All of lore.kernel.org
 help / color / mirror / Atom feed
* [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
@ 2006-11-19  2:27 Axel Ruder
  2006-11-20  8:28 ` Marcel Holtmann
  0 siblings, 1 reply; 10+ messages in thread
From: Axel Ruder @ 2006-11-19  2:27 UTC (permalink / raw)
  To: bluez-devel


[-- Attachment #1.1: Type: text/plain, Size: 5967 bytes --]

Hi,

please help me!
I have the following problem with Bluez/RFcomm:
- I use a shell script that calls 'rfcomm listen rfcomm0 3' repeatedly to
wait for a client to connect.
- Everything works fine, except that every once in a while (unfortunately
pretty often, like twice a day), the linux kernel crashes with the following
message in syslog:

Nov 18 20:31:48 localhost hcid[23340]: link_key_request
(sba=00:02:72:C5:88:A1, dba=00:12:37:8D:A3:D5)
Nov 18 20:32:28 localhost kernel: BUG: unable to handle kernel NULL pointer
dereference at virtual address 0000003c
Nov 18 20:32:28 localhost kernel:  printing eip:
Nov 18 20:32:28 localhost kernel: e1ce8e85
Nov 18 20:32:28 localhost kernel: *pde = 00000000
Nov 18 20:32:28 localhost kernel: Oops: 0000 [#1]
Nov 18 20:32:28 localhost kernel: SMP
Nov 18 20:32:28 localhost kernel: Modules linked in: dv1394 ohci1394 eth1394
nvidia rfcomm l2cap lirc_serial cx8800 cx88xx bttv video_buf ir_common
compat_ioctl32 btcx_risc lirc_i2c lirc_dev ipv6 dm_mod sd_mod hci_usb
bluetooth raw1394 msp3400 mousedev saa7127 tsdev saa7115 usb_storage
snd_intel8x0 tuner snd_ac97_codec snd_ac97_bus scsi_mod snd_pcm_oss ivtv
snd_mixer_oss firmware_class snd_pcm i2c_algo_bit snd_timer ide_cd cdrom
tveeprom videodev rtc sis_agp psmouse v4l1_compat v4l2_common ohci_hcd snd
evdev parport_pc parport i2c_sis96x 8250_pnp ns558 i2c_core serio_raw sis900
mii ehci_hcd agpgart shpchp pci_hotplug analog usbcore ieee1394 pcspkr
gameport soundcore snd_page_alloc ext3 jbd mbcache ide_disk ide_generic
via82cxxx trm290 triflex slc90e66 sis5513 siimage serverworks sc1200 rz1000
piix pdc202xx_old pdc202xx_new opti621 ns87415 it821x hpt366 hpt34x generic
cy82c693 cs5535 cs5530 cs5520 cmd64x atiixp amd74xx alim15x3 aec62xx
ide_core
Nov 18 20:32:28 localhost kernel: CPU:    0
Nov 18 20:32:28 localhost kernel: EIP:    0060:[<e1ce8e85>]    Tainted: PF
M  VLI
Nov 18 20:32:28 localhost kernel: EFLAGS: 00010246   (2.6.18.2 #1)
Nov 18 20:32:28 localhost kernel: EIP is at
rfcomm_tty_chars_in_buffer+0x6/0x19 [rfcomm]
Nov 18 20:32:28 localhost kernel: eax: 00000000   ebx: c4591000   ecx:
00000000   edx: dda3bc00
Nov 18 20:32:28 localhost kernel: esi: 00000000   edi: c6c54a40   ebp:
c459100c   esp: cd6bdc00
Nov 18 20:32:28 localhost kernel: ds: 007b   es: 007b   ss: 0068
Nov 18 20:32:28 localhost kernel: Process rfcomm (pid: 23351, ti=cd6bc000
task=ca605570 task.ti=cd6bc000)
Nov 18 20:32:28 localhost kernel: Stack: b01fb6e7 00124d5e c4591000 b01fb5f2
c6c54a40 b01f7943 00000000 00000000
Nov 18 20:32:28 localhost kernel:        00000000 cd6bdea0 c6c54a40 cd6bde98
b0167131 cd6bdfb0 afc02110 afc02118
Nov 18 20:32:28 localhost kernel:        00000000 cd6bde98 cd6bde98 cd6bde98
