakup_win_set+0x230/0x230 [speakup]
[  553.087429]  [] ? keyboard_notifier_call+0x2ed/0xc50 
[speakup]
[  553.087432]  [] ? pollwake+0x65/0x70
[  553.087436]  [] ? notifier_call_chain+0x45/0x60
[  553.087440]  [] ? atomic_notifier_call_chain+0x15/0x20
[  553.087444]  [] ? kbd_event+0x2b7/0x710
[  553.087448]  [] ? input_to_handler+0xd3/0xe0
[  553.087453]  [] ? input_pass_values+0x150/0x160
[  553.087457]  [] ? input_handle_event+0x140/0x540
[  553.087460]  [] ? input_event+0x72/0x90
[  553.087470]  [] ? scsi_run_queue+0xc8/0x260 [scsi_mod]
[  553.087473]  [] ? atkbd_interrupt+0x5fa/0x6b0
[  553.087478]  [] ? sched_clock+0x5/0x10
[  553.087481]  [] ? serio_interrupt+0x4d/0xa0
[  553.087484]  [] ? i8042_interrupt+0x18c/0x3a0
[  553.087488]  [] ? do_timer+0x1eb/0x620
[  553.087492]  [] ? __do_softirq+0x14d/0x280
[  553.087496]  [] ? handle_irq_event_percpu+0x54/0x210
[  553.087500]  [] ? handle_irq_event+0x41/0x70
[  553.087503]  [] ? handle_edge_irq+0x75/0x110
[  553.087507]  [] ? handle_irq+0x18/0x30
[  553.087510]  [] ? do_IRQ+0x53/0xd0
[  553.087514]  [] ? common_interrupt+0x6d/0x6d
[  553.087515][] ? cpuidle_enter_state+0x5b/0xf0
[  553.087522]  [] ? cpuidle_enter_state+0x54/0xf0
[  553.087526]  [] ? cpuidle_idle_call+0xcb/0x240
[  553.087529]  [] ? arch_cpu_idle+0x9/0x30
[  553.087532]  [] ? cpu_startup_entry+0xdb/0x2b0
[  553.087537]  [] ? start_kernel+0x42a/0x435
[  553.087540]  [] ? repair_env_string+0x58/0x58
[  553.087544]  [] ? early_idt_handlers+0x120/0x120
[  553.087548]  [] ? x86_64_start_kernel+0x10e/0x11d

-- 
Ben Hutchings
When you say `I wrote a program that crashed Windows', people just stare ...
and say `Hey, I got those with the system, *for free*'. - Linus Torvalds


signature.asc
Description: This is a digitally signed message part

Bug#735202: speakup freezes system when trying to paste

[Ben Hutchings]

On Sat, 2014-03-15 at 23:03 +, Ben Hutchings wrote:
[...]
> I can't reproduce the hang, but when I do the above the kernel does
> report 'scheduling while atomic' (full log below) and that means there
> is the potential for a hang.
> 
> I'm working on a patch for this.
[...]

I'm attaching two patches, one which should directly address this and a
second which fixes further locking bugs in the same area.  They fixed
the 'scheduling while atomic' error for me.  Please test them, following
the directions at
.

If necessary, I can provide new packages for you to test, but this does
take more of my time.

Ben.

-- 
Ben Hutchings
When you say `I wrote a program that crashed Windows', people just stare ...
and say `Hey, I got those with the system, *for free*'. - Linus Torvalds
From e5951c042f47f8c12810984453ef66920b422e71 Mon Sep 17 00:00:00 2001
From: Ben Hutchings 
Date: Sat, 15 Mar 2014 22:34:09 +
Subject: [PATCH 1/2] Staging: speakup: Move pasting into a work item

Input is handled in softirq context, but when pasting we may
need to sleep.  speakup_paste_selection() currently tries to
bodge this by busy-waiting if in_atomic(), but that doesn't
help because the ldisc may also sleep.

