usb audio race at disconnect time

usb audio race at disconnect time

[Matthieu CASTET]

[-- Attachment #1: Type: text/plain, Size: 10036 bytes --]

Hi,

while doing some monkey tests on a product we found races in usb audio code when
the device in unplugged from usb (on linus master tree).

This can be reproduced with usb_audio_show_race.diff and CONFIG_DEBUG_SLAB.
With this patch, start a stream :
# arecord -D hw:0 -r 44100 -c 2  -f S16_LE > /dev/null
you will see the kernel log : "in snd_usb_hw_params sleeping"
Unplug the device before "in snd_usb_hw_params sleeping exit", and you will see
an oops in snd_pcm_hw_params


Instead of using CONFIG_DEBUG_SLAB, usb_audio_show_use_after_free.diff can show
use after free by setting usb_device pointer to NULL in
snd_usb_audio_disconnect. [1]


In order to protect from all the races, before using any usb_device we need to
check if it is not freed.

What's the best way to do that ?

A trival fix would be to take a mutex in all snd_pcm_ops callback that access usb :

{
mutex_lock(&chip->shutdown_mutex);
if (!chip->dev) {
	mutex_unlock(&chip->shutdown_mutex);
	return -ENODEV;
}
[...]
mutex_unlock(&chip->shutdown_mutex);
}


But that will serialize all snd_pcm_ops callbacks.

Another solution could be to use refcounting or rwlock patern :
- snd_pcm_ops callbacks call rdlock_trylock/rdlock_unlock
- usb_driver disconnect callback take rwlock_lock and never release it

This will make "usb_driver disconnect" wait that all "snd_pcm_ops callback" are
finished and abort all future call to "snd_pcm_ops callback".

I believe similar problems exist in other drivers, (we saw another one  in
hidraw [2]), so it could be nice to find a generic pattern to help driver to
manage correctly disconnection.

Are there any recommended pattern ?


Do you have any comment ?

Thanks,

Matthieu


[1]

[ 1366.315307] usb 1-2.1.3: new full-speed USB device number 4 using ehci-omap
[ 1366.556579] input: USB Audio as /devices/platform/usbhs_omap/ehci-omap.0/usb1
/1-2/1-2.1/1-2.1.3/1-2.1.3:1.3/input/input1
[ 1366.604553] hid-generic 0003:06F8:C000.0001: input,hidraw0: USB HID v1.00 Dev
ice [USB Audio] on usb-ehci-omap.0-2.1.3/input3