cd6bdea8 00000000 b0167bdf 00000000
Nov 18 20:32:28 localhost kernel: Call Trace:
Nov 18 20:32:28 localhost kernel:  [<b01fb6e7>] normal_poll+0xf5/0x11a
Nov 18 20:32:28 localhost kernel:  [<b01fb5f2>] normal_poll+0x0/0x11a
Nov 18 20:32:28 localhost kernel:  [<b01f7943>] tty_poll+0x48/0x60
Nov 18 20:32:28 localhost kernel:  [<b0167131>] do_sys_poll+0x1a7/0x341
Nov 18 20:32:28 localhost kernel:  [<b0167bdf>] __pollwait+0x0/0xb2
Nov 18 20:32:28 localhost kernel:  [<b0117295>]
default_wake_function+0x0/0xc
Nov 18 20:32:28 localhost kernel:  [<b0117295>]
default_wake_function+0x0/0xc
Nov 18 20:32:28 localhost kernel:  [<b016b0ed>] dput+0x1a/0x117
Nov 18 20:32:28 localhost kernel:  [<b016489e>] __link_path_walk+0xb95/0xcce
Nov 18 20:32:28 localhost kernel:  [<b0159351>]
__find_get_block_slow+0xfb/0x105
Nov 18 20:32:28 localhost kernel:  [<b014490d>]
blockable_page_cache_readahead+0x46/0x99
Nov 18 20:32:28 localhost kernel:  [<b016ad20>] __d_lookup+0x2f/0xd7
Nov 18 20:32:28 localhost kernel:  [<b011728b>] try_to_wake_up+0x355/0x35f
Nov 18 20:32:28 localhost kernel:  [<b01431e7>]
get_page_from_freelist+0x74/0x328
Nov 18 20:32:28 localhost kernel:  [<b0115d79>] __wake_up_common+0x2f/0x53
Nov 18 20:32:28 localhost kernel:  [<b016ad89>] __d_lookup+0x98/0xd7
Nov 18 20:32:28 localhost kernel:  [<b01629b2>] do_lookup+0x4f/0x135
Nov 18 20:32:28 localhost kernel:  [<b016b0ed>] dput+0x1a/0x117
Nov 18 20:32:28 localhost kernel:  [<b016489e>] __link_path_walk+0xb95/0xcce
Nov 18 20:32:28 localhost kernel:  [<b016e6df>] mntput_no_expire+0x11/0x68
Nov 18 20:32:28 localhost kernel:  [<b0164a7e>] link_path_walk+0xa7/0xb1
Nov 18 20:32:28 localhost kernel:  [<b01b774e>] memmove+0xe/0x22
Nov 18 20:32:28 localhost kernel:  [<b02019d2>] scrup+0x8c/0xb9
Nov 18 20:32:28 localhost kernel:  [<b011cde5>]
release_console_sem+0x17b/0x1b5
Nov 18 20:32:28 localhost kernel:  [<b02045de>] do_con_write+0x1462/0x1493
Nov 18 20:32:28 localhost kernel:  [<b01100ff>] __cpu_disable+0x1d/0xee
Nov 18 20:32:28 localhost kernel:  [<b01f9c91>] tty_open+0x179/0x2f0
Nov 18 20:32:28 localhost kernel:  [<b011cde5>]
release_console_sem+0x17b/0x1b5
Nov 18 20:32:28 localhost kernel:  [<b013f453>] find_get_page+0x18/0x38
Nov 18 20:32:28 localhost kernel:  [<b01419bf>] filemap_nopage+0x191/0x30a
Nov 18 20:32:28 localhost kernel:  [<b0149d94>]
__handle_mm_fault+0x3fa/0x72e
Nov 18 20:32:28 localhost kernel:  [<b01f692e>] tty_ldisc_deref+0x14/0x59
Nov 18 20:32:28 localhost kernel:  [<b0115026>] do_page_fault+0x184/0x460
Nov 18 20:32:28 localhost kernel:  [<b0167300>] sys_poll+0x35/0x38
Nov 18 20:32:28 localhost kernel:  [<b0102c73>] syscall_call+0x7/0xb
Nov 18 20:32:28 localhost kernel: Code: 88 84 01 00 00 8b 59 3c 8b 53 5c 85
d2 b8 01 00 00 00 0f 44 d0 8b 49 64 0f af 53 50 30 c0 29 ca 0f 49 c2 5b c3
8b 80 84 01 00 00 <8b> 50 3c 8d 42 0c 31 c9 39 42 0c 74 03 8b 4a 50 89 c8 c3
c3 c3
Nov 18 20:32:28 localhost kernel: EIP: [<e1ce8e85>]
rfcomm_tty_chars_in_buffer+0x6/0x19 [rfcomm] SS:ESP 0068:cd6bdc00
Nov 18 20:32:28 localhost sdpd[23342]: terminating...