For bonus breakage, speakup_paste_selection() changes the
state of current, even though it's not running in process
context.

Move it into a work item and make sure to cancel it on exit.

Signed-off-by: Ben Hutchings 
---
 drivers/staging/speakup/main.c  |  1 +
 drivers/staging/speakup/selection.c | 38 +++--
 drivers/staging/speakup/speakup.h   |  1 +
 3 files changed, 34 insertions(+), 6 deletions(-)

diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index 14079c4..2239fdd 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c
@@ -2220,6 +2220,7 @@ static void __exit speakup_exit(void)
 	unregister_keyboard_notifier(&keyboard_notifier_block);
 	unregister_vt_notifier(&vt_notifier_block);
 	speakup_unregister_devsynth();
+	speakup_cancel_paste();
 	del_timer(&cursor_timer);
 	kthread_stop(speakup_task);
 	speakup_task = NULL;
diff --git a/drivers/staging/speakup/selection.c b/drivers/staging/speakup/selection.c
index f0fb003..f67941e 100644
--- a/drivers/staging/speakup/selection.c
+++ b/drivers/staging/speakup/selection.c
@@ -4,6 +4,8 @@
 #include 
 #include  /* for dev_warn */
 #include 
+#include 
+#include 
 
 #include "speakup.h"
 
@@ -121,20 +123,24 @@ int speakup_set_selection(struct tty_struct *tty)
 	return 0;
 }
 
-/* TODO: move to some helper thread, probably.  That'd fix having to check for
- * in_atomic().  */
-int speakup_paste_selection(struct tty_struct *tty)
+struct speakup_paste_work {
+	struct work_struct work;
+	struct tty_struct *tty;
+};
+
+static void __speakup_paste_selection(struct work_struct *work)
 {
+	struct speakup_paste_work *spw =
+		container_of(work, struct speakup_paste_work, work);
+	struct tty_struct *tty = xchg(&spw->tty, NULL);
 	struct vc_data *vc = (struct vc_data *) tty->driver_data;
 	int pasted = 0, count;
 	DECLARE_WAITQUEUE(wait, current);
+
 	add_wait_queue(&vc->paste_wait, &wait);
 	while (sel_buffer && sel_buffer_lth > pasted) {
 		set_current_state(TASK_INTERRUPTIBLE);
 		if (test_bit(TTY_THROTTLED, &tty->flags)) {
-			if (in_atomic())
-/* if we are in an interrupt handler, abort */
-break;
 			schedule();
 			continue;
 		}
@@ -146,6 +152,26 @@ int speakup_paste_selection(struct tty_struct *tty)
 	}
 	remove_wait_queue(&vc->paste_wait, &wait);
 	current->state = TASK_RUNNING;
+	tty_kref_put(tty);
+}
+
+static struct speakup_paste_work speakup_paste_work = {
+	.work = __WORK_INITIALIZER(speakup_paste_work.work,
+   __speakup_paste_selection)
+};
+
+int speakup_paste_selection(struct tty_struct *tty)
+{
+	if (cmpxchg(&speakup_paste_work.tty, NULL, tty) != NULL)
+		return -EBUSY;
+
+	tty_kref_get(tty);
+	schedule_work_on(WORK_CPU_UNBOUND, &speakup_paste_work.work);
 	return 0;
 }
 
+void speakup_cancel_paste(void)
+{
+	cancel_work_sync(&speakup_paste_work.work);
+	tty_kref_put(speakup_paste_work.tty);
+}
diff --git a/drivers/staging/speakup/speakup.h b/drivers/staging/speakup/speakup.h
index 0126f71..74fe724 100644
--- a/drivers/staging/speakup/speakup.h
+++ b/drivers/staging/speakup/speakup.h
@@ -77,6 +77,7 @@ extern void synth_buffer_clear(void);
 extern void speakup_clear_selection(void);
 extern int speakup_set_selection(struct tty_struct *tty);
 extern int speakup_paste_selection(struct tty_struct *tty);
+extern void speakup_cancel_paste(void);
 extern void speakup_register_devsynth(void);
 extern void speakup_unregister_devsynth(void);
 extern void synth_write(const char *buf, size_t count);
From fa970267e33f95f96ff44febe3cfa0ff08817167 Mon Sep 17 00:00:00 2001
From: Ben Hutchings 
Date: Sat, 15 Mar 2014 22:42:27 +
Subject: [PATCH 2/2] Staging: speakup: Update __speakup_paste_selection(

