** Description changed: [Impact] Ubuntu 24.04 LTS ships v4l2loopback 0.12.7. After the Linux 6.18 API compatibility fixes from LP: #2161037 are applied, streaming through a v4l2loopback device on the Noble 7.0 HWE kernel can hard-freeze the system. The output DQBUF path reads and reorders dev->outbufs_list without holding dev->lock. The concurrent output QBUF path modifies the same list under dev->lock. This race can corrupt the kernel list while an output buffer is queued and dequeued concurrently. A controlled Noble VM test reproduced the underlying corruption on 7.0.0-28-generic. The unpatched DQBUF path produced 112 kernel warnings, including: list_add corruption. prev->next should be next WARNING: lib/list_debug.c:32 at __list_add_valid_or_report call trace included. buffer_written vidioc_qbuf The fix takes the existing dev->lock while vidioc_dqbuf() reads and rotates dev->outbufs_list. [Test Plan] - TBD + Run the test on Noble with both the GA 6.8 kernel and the HWE 7.0 + kernel. + + After booting each kernel, confirm the running version and install the + test dependencies: + + uname -r + sudo apt-get install -y build-essential linux-modules-extra-$(uname -r) + + Download and build the reproducer: + + wget -O v4l2-dqbuf-race.c https://bugs.launchpad.net/ubuntu/+source/v4l2loopback/+bug/2161239/+attachment/5987649/+files/v4l2-dqbuf-race.c + gcc -std=gnu11 -O2 -Wall -Wextra -pthread v4l2-dqbuf-race.c -o v4l2-dqbuf-race + + After installing the v4l2loopback module under test, run: + + sudo modprobe -r v4l2loopback + sudo modprobe v4l2loopback devices=1 video_nr=42 max_buffers=8 + sudo udevadm settle + sudo chmod 666 /dev/video42 + sudo dmesg -C + ./v4l2-dqbuf-race /dev/video42 180 + sudo dmesg | grep -E 'list_(add|del) corruption|__list_(add|del)_valid' + + Before the update: + + On the Noble HWE 7.0 kernel, the reproducer prints a non-zero dqbuf_ops + value and the final command reports list-corruption warnings such as: + + list_add corruption. prev->next should be next + WARNING: lib/list_debug.c:32 at __list_add_valid_or_report + list_del corruption. prev->next should be + + On the Noble GA 6.8 kernel, the reproducer completes with a non-zero + dqbuf_ops value and the final command produces no output. + + After the fix: + + On both the Noble GA 6.8 and HWE 7.0 kernels, the reproducer completes + with a non-zero dqbuf_ops value and the final command produces no + output. [Where problems could occur] If the locking range is wrong or the lock is not released, concurrent output DQBUF and QBUF operations can either hang or produce list- corruption warnings and broken output streaming. [Other Info] Fixed upstream in v4l2loopback 0.13.0 by https://github.com/v4l2loopback/v4l2loopback/commit/d9277249064a04cee6e3784573cf36162e09bf3e mutex lock access to outbufs_list in vidioc_dqbuf [Original Description] On Ubuntu 24.04 (Noble) with the HWE 7.0 kernel (7.0.0-28-generic), v4l2loopback fails to build with the stock package (see bug #2161037). After manually applying a community-suggested compile fix (https://github.com/v4l2loopback/v4l2loopback/issues/669#issuecomment-5011058299) for the v4l2_fh_add/v4l2_fh_del kernel API signature change, the module compiles and loads successfully. However, actually streaming through the resulting /dev/videoX device causes a complete system hard-freeze. Reproduced 3/3 times (2x via ffplay, 1x via v4l2-ctl --stream-mmap). Symptoms: display becomes fully unresponsive, keyboard LEDs still toggle but no input is processed, SysRq/REISUB does not respond, machine stays reachable over the network (SSH), requiring a hard power cycle to recover. No kernel oops/panic was captured in the journal before the freeze -- the log simply stops. This does NOT reproduce on kernel 6.17.0-40-generic with the identical userspace pipeline (same v4l2loopback source, same docker-based ffmpeg writer, same ffplay/v4l2-ctl reader). Filed upstream as a separate issue from the build failure: https://github.com/v4l2loopback/v4l2loopback/issues/670 A maintainer commented on that upstream issue suggesting this could be related to https://github.com/v4l2loopback/v4l2loopback/issues/532 (missing list protection against concurrent access in 0.12.7, potentially causing a panic), and confirmed the current main branch (0.15.4) runs on kernel 7.0+ without this issue. Given Ubuntu's packaged version (0.12.7) is 9 releases behind upstream, this may already be fixed by updating the packaged version rather than needing a targeted backport. Steps to reproduce: 1. Apply the compile fix from the comment linked above to /usr/src/v4l2loopback-0.12.7/v4l2loopback.c and rebuild via DKMS for kernel 7.0.0-28-generic 2. Write to the loopback device via ffmpeg (dockerized): docker run --rm --device=/dev/video0:/dev/video0 jrottenberg/ffmpeg -loop 1 -re -i /data/image.png -f v4l2 -vcodec rawvideo -pix_fmt yuv420p /dev/video0 3. On the host, read from the device: v4l2-ctl --device=/dev/video0 --stream-mmap --stream-count=5 --stream-to=/tmp/test.raw or: ffplay /dev/video0 4. System hard-freezes within seconds. Expected: streaming works without crashing, as it does on kernel 6.17.0-40-generic. Configuration: - v4l2loopback version: 0.12.7 (patched per the comment above for kernel 7.0 API compat) - kernel version: 7.0.0-28-generic (x86_64) -- reproduced; NOT reproduced on 6.17.0-40-generic - Distribution: Ubuntu 24.04 LTS (Noble Numbat), HWE kernel from linux-signed-hwe-7.0 - GPU: NVIDIA (proprietary driver 595.71.05, DKMS) + AMD iGPU (amdgpu), hybrid graphics, Wayland session --- Filed with the help of Claude (Anthropic).
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2161239 Title: v4l2loopback 0.12.7 causes full system hard-freeze when streaming on kernel 7.0 HWE To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/v4l2loopback/+bug/2161239/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