- I use kernel version 2.6.18.2
- I use debian unstable
- bluez-utils version 3.7-1
- the communication between client and bluez uses 9600 Baud and standard
parameters

Any help would be highly appreciated!

Thanks,
Axel

[-- Attachment #1.2: Type: text/html, Size: 6924 bytes --]

[-- Attachment #2: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #3: Type: text/plain, Size: 164 bytes --]

_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
  2006-11-19  2:27 [Bluez-devel] Rfcomm kernel crashes (2.6.18.2) Axel Ruder
@ 2006-11-20  8:28 ` Marcel Holtmann
  2006-11-20  9:26   ` Stefan Seyfried
  0 siblings, 1 reply; 10+ messages in thread
From: Marcel Holtmann @ 2006-11-20  8:28 UTC (permalink / raw)
  To: BlueZ development

[-- Attachment #1: Type: text/plain, Size: 495 bytes --]

Hi Axel,

> I have the following problem with Bluez/RFcomm:
> - I use a shell script that calls 'rfcomm listen rfcomm0 3' repeatedly
> to wait for a client to connect.
> - Everything works fine, except that every once in a while
> (unfortunately pretty often, like twice a day), the linux kernel
> crashes with the following message in syslog: 

so you have something to reproduce this. That is good. Please try out
the attached patch and report back if it fixes this for you.

Regards

Marcel


[-- Attachment #2: patch --]
[-- Type: text/x-patch, Size: 1403 bytes --]

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index b8e3a5f..46c03f8 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -915,12 +915,14 @@ static void rfcomm_tty_unthrottle(struct
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	struct rfcomm_dlc *dlc = dev->dlc;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
-	if (!skb_queue_empty(&dlc->tx_queue))
-		return dlc->mtu;
+	if (!dev || !dev->dlc)
+		return 0;
+
+	if (!skb_queue_empty(&dev->dlc->tx_queue))
+		return dev->dlc->mtu;
 
 	return 0;
 }
@@ -928,11 +930,12 @@ static int rfcomm_tty_chars_in_buffer(st
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	if (!dev)
-		return;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
+	if (!dev || !dev->dlc)
+		return;
+
 	skb_queue_purge(&dev->dlc->tx_queue);
 
 	if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +955,12 @@ static void rfcomm_tty_wait_until_sent(s
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	if (!dev)
-		return;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
+	if (!dev)
+		return;
+
 	rfcomm_tty_flush_buffer(tty);
 
 	if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))

[-- Attachment #3: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #4: Type: text/plain, Size: 164 bytes --]

_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply related	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
  2006-11-20  8:28 ` Marcel Holtmann
@ 2006-11-20  9:26   ` Stefan Seyfried
  2006-11-20  9:35     ` Marcel Holtmann
  0 siblings, 1 reply; 10+ messages in thread
From: Stefan Seyfried @ 2006-11-20  9:26 UTC (permalink / raw)
  To: bluez-devel

On Mon, Nov 20, 2006 at 09:28:07AM +0100, Marcel Holtmann wrote:

> so you have something to reproduce this. That is good. Please try out
> the attached patch and report back if it fixes this for you.

just in case this is supposed to go in...

> diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
> index b8e3a5f..46c03f8 100644
> --- a/net/bluetooth/rfcomm/tty.c
> +++ b/net/bluetooth/rfcomm/tty.c
> @@ -915,12 +915,14 @@ static void rfcomm_tty_unthrottle(struct
>  static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
>  {
>  	struct rfcomm_dev *dev =3D (struct rfcomm_dev *) tty->driver_data;
> -	struct rfcomm_dlc *dlc =3D dev->dlc;
>  =

>  	BT_DBG("tty %p dev %p", tty, dev);

dev used
  =

> -	if (!skb_queue_empty(&dlc->tx_queue))
> -		return dlc->mtu;
> +	if (!dev || !dev->dlc)

dev checked.

> +		return 0;
> +
> +	if (!skb_queue_empty(&dev->dlc->tx_queue))
> +		return dev->dlc->mtu;
>  =

>  	return 0;
>  }
> @@ -928,11 +930,12 @@ static int rfcomm_tty_chars_in_buffer(st
>  static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
>  {
>  	struct rfcomm_dev *dev =3D (struct rfcomm_dev *) tty->driver_data;
> -	if (!dev)
> -		return;
>  =

>  	BT_DBG("tty %p dev %p", tty, dev);

dev used
  =

> +	if (!dev || !dev->dlc)

dev checked....
-- =

Stefan Seyfried
QA / R&D Team Mobile Devices        |              "Any ideas, John?"
SUSE LINUX Products GmbH, N=FCrnberg  | "Well, surrounding them's out." =


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3DDE=
VDEV
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
  2006-11-20  9:26   ` Stefan Seyfried
@ 2006-11-20  9:35     ` Marcel Holtmann
  2006-11-20 10:25       ` Stefan Seyfried
  0 siblings, 1 reply; 10+ messages in thread
From: Marcel Holtmann @ 2006-11-20  9:35 UTC (permalink / raw)
  To: BlueZ development

Hi Stefan,

> > so you have something to reproduce this. That is good. Please try out
> > the attached patch and report back if it fixes this for you.
> 
> just in case this is supposed to go in...
> 
> > diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
> > index b8e3a5f..46c03f8 100644
> > --- a/net/bluetooth/rfcomm/tty.c
> > +++ b/net/bluetooth/rfcomm/tty.c
> > @@ -915,12 +915,14 @@ static void rfcomm_tty_unthrottle(struct
> >  static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
> >  {
> >  	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
> > -	struct rfcomm_dlc *dlc = dev->dlc;
> >  
> >  	BT_DBG("tty %p dev %p", tty, dev);
> 
> dev used

and? It will print "(nil)" which is fine. And it is debug output anyway.
This is not a dereference.

Regards

Marcel



-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
  2006-11-20  9:35     ` Marcel Holtmann
@ 2006-11-20 10:25       ` Stefan Seyfried
  0 siblings, 0 replies; 10+ messages in thread
From: Stefan Seyfried @ 2006-11-20 10:25 UTC (permalink / raw)
  To: bluez-devel

On Mon, Nov 20, 2006 at 10:35:04AM +0100, Marcel Holtmann wrote:
> Hi Stefan,
> =

> > >  	BT_DBG("tty %p dev %p", tty, dev);
> > =

> > dev used
> =

> and? It will print "(nil)" which is fine. And it is debug output anyway.
> This is not a dereference.

Ok, it just popped into my eye.
I trust you that you know much better than me what you're doing there... :-)
-- =

Stefan Seyfried
QA / R&D Team Mobile Devices        |              "Any ideas, John?"
SUSE LINUX Products GmbH, N=FCrnberg  | "Well, surrounding them's out." =


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=3Djoin.php&p=3Dsourceforge&CID=3DDE=
VDEV
_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
@ 2006-11-24  4:09 Axel Ruder
  0 siblings, 0 replies; 10+ messages in thread
From: Axel Ruder @ 2006-11-24  4:09 UTC (permalink / raw)
  To: bluez-devel


[-- Attachment #1.1: Type: text/plain, Size: 216 bytes --]

Hi Marcel,

thanks a lot for the patch. I just applied and installed it.
I will know in a couple of days if it worked, I'll take some time this
weekend to test it.
Thanks again! I'll let you know if it worked.