#
#
# arecord -D hw:0 -r 44100 -c 2  -f S16_LE > /dev/null
Recording WAVE '[ 1368.937774] in snd_usb_hw_params sleeping
stdin' : Signed 16 bit Little Endian, Rate 44100 Hz, Stereo
Warning: rate is not accurate (requested = 44100Hz, got = 48000Hz)
         please, try the plug plugin
[ 1372.385375] hid-generic 0003:06F8:C000.0001: can't reset device, ehci-omap.0-
2.1.3/input3, status -71
[ 1372.439514] usb 1-2.1.3: USB disconnect, device number 4
[ 1372.449005] hid-generic 0003:06F8:C000.0001: can't reset device, ehci-omap.0-
2.1.3/input3, status -71
[ 1378.947235] in snd_usb_hw_params sleeping exit
[ 1378.952301] Unable to handle kernel NULL pointer dereference at virtual addre
ss 0000029c
[ 1378.961029] pgd = c31e8000
[ 1378.964019] [0000029c] *pgd=8e885831, *pte=00000000, *ppte=00000000
[ 1378.970825] Internal error: Oops: 17 [#1] SMP ARM
[ 1378.975799] Modules linked in:
[ 1378.979064] CPU: 0    Not tainted  (3.6.0-03889-ge8dc7a6-dirty #5)
[ 1378.985595] PC is at usb_ifnum_to_if+0xc/0xd4
[ 1378.990234] LR is at snd_usb_hw_params+0x1bc/0x764
[ 1378.995300] pc : [<c0275338>]    lr : [<c030816c>]    psr: 00000013
[ 1378.995300] sp : cf3fddf0  ip : cf3fde08  fp : cf3fde04
[ 1379.007415] r10: 0000bb80  r9 : 00000001  r8 : 00000000
[ 1379.012908] r7 : cf972f40  r6 : cf3e1f14  r5 : ce8ad000  r4 : cf3e1eb0
[ 1379.019805] r3 : 00000004  r2 : 00000005  r1 : 00000002  r0 : 00000000
[ 1379.026702] Flags: nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[ 1379.034240] Control: 10c5387d  Table: 831e8019  DAC: 00000015
[ 1379.040313] Process arecord (pid: 636, stack limit = 0xcf3fc2f8)
[ 1379.046661] Stack: (0xcf3fddf0 to 0xcf3fe000)
[ 1379.051269] dde0:                                     cf3e1eb0 ce8ad000 cf3fd
e5c cf3fde08
[ 1379.059906] de00: c030816c c0275338 cf3fde3c cf3fde18 c02f5d68 c02f59e4 c05b4
c60 ce8ad000
[ 1379.068542] de20: cf3e1800 00000001 00000004 00000001 cf3fde5c cf3e1800 ce8ad
800 c05b8310
[ 1379.077178] de40: ce8ad000 c0014728 cf3fc000 00000000 cf3fde7c cf3fde60 c02f0
b8c c0307fbc
[ 1379.085815] de60: cf3e1800 be91b890 be91b890 ce8ad000 cf3fdec4 cf3fde80 c02f1
778 c02f0ad4
[ 1379.094451] de80: cf3fc000 60000013 cf97b540 00000002 c0126484 00000000 cf3fd
ed4 cf3e1800
[ 1379.103088] dea0: be91b890 cf3e5078 c0045877 c0014728 cf3fc000 00000000 cf3fd
efc cf3fdec8
[ 1379.111755] dec0: c02f2150 c02f1228 cf3fdf3c cf3fded8 c0126634 c0068ef0 00000
001 00000000
[ 1379.120391] dee0: cf87f280 be91b890 cf3e5078 c0045877 cf3fdf0c cf3fdf00 c02f2
5dc c02f2124
[ 1379.129028] df00: cf3fdf7c cf3fdf10 c00fd6b4 c02f25ac c03d7328 cf8b49c8 00000
026 00000000
[ 1379.137664] df20: cd673738 00000002 cf3fc000 00000000 cf3fdf6c cf3fdf40 c00ec
138 c0126420
[ 1379.146301] df40: 00000000 00000000 00000006 cf8b49c0 be919140 00000000 cf87f
280 be91b890
[ 1379.154907] df60: c25c4111 00000004 c0014728 cf3fc000 cf3fdfa4 cf3fdf80 c00fd
c6c c00fd638
[ 1379.163543] df80: c00183f0 00000000 00028288 b6fc68a0 00028238 00000036 00000
000 cf3fdfa8
[ 1379.172180] dfa0: c00145a0 c00fdc38 00028288 b6fc68a0 00000004 c25c4111 be91b
890 00020001
[ 1379.180816] dfc0: 00028288 b6fc68a0 00028238 00000036 be91b890 0000bb80 0000a
c44 be91bb74
[ 1379.189453] dfe0: 00028288 be91b760 b6fa41c8 b6e05aec 20000010 00000004 007ff
f00 00ffdf00
[ 1379.198089] Backtrace:
[ 1379.200683] [<c027532c>] (usb_ifnum_to_if+0x0/0xd4) from [<c030816c>] (snd_us
b_hw_params+0x1bc/0x764)
[ 1379.210418]  r5:ce8ad000 r4:cf3e1eb0
[ 1379.214263] [<c0307fb0>] (snd_usb_hw_params+0x0/0x764) from [<c02f0b8c>] (snd
_pcm_hw_params+0xc4/0x368)
[ 1379.224182] [<c02f0ac8>] (snd_pcm_hw_params+0x0/0x368) from [<c02f1778>] (snd
_pcm_common_ioctl1+0x55c/0xefc)
[ 1379.234558]  r7:ce8ad000 r6:be91b890 r5:be91b890 r4:cf3e1800
[ 1379.240600] [<c02f121c>] (snd_pcm_common_ioctl1+0x0/0xefc) from [<c02f2150>]
(snd_pcm_capture_ioctl1+0x38/0x488)
[ 1379.251342] [<c02f2118>] (snd_pcm_capture_ioctl1+0x0/0x488) from [<c02f25dc>]
 (snd_pcm_capture_ioctl+0x3c/0x40)
[ 1379.261962]  r7:c0045877 r6:cf3e5078 r5:be91b890 r4:cf87f280
[ 1379.268005] [<c02f25a0>] (snd_pcm_capture_ioctl+0x0/0x40) from [<c00fd6b4>] (
do_vfs_ioctl+0x88/0x600)
[ 1379.277770] [<c00fd62c>] (do_vfs_ioctl+0x0/0x600) from [<c00fdc6c>] (sys_ioct
l+0x40/0x68)
[ 1379.286376]  r9:cf3fc000 r8:c0014728 r7:00000004 r6:c25c4111 r5:be91b890
r4:cf87f280
[ 1379.294738] [<c00fdc2c>] (sys_ioctl+0x0/0x68) from [<c00145a0>] (ret_fast_sys
call+0x0/0x30)
[ 1379.303558]  r7:00000036 r6:00028238 r5:b6fc68a0 r4:00028288
[ 1379.309600] Code: e89da818 e1a0c00d e92dd830 e24cb004 (e590329c)
[ 1379.316223] ---[ end trace 48c30133f24e0b57 ]---
[ 1379.321105] Kernel panic - not syncing: Fatal exception


