Sundtek Support Forum

Hallo!

Leider habe ich mit dem Sundtek SkyTV Ultimate Dual ständig Crashes.

Mein System:
- Debian 11 (Kernel 5.10.179-1)
- VM unter Proxmox V7 mit durchgereichtem Endgerät (nicht Port)
- Aktueller Treiber (installiert am 05.06. über Netinstall-Skript)
- TVHeadEnd 4.3-2124~g1705297c2
- SkyTV Ultimate Dual DVB-S2 an einem aktiven USB 3-Hub
- Si2168 DVB-C/T2-Stick für DVB-T2-Empfang (funktioniert einwandfrei)
- DUR-line UK 124 - Unicable LNB (24 Teilnehmer, Unicable 2 / JESS)
- Netzteil steckt
- SAT-Anschluss ist zur Sicherheit diodenentkoppelt

cat /etc/sundtek.conf
[U2303...]
unicable_frequency=1950
unicable_satcr=20
unicable_frequency2=1995
unicable_satcr2=21

Problem:
[  498.049487] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-8k' (offset 0, size 16384)!
[  498.050107] ------------[ cut here ]------------
[  498.050401] kernel BUG at mm/usercopy.c:99!
[  498.050626] invalid opcode: 0000 [#1] SMP NOPTI
[  498.050867] CPU: 0 PID: 1162 Comm: mediasrv Tainted: P           OE     5.10.0-23-amd64 #1 Debian 5.10.179-1
[  498.051423] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
[  498.052050] RIP: 0010:usercopy_abort+0x74/0x76
[  498.052286] Code: 8c ce 91 51 48 0f 45 d6 49 c7 c3 30 94 cf 91 4c 89 d1 57 48 c7 c6 e1 38 ce 91 48 c7 c7 d0 93 cf 91 49 0f 45 f3 e8 35 79 ff ff <0f> 0b 4c 89 e1 49 89 d8 44 89 ea 31 f6 48 29 c1 48 c7 c7 72 94 cf
[  498.053297] RSP: 0018:ffffb1678029fd98 EFLAGS: 00010246
[  498.053572] RAX: 0000000000000067 RBX: 0000000000004000 RCX: 0000000000000000
[  498.053978] RDX: 0000000000000000 RSI: ffff952cfdc20900 RDI: ffff952cfdc20900
[  498.054398] RBP: ffff952cdbfee000 R08: 0000000000000000 R09: ffffb1678029fbc0
[  498.054785] R10: ffffb1678029fbb8 R11: ffffffff922cb7a8 R12: ffff952cdbfea000
[  498.055155] R13: 0000000000000001 R14: 0000000000000002 R15: 0000000000004000
[  498.055598] FS:  00007f985a153700(0000) GS:ffff952cfdc00000(0000) knlGS:0000000000000000
[  498.056032] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  498.056363] CR2: 00007fc23c9b53c0 CR3: 000000002cde6004 CR4: 0000000000370ef0
[  498.056735] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  498.057166] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  498.057592] Call Trace:
[  498.057750]  __check_heap_object+0xe4/0x110
[  498.057994]  __check_object_size+0x146/0x160
[  498.058277]  copy_urb_data_to_user+0x97/0x130 [usbcore]
[  498.058573]  processcompl+0xd2/0x140 [usbcore]
[  498.058847]  usbdev_ioctl+0x116/0x1180 [usbcore]
[  498.059092]  __x64_sys_ioctl+0x88/0xc0
[  498.059293]  do_syscall_64+0x30/0x80
[  498.059517]  entry_SYSCALL_64_after_hwframe+0x61/0xc6
[  498.059841] RIP: 0033:0x7f985ea31f29
[  498.060032] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 37 8f 0d 00 f7 d8 64 89 01 48
[  498.060986] RSP: 002b:00007f985a152c98 EFLAGS: 00000206 ORIG_RAX: 0000000000000010
[  498.061377] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f985ea31f29
[  498.061749] RDX: 00007f985a152ec0 RSI: 000000004008550d RDI: 0000000000000017
[  498.062181] RBP: 00007f985000d930 R08: 0000000000000018 R09: 0000000000000018
[  498.062551] R10: 0000000000000018 R11: 0000000000000206 R12: 0000000000000017
[  498.062967] R13: 00007f985a152ec0 R14: 000000004008550d R15: 0000000000000000