Axel

[-- Attachment #1.2: Type: text/html, Size: 288 bytes --]

[-- Attachment #2: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #3: Type: text/plain, Size: 164 bytes --]

_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
@ 2006-11-28  2:06 Axel Ruder
  2006-11-28  4:18 ` Marcel Holtmann
  0 siblings, 1 reply; 10+ messages in thread
From: Axel Ruder @ 2006-11-28  2:06 UTC (permalink / raw)
  To: bluez-devel


[-- Attachment #1.1: Type: text/plain, Size: 6010 bytes --]

Hi Marcel,
thanks again for your patch. It seems to have fixed the problem partially.
I get a lot less frequent crashes, but unfortunately I now got this new
error:

Nov 26 21:57:58 localhost kernel: BUG: unable to handle kernel NULL pointer
dereference at virtual address 0000003c
Nov 26 21:57:58 localhost kernel:  printing eip:
Nov 26 21:57:58 localhost kernel: e1cebe5f
Nov 26 21:57:58 localhost kernel: *pde = 00000000
Nov 26 21:57:58 localhost kernel: Oops: 0000 [#1]
Nov 26 21:57:58 localhost kernel: SMP
Nov 26 21:57:58 localhost kernel: Modules linked in: nvidia rfcomm l2cap
lirc_serial cx8800 cx88xx bttv video_buf ir_common compat_ioctl32 btcx_risc
lirc_i2c lirc_dev ipv6 dm_mod it87 hwmon_vid i2c_isa eeprom sd_mod eth1394
dv1394 raw1394 hci_usb bluetooth usb_storage scsi_mod msp3400 saa7127
mousedev saa7115 tsdev tuner snd_intel8x0 snd_ac97_codec snd_ac97_bus
snd_pcm_oss snd_mixer_oss snd_pcm shpchp ivtv ohci1394 ide_cd cdrom
firmware_class ehci_hcd ieee1394 pci_hotplug i2c_sis96x i2c_algo_bit
ohci_hcd snd_timer sis900 ns558 snd 8250_pnp tveeprom i2c_core psmouse
usbcore mii analog sis_agp agpgart videodev v4l1_compat v4l2_common evdev
soundcore snd_page_alloc serio_raw pcspkr rtc gameport parport_pc parport
ext3 jbd mbcache ide_disk ide_generic via82cxxx trm290 triflex slc90e66
sis5513 siimage serverworks sc1200 rz1000 piix pdc202xx_old pdc202xx_new
opti621 ns87415 it821x hpt366 hpt34x generic cy82c693 cs5535 cs5530 cs5520
cmd64x atiixp amd74xx alim15x3 aec62xx ide_core
Nov 26 21:57:58 localhost kernel: CPU:    1
Nov 26 21:57:58 localhost kernel: EIP:    0060:[<e1cebe5f>]    Tainted:
PF     VLI
Nov 26 21:57:58 localhost kernel: EFLAGS: 00010293   (2.6.18.2 #1)
Nov 26 21:57:58 localhost kernel: EIP is at rfcomm_tty_write_room+0x7/0x27
[rfcomm]
Nov 26 21:57:58 localhost kernel: eax: c297a000   ebx: c297a000   ecx:
00000000   edx: deeb8200
Nov 26 21:57:58 localhost kernel: esi: 00000000   edi: d6b1c8c0   ebp:
c297a00c   esp: c554fbfc
Nov 26 21:57:58 localhost kernel: ds: 007b   es: 007b   ss: 0068
Nov 26 21:57:58 localhost kernel: Process rfcomm (pid: 20250, ti=c554e000
task=dfceeab0 task.ti=c554e000)
Nov 26 21:57:58 localhost kernel: Stack: c297a000 b01fb6f9 00124d5e c297a000
b01fb5f2 d6b1c8c0 b01f7943 00000000
Nov 26 21:57:58 localhost kernel:        00000000 00000000 c554fea0 d6b1c8c0
c554fe98 b0167131 c554ffb0 afcd69e0
Nov 26 21:57:58 localhost kernel:        afcd69e8 00000000 c554fe98 c554fe98
c554fe98 c554fea8 00000000 b0167bdf
Nov 26 21:57:58 localhost kernel: Call Trace:
Nov 26 21:57:58 localhost kernel:  [<b01fb6f9>] normal_poll+0x107/0x11a
Nov 26 21:57:58 localhost kernel:  [<b01fb5f2>] normal_poll+0x0/0x11a
Nov 26 21:57:58 localhost kernel:  [<b01f7943>] tty_poll+0x48/0x60
Nov 26 21:57:58 localhost kernel:  [<b0167131>] do_sys_poll+0x1a7/0x341