Bug#735202: speakup freezes system when trying to paste

[Jarek Czekalski]

Hey Ben!

After reading your findings I wanted to see if I can get at least these 
"scheduling" messages. So I started my 3.12.1 kernel and did some 
speakupping, while compiling glib in the background! Bingo, I got "BUG 
... scheduling ..." message on console.. and an immediate freeze as well :(


So these are my conditions for the freeze:
1. fire kernel 3.12.1
2. launch screen and a command "while [[ 1 ]]; do find|wc; done" and 
detach this screen (C-a d)
3. do some speakup pasting, "cat" is not necessary to experience the 
freeze after at most 3 pastes


The "BUG" message also contained the word "find". Something to do with 
my "find" command perhaps.


I can't freeze nor get "scheduling" on 3.13.1 kernel. So I confirm 
Jude's report, that this kernel version seems to be free of the bug.

I can't freeze the kernel without a background task.

Ben, is it still important to test your patches? I would have to do this 
hard job of compiling the kernel to test them, but if you need it, I'll 
do the job.


Jarek


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#735202: speakup freezes system when trying to paste

[Ben Hutchings]

On Tue, 2014-03-18 at 23:44 +0100, Jarek Czekalski wrote:
[...]
> I can't freeze nor get "scheduling" on 3.13.1 kernel. So I confirm 
> Jude's report, that this kernel version seems to be free of the bug.
> I can't freeze the kernel without a background task.
> 
> Ben, is it still important to test your patches? I would have to do this 
> hard job of compiling the kernel to test them, but if you need it, I'll 
> do the job.

It is not too difficult if you follow the instructions I linked to.  But
if you don't have a reliable way to reproduce the bug under 3.13, you
won't be able to tell whether the patches fix it.

Ben.

-- 
Ben Hutchings
Sturgeon's Law: Ninety percent of everything is crap.


signature.asc
Description: This is a digitally signed message part

Bug#735202: speakup freezes system when trying to paste

[Jarek Czekalski]

Ben,

Recently I had a bunch of kernel's to choose from at boot time. But I 
must have done some accidental cleanup (apt-get autoremove maybe) and 
now from the 3.x series I have only 3.13. So it's what you were afraid of.


If there is any doable scenario in which I could build and run 3.12 
version and be able to apply your patches, I can still engage in that. 
But I would need some general preliminary guidance. I know were to find 
upstream kernel source package, but not sure if I can work on them. If 
there was a place to get deb files for 3.12, the rest should be easy.


Jarek


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org

Bug#735202: speakup freezes system when trying to paste

[Paul Gevers]

On 07-04-14 19:30, Jarek Czekalski wrote:
> If there was a place to get deb files for 3.12, the rest should be easy.

http://snapshot.debian.org/

Paul




signature.asc
Description: OpenPGP digital signature

Bug#735202: speakup freezes system when trying to paste

[Jarek Czekalski]

Ben, I downloaded upstream kernel 3.12.17 and reproduced the issue. Then 
I patched it and using this patched kernel I see no ways to reproduce 
the issue. Pasting always works, even in scenario reported in bug 
#744015. Now I'll try to reproduce this other bug with and without the 
patch with kernel 3.14.


Paul, thanks for the snapshot link. I couldn't find this useful archive 
by myself.


I wanted to add that preparing a kernel from source works like a charm. 
I haven't seen any project that would be easier to build. It takes quite 
long, that's a different story. 11 hours.


[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=744015


--
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org