[  498.063338] Modules linked in: uinput ip6t_REJECT nf_reject_ipv6 ip6_tables nf_log_ipv6 xt_recent ipt_REJECT nf_reject_ipv4 xt_multiport xt_comment xt_conntrack xt_hashlimit xt_addrtype xt_mark xt_TCPMSS nft_chain_nat nft_counter xt_CT xt_tcpudp nft_compat nfnetlink_log xt_NFLOG nf_log_ipv4 nf_log_common xt_LOG nf_nat_tftp nf_nat_snmp_basic nf_conntrack_snmp nf_nat_sip nf_nat_pptp nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda ts_kmp nf_conntrack_amanda nf_nat nf_conntrack_sane nf_conntrack_tftp nf_conntrack_sip nf_conntrack_pptp nf_conntrack_netlink nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp nf_tables nfnetlink lz4 zram zsmalloc zfs(POE) zunicode(POE) zzstd(OE) zlua(OE) zavl(POE) icp(POE) zcommon(POE) dm_multipath znvpair(POE) scsi_dh_rdac scsi_dh_emc spl(OE) scsi_dh_alua rc_total_media_in_hand_02 si2157 si2168 intel_rapl_msr intel_rapl_common intel_pmc_core kvm_intel kvm irqbypass ghash_clmulni_intel snd_hda_intel sch_fq
[  498.063381]  snd_intel_dspcfg soundwire_intel soundwire_generic_allocation dvb_usb_dvbsky ib_iser snd_soc_core aesni_intel rdma_cm snd_compress iw_cm soundwire_cadence libaes dvb_usb_v2 crypto_simd ib_cm cryptd dm_mod glue_helper snd_hda_codec m88ds3103 snd_hda_core qxl snd_hwdep drm_ttm_helper rapl soundwire_bus ttm snd_pcm drm_kms_helper i2c_mux dvb_core snd_timer iTCO_wdt virtio_rng intel_pmc_bxt i6300esb iTCO_vendor_support joydev snd evdev rc_core serio_raw pcspkr sg virtio_balloon mc virtio_console watchdog rng_core cec ib_core soundcore iscsi_tcp libiscsi_tcp libiscsi button qemu_fw_cfg scsi_transport_iscsi tcp_bbr nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 libcrc32c ipmi_poweroff ipmi_watchdog drm ipmi_devintf ipmi_msghandler fuse configfs ip_tables x_tables autofs4 ext4 crc16 mbcache jbd2 crc32c_generic sd_mod t10_pi crc_t10dif crct10dif_generic virtio_net net_failover virtio_scsi failover crct10dif_pclmul crct10dif_common crc32_pclmul crc32c_intel ahci libahci xhci_pci xhci_hcd
[  498.068596]  libata virtio_pci virtio_ring virtio uhci_hcd ehci_pci ehci_hcd i2c_i801 i2c_smbus psmouse scsi_mod lpc_ich usbcore usb_common
[  498.074348] ---[ end trace 527704a25960b1d4 ]---
[  498.074621] RIP: 0010:usercopy_abort+0x74/0x76
[  498.074913] Code: 8c ce 91 51 48 0f 45 d6 49 c7 c3 30 94 cf 91 4c 89 d1 57 48 c7 c6 e1 38 ce 91 48 c7 c7 d0 93 cf 91 49 0f 45 f3 e8 35 79 ff ff <0f> 0b 4c 89 e1 49 89 d8 44 89 ea 31 f6 48 29 c1 48 c7 c7 72 94 cf
[  498.076026] RSP: 0018:ffffb1678029fd98 EFLAGS: 00010246
[  498.076329] RAX: 0000000000000067 RBX: 0000000000004000 RCX: 0000000000000000
[  498.076740] RDX: 0000000000000000 RSI: ffff952cfdc20900 RDI: ffff952cfdc20900
[  498.077128] RBP: ffff952cdbfee000 R08: 0000000000000000 R09: ffffb1678029fbc0
[  498.077498] R10: ffffb1678029fbb8 R11: ffffffff922cb7a8 R12: ffff952cdbfea000
[  498.077934] R13: 0000000000000001 R14: 0000000000000002 R15: 0000000000004000
[  498.078374] FS:  00007f985a153700(0000) GS:ffff952cfdc00000(0000) knlGS:0000000000000000
[  498.078866] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  498.079165] CR2: 00007fc23c9b53c0 CR3: 000000002cde6004 CR4: 0000000000370ef0
[  498.079535] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  498.079961] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400

