Bug#677164: [3.2.17-1 -> 3.2.18-1 regression] Wacom tablet in Thinkpad x220t not working

[Jonathan Nieder <jrnieder@gmail.com>]

Hi Nils,

Nils Kanning wrote:

> 0001:
>
> The tablet does not work, see also dmesg_0001. I had to press ctrl+c
> during booting at [12.000000] and lsusb -t gives
> 1-1.3:1.0: No such file or directory
> (and then hangs)

This is 0024 from the earlier list:

  f393ee2b814e Input: wacom - retrieve maximum number of touch points
               from the HID usage table when it is supported

I'll look at it more closely.  (Probably I introduced a bug while
backporting it.)

> 0002:
>
> I could not apply the patch:

Are you trying to apply this patch alone or on top of 0001?  Only the
latter is supposed to work.

[...]
> "Sometimes" this configuration really works. But most of the times it
> does not and I have to press ctrl+c at [12.000000] (see
> dmesg_20-24_fail). Again lsusb -t gives
> 1-1.3:1.0: No such file or directory
> (and hangs)
>
> (I'm sorry for "sometimes" and "most of the times" ...)

No, thanks much for these details.  It's very helpful.

[...]
> [    2.961552] Linux video capture interface: v2.00
> [    2.962940] ------------[ cut here ]------------
> [    2.962988] kernel BUG at mm/slab.c:505!
> [    2.963036] invalid opcode: 0000 [#1] SMP 
> [    2.963157] CPU 2 
> [    2.963195] Modules linked in: videobuf2_core videodev media ghash_clmulni_intel(+) cdc_acm(+) cdc_ncm(+) cdc_wdm wacom(+) usbnet snd_seq_midi mii aesni_intel aes_x86_64 aes_generic cryptd snd_seq_midi_event snd_rawmidi snd_seq microcode(+) snd_seq_device snd_timer i915(+) iwlwifi drm_kms_helper psmouse snd drm mac80211 tpm_tis i2c_i801 serio_raw pcspkr evdev iTCO_wdt tpm i2c_algo_bit acpi_cpufreq iTCO_vendor_support cfg80211 ac i2c_core soundcore mperf rfkill wmi tpm_bios battery power_supply video button processor ext4 crc16 jbd2 mbcache usbhid hid sd_mod crc_t10dif ahci libahci libata ehci_hcd scsi_mod thermal thermal_sys e1000e usbcore sdhci_pci sdhci mmc_core usb_common [last unloaded: scsi_wait_scan]
> [    2.965891] 
> [    2.965932] Pid: 579, comm: modprobe Not tainted 3.4.2-amd64 #1 LENOVO 42992QG/42992QG
> [    2.966079] RIP: 0010:[<ffffffff810eeee2>]  [<ffffffff810eeee2>] virt_to_cache+0x1b/0x23
> [    2.966193] RSP: 0000:ffff88021204fcf8  EFLAGS: 00010046
> [    2.966251] RAX: ffffea00073a6800 RBX: ffff880210b0020c RCX: 000000000000040b
> [    2.966312] RDX: 0200000000000000 RSI: ffff880211e11c80 RDI: ffff880210b0020c
> [    2.966375] RBP: 0000000000000286 R08: ffff88021204e000 R09: 000000000000002e
> [    2.966435] R10: 00007fffcdeb8770 R11: ffff88020fcf0c40 R12: ffffffffa04029cd
> [    2.966497] R13: 000000000000005a R14: 0000000000000001 R15: ffff88020ec71c00
> [    2.966560] FS:  00007ff356606700(0000) GS:ffff88021e280000(0000) knlGS:0000000000000000
> [    2.966631] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [    2.966686] CR2: 0000000000403228 CR3: 00000002127d4000 CR4: 00000000000407e0
> [    2.966743] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [    2.966801] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> [    2.966860] Process modprobe (pid: 579, threadinfo ffff88021204e000, task ffff8802111e36d0)
> [    2.966933] Stack:
> [    2.966990]  ffff88021204e000 ffffffff810ef84e 0000000000000000 ffff880210b4b080
> [    2.967214]  ffff880210011400 ffffffffa04029cd ffff880210011400 ffff880200000165
> [    2.967433]  ffff880200001388 0000000000000202 ffff880200000002 ffff88020fce0800
> [    2.967657] Call Trace:
> [    2.967713]  [<ffffffff810ef84e>] ? kfree+0x50/0x6c
> [    2.967775]  [<ffffffffa04029cd>] ? wacom_probe+0x52c/0x957 [wacom]
> [    2.967845]  [<ffffffffa006866b>] ? usb_probe_interface+0xf2/0x15d [usbcore]

That's

	BUG_ON(!PageSlab(page))

in page_get_cache() and represents a free of an invalid pointer (for
example a double free).  Thanks again.  More tomorrow.

Good night,
Jonathan