Nov 26 21:57:58 localhost kernel:  [<b0167bdf>] __pollwait+0x0/0xb2
Nov 26 21:57:58 localhost kernel:  [<b0117295>]
default_wake_function+0x0/0xc
Nov 26 21:57:58 localhost kernel:  [<b0117295>]
default_wake_function+0x0/0xc
Nov 26 21:57:58 localhost kernel:  [<e2374249>] _nv005245rm+0xa9/0xe8
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e2374249>] _nv005245rm+0xa9/0xe8
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e21fe10a>] _nv002668rm+0x26/0x2c
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e24336d2>] _nv000984rm+0x1a/0x20
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e243203f>] _nv000986rm+0x33/0x68
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e2432051>] _nv000986rm+0x45/0x68
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e21fe053>] _nv002682rm+0x53/0x84
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e23748b1>] _nv005436rm+0x15/0x1c
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e21fe101>] _nv002668rm+0x1d/0x2c
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<e21fe10a>] _nv002668rm+0x26/0x2c
[nvidia]
Nov 26 21:57:58 localhost kernel:  [<b020ed34>] dma_pool_alloc+0x16e/0x178
Nov 26 21:57:58 localhost kernel:  [<e093fe8c>] ohci_urb_enqueue+0x61d/0x6d1
[ohci_hcd]
Nov 26 21:57:58 localhost kernel:  [<b0115f3e>] __activate_task+0x1c/0x29
Nov 26 21:57:58 localhost kernel:  [<b011728b>] try_to_wake_up+0x355/0x35f
Nov 26 21:57:58 localhost kernel:  [<e0965e40>] hcd_submit_urb+0x67d/0x727
[usbcore]
Nov 26 21:57:58 localhost kernel:  [<b012d1f2>]
autoremove_wake_function+0xd/0x2d
Nov 26 21:57:58 localhost kernel:  [<b0115d79>] __wake_up_common+0x2f/0x53
Nov 26 21:57:58 localhost kernel:  [<b01161ca>] __wake_up+0x2a/0x3d
Nov 26 21:57:58 localhost kernel:  [<b0141c58>] mempool_free+0x5f/0x63
Nov 26 21:57:58 localhost kernel:  [<b015bc9c>] bio_put+0x22/0x23
Nov 26 21:57:58 localhost kernel:  [<b017500c>] mpage_end_io_read+0x5e/0x66
Nov 26 21:57:58 localhost kernel:  [<b0124dfb>] __mod_timer+0x93/0x9d
Nov 26 21:57:58 localhost kernel:  [<b01aec85>] as_antic_waitnext+0x25/0x31
Nov 26 21:57:58 localhost kernel:  [<b01afa43>]
as_dispatch_request+0x176/0x30e
Nov 26 21:57:58 localhost kernel:  [<b01a896f>] elv_next_request+0x106/0x113
Nov 26 21:57:58 localhost kernel:  [<e083630f>] ide_do_request+0x249/0x6bf
[ide_core]
Nov 26 21:57:58 localhost kernel:  [<b01aa2b7>] freed_request+0x1d/0x37
Nov 26 21:57:58 localhost kernel:  [<e0836095>] ide_end_request+0xc1/0xc9
[ide_core]
Nov 26 21:57:58 localhost kernel:  [<e0836a0a>] ide_intr+0x183/0x18f
[ide_core]
Nov 26 21:57:58 localhost kernel:  [<b013d8bf>] handle_IRQ_event+0x23/0x49
Nov 26 21:57:58 localhost kernel:  [<b0106758>] enable_8259A_irq+0xd/0x42
Nov 26 21:57:58 localhost kernel:  [<b013d9bb>] __do_IRQ+0xd6/0xe6
Nov 26 21:57:58 localhost kernel:  [<b0167300>] sys_poll+0x35/0x38
Nov 26 21:57:58 localhost kernel:  [<b0102c73>] syscall_call+0x7/0xb
Nov 26 21:57:58 localhost kernel: Code: 5f 5d c3 90 89 c1 a1 c0 16 cf e1 eb
07 39 48 18 74 11 89 d0 8b 10 0f 18 02 90 3d c0 16 cf e1 75 ec 31 c0 c3 53
8b 88 84 01 00 00 <8b> 59 3c 8b 53 5c 85 d2 b8 01 00 00 00 0f 44 d0 8b 49 64
0f af
Nov 26 21:57:58 localhost kernel: EIP: [<e1cebe5f>]
rfcomm_tty_write_room+0x7/0x27 [rfcomm] SS:ESP 0068:c554fbfc