Wenn ich in TVH einen Scan erzwinge, dauert es ca. 5 Minuten bis mediasrv mit dem usercopy-Warning abstürzt. TVH hängt sich dann so lange komplett auf, bis die VM neu gestartet wird. Das Problem reicht bis weit in den Kernel, da die VM in solch einem Fall auch beim stoppen der Dienste hängt.

Ich habe den Eindruck, dass es sich um ein Memory-Problem handelt, da es sich auch nicht mit "hardened_usercopy=0" in den Griff bekommen lässt. Das System läuft bei einem Crash zwar weiter aber der Tuner ist unbenutzbar. Es ist dann notwendig den "sundtek"-Dienst neu zu starten.

Wenn der Treiber mit einem "hardened_usercopy=0" crasht, steht in dmesg folgendes:
[599378.377406] mediasrv[572495]: segfault at 18 ip 0000000000414b7e sp 00007f1e3b8d2e80 error 4 in mediasrv[400000+69000]
[599378.377955] Code: 8b 7d 00 31 c0 4c 89 c2 be 0a 55 38 80 e8 ea fe fe ff 85 c0 41 89 c7 0f 85 d0 01 00 00 0f b6 45 40 e9 29 fc ff ff 49 8b 55 28 <8b> 42 18 89 42 24 e9 d1 fe ff ff 45 85 e4 0f 84 11 fc ff ff 48 8b

Ein paar Minuten vorher in dmesg (evtl. nicht relevant):
[598918.724267] xhci_hcd 0000:07:1b.0: ERROR Transfer event TRB DMA ptr not part of current TD ep_index 12 comp_code 3
[598918.724903] xhci_hcd 0000:07:1b.0: Looking for event-dma 00000000022e3d00 trb-start 00000000022e31b0 trb-end 00000000022e31d0 seg-start 00000000022e3000 seg-end 00000000022e3ff0

In mediasrv.log erscheint nur:
2023-06-12 21:07:00 [573268] RC: detached remote control

Nach Crash:
root@iptv ~ # ps -aux | grep media
root      573318  0.0  0.0   8404   740 pts/0    S+   21:08   0:00 grep media
root@iptv ~ # systemctl restart sundtek
root@iptv ~ # ps -aux | grep media
root      573327  0.0  0.0   7948   164 ?        S    21:09   0:00 /opt/bin/mediaclient --start=4
root      573338  0.0  0.0   8404   740 pts/0    S+   21:09   0:00 grep media
root@iptv ~ # ps -aux | grep media
root      573341  2.5  0.2 275208  4960 ?        Sl   21:09   0:00 /opt/bin/mediasrv -d --pluginpath=/opt/bin
root      573342  0.0  0.0   5104   136 ?        S    21:09   0:00 /opt/bin/mediasrv -d --pluginpath=/opt/bin
root      573351  0.0  0.0   8404   740 pts/0    S+   21:09   0:00 grep media

Der DVB-T2-Stick, auf gleiche Weise angeschlossen, funktioniert einwandfrei.

Wie kann ich das Problem lösen?