Thanks for your help!
Axel

[-- Attachment #1.2: Type: text/html, Size: 6979 bytes --]

[-- Attachment #2: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #3: Type: text/plain, Size: 164 bytes --]

_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
  2006-11-28  2:06 Axel Ruder
@ 2006-11-28  4:18 ` Marcel Holtmann
  2006-11-28  4:21   ` Marcel Holtmann
  0 siblings, 1 reply; 10+ messages in thread
From: Marcel Holtmann @ 2006-11-28  4:18 UTC (permalink / raw)
  To: BlueZ development

[-- Attachment #1: Type: text/plain, Size: 213 bytes --]

Hi Axel,

> thanks again for your patch. It seems to have fixed the problem
> partially.
> I get a lot less frequent crashes, but unfortunately I now got this
> new error:

try the attached one.

Regards

Marcel


[-- Attachment #2: patch --]
[-- Type: text/x-patch, Size: 1840 bytes --]

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 1fb5d42..0a6afc2 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -280,6 +280,9 @@ static void rfcomm_dev_del(struct rfcomm_dev *dev)
 /* ---- Send buffer ---- */
 static inline unsigned int rfcomm_room(struct rfcomm_dlc *dlc)
 {
+	if (!dlc)
+		return 0;
+
 	/* We can't let it be zero, because we don't get a callback
 	   when tx_credits becomes nonzero, hence we'd never wake up */
 	return dlc->mtu * (dlc->tx_credits?:1);
@@ -915,12 +918,14 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	struct rfcomm_dlc *dlc = dev->dlc;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
-	if (!skb_queue_empty(&dlc->tx_queue))
-		return dlc->mtu;
+	if (!dev || !dev->dlc)
+		return 0;
+
+	if (!skb_queue_empty(&dev->dlc->tx_queue))
+		return dev->dlc->mtu;
 
 	return 0;
 }
@@ -928,11 +933,12 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	if (!dev)
-		return;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
+	if (!dev || !dev->dlc)
+		return;
+
 	skb_queue_purge(&dev->dlc->tx_queue);
 
 	if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +958,12 @@ static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	if (!dev)
-		return;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
+	if (!dev)
+		return;
+
 	rfcomm_tty_flush_buffer(tty);
 
 	if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))

[-- Attachment #3: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #4: Type: text/plain, Size: 164 bytes --]

_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply related	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
  2006-11-28  4:18 ` Marcel Holtmann
@ 2006-11-28  4:21   ` Marcel Holtmann
  2006-12-04 23:19     ` Axel Ruder
  0 siblings, 1 reply; 10+ messages in thread
From: Marcel Holtmann @ 2006-11-28  4:21 UTC (permalink / raw)
  To: BlueZ development

[-- Attachment #1: Type: text/plain, Size: 276 bytes --]

Hi Axel,

> > thanks again for your patch. It seems to have fixed the problem
> > partially.
> > I get a lot less frequent crashes, but unfortunately I now got this
> > new error:
> 
> try the attached one.

actually that one was wrong. Please try this one.

Regards

Marcel


[-- Attachment #2: patch --]
[-- Type: text/x-patch, Size: 1738 bytes --]

diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 1fb5d42..5d1494d 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -697,9 +697,13 @@ static int rfcomm_tty_write_room(struct tty_struct *tty)
 
 	BT_DBG("tty %p", tty);
 
+	if (!dev || !dev->dlc)
+		return 0;
+
 	room = rfcomm_room(dev->dlc) - atomic_read(&dev->wmem_alloc);
 	if (room < 0)
 		room = 0;
+
 	return room;
 }
 
@@ -915,12 +919,14 @@ static void rfcomm_tty_unthrottle(struct tty_struct *tty)
 static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	struct rfcomm_dlc *dlc = dev->dlc;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
-	if (!skb_queue_empty(&dlc->tx_queue))
-		return dlc->mtu;
+	if (!dev || !dev->dlc)
+		return 0;
+
+	if (!skb_queue_empty(&dev->dlc->tx_queue))
+		return dev->dlc->mtu;
 
 	return 0;
 }
@@ -928,11 +934,12 @@ static int rfcomm_tty_chars_in_buffer(struct tty_struct *tty)
 static void rfcomm_tty_flush_buffer(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	if (!dev)
-		return;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
+	if (!dev || !dev->dlc)
+		return;
+
 	skb_queue_purge(&dev->dlc->tx_queue);
 
 	if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags) && tty->ldisc.write_wakeup)
@@ -952,11 +959,12 @@ static void rfcomm_tty_wait_until_sent(struct tty_struct *tty, int timeout)
 static void rfcomm_tty_hangup(struct tty_struct *tty)
 {
 	struct rfcomm_dev *dev = (struct rfcomm_dev *) tty->driver_data;
-	if (!dev)
-		return;
 
 	BT_DBG("tty %p dev %p", tty, dev);
 
+	if (!dev)
+		return;
+
 	rfcomm_tty_flush_buffer(tty);
 
 	if (test_bit(RFCOMM_RELEASE_ONHUP, &dev->flags))

[-- Attachment #3: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #4: Type: text/plain, Size: 164 bytes --]

_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply related	[flat|nested] 10+ messages in thread
* Re: [Bluez-devel] Rfcomm kernel crashes (2.6.18.2)
  2006-11-28  4:21   ` Marcel Holtmann
@ 2006-12-04 23:19     ` Axel Ruder
  0 siblings, 0 replies; 10+ messages in thread
From: Axel Ruder @ 2006-12-04 23:19 UTC (permalink / raw)
  To: BlueZ development


[-- Attachment #1.1: Type: text/plain, Size: 999 bytes --]

Hi Marcel,

thanks a lot! Both problems do not occur any more!
That is great! Thanks!

Axel

On 11/27/06, Marcel Holtmann <marcel@holtmann.org> wrote:
>
> Hi Axel,
>
> > > thanks again for your patch. It seems to have fixed the problem
> > > partially.
> > > I get a lot less frequent crashes, but unfortunately I now got this
> > > new error:
> >
> > try the attached one.
>
> actually that one was wrong. Please try this one.
>
> Regards
>
> Marcel
>
>
>
> -------------------------------------------------------------------------
> Take Surveys. Earn Cash. Influence the Future of IT
> Join SourceForge.net's Techsay panel and you'll get the chance to share
> your
> opinions on IT & business topics through brief surveys - and earn cash
> http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV
>
> _______________________________________________
> Bluez-devel mailing list
> Bluez-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bluez-devel
>
>
>
>

[-- Attachment #1.2: Type: text/html, Size: 1594 bytes --]

[-- Attachment #2: Type: text/plain, Size: 347 bytes --]

-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV

[-- Attachment #3: Type: text/plain, Size: 164 bytes --]

_______________________________________________
Bluez-devel mailing list
Bluez-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/bluez-devel

^ permalink raw reply	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2006-12-04 23:19 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-11-19  2:27 [Bluez-devel] Rfcomm kernel crashes (2.6.18.2) Axel Ruder
2006-11-20  8:28 ` Marcel Holtmann
2006-11-20  9:26   ` Stefan Seyfried
2006-11-20  9:35     ` Marcel Holtmann
2006-11-20 10:25       ` Stefan Seyfried
  -- strict thread matches above, loose matches on Subject: below --
2006-11-24  4:09 Axel Ruder
2006-11-28  2:06 Axel Ruder
2006-11-28  4:18 ` Marcel Holtmann
2006-11-28  4:21   ` Marcel Holtmann
2006-12-04 23:19     ` Axel Ruder

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.