[2]
[  349.573974] ------------[ cut here ]------------
[  349.578796] WARNING: at
/opt/mcastet/CIA/fidji-beta28/raptor/kernel/omap/lib/list_debug.c:48
list_del+0x30/0x8c()
[  349.589477] list_del corruption. prev->next should be d95efc44, but was 6b6b6b6b
[  349.597167] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso
atmel_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap2_mcspi omap_hsmmc
[  349.611572] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f7b4>]
(warn_slowpath_common+0x4c/0x64)
[  349.621368] [<c016f7b4>] (warn_slowpath_common+0x4c/0x64) from [<c016f84c>]
(warn_slowpath_fmt+0x2c/0x3c)
[  349.631347] [<c016f84c>] (warn_slowpath_fmt+0x2c/0x3c) from [<c0298200>]
(list_del+0x30/0x8c)
[  349.640228] [<c0298200>] (list_del+0x30/0x8c) from [<c0185d50>]
(remove_wait_queue+0x2c/0x6c)
[  349.649108] [<c0185d50>] (remove_wait_queue+0x2c/0x6c) from [<c01f4e64>]
(free_poll_entry+0x14/0x20)
[  349.658630] [<c01f4e64>] (free_poll_entry+0x14/0x20) from [<c01f4e88>]
(poll_freewait+0x18/0x6c)
[  349.667785] [<c01f4e88>] (poll_freewait+0x18/0x6c) from [<c01f5448>]
(do_sys_poll+0x314/0x3a4)
[  349.676757] [<c01f5448>] (do_sys_poll+0x314/0x3a4) from [<c01f56fc>]
(sys_poll+0x5c/0xbc)
[  349.685272] [<c01f56fc>] (sys_poll+0x5c/0xbc) from [<c0138f40>]
(ret_fast_syscall+0x0/0x30)
[  349.693969] ---[ end trace 1b75b31a2719ed1e ]---
[  349.698791] ------------[ cut here ]------------
[  349.703582] WARNING: at
/opt/mcastet/CIA/fidji-beta28/raptor/kernel/omap/lib/list_debug.c:51
list_del+0x58/0x8c()
[  349.714263] list_del corruption. next->prev should be d95efc44, but was 6b6b6b6b
[  349.721954] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso
atmel_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap2_mcspi omap_hsmmc
[  349.736328] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f7b4>]
(warn_slowpath_common+0x4c/0x64)
[  349.746124] [<c016f7b4>] (warn_slowpath_common+0x4c/0x64) from [<c016f84c>]
(warn_slowpath_fmt+0x2c/0x3c)
[  349.756103] [<c016f84c>] (warn_slowpath_fmt+0x2c/0x3c) from [<c0298228>]
(list_del+0x58/0x8c)
[  349.764984] [<c0298228>] (list_del+0x58/0x8c) from [<c0185d50>]
(remove_wait_queue+0x2c/0x6c)
[  349.773864] [<c0185d50>] (remove_wait_queue+0x2c/0x6c) from [<c01f4e64>]
(free_poll_entry+0x14/0x20)
[  349.783386] [<c01f4e64>] (free_poll_entry+0x14/0x20) from [<c01f4e88>]
(poll_freewait+0x18/0x6c)
[  349.792541] [<c01f4e88>] (poll_freewait+0x18/0x6c) from [<c01f5448>]
(do_sys_poll+0x314/0x3a4)
[  349.801513] [<c01f5448>] (do_sys_poll+0x314/0x3a4) from [<c01f56fc>]
(sys_poll+0x5c/0xbc)
[  349.810028] [<c01f56fc>] (sys_poll+0x5c/0xbc) from [<c0138f40>]
(ret_fast_syscall+0x0/0x30)
[  349.818725] ---[ end trace 1b75b31a2719ed1f ]---
[  349.830444] hub 1-1:1.0: unable to enumerate USB device on port 2
[  350.412475] Slab corruption: size-64 start=d7189ac0, len=64
[  350.420166] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b cc 9a 18 d7
[  350.426544] 010: cc 9a 18 d7 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b
[  350.435699] Prev obj: start=d7189a80, len=64
[  350.441284] 000: 02 26 00 00 c5 91 18 d7 84 93 18 d7 c4 9d 18 d7
[  350.447601] 010: 50 91 ad d3 50 9f 18 d7 50 95 ad d3 00 00 00 00
[  350.454650] Next obj: start=d7189b00, len=64
[  350.460083] 000: 5d 25 00 00 05 78 e5 d8 c4 9e 18 d7 44 13 6a d9
[  350.466613] 010: 91 13 6a d9 00 00 00 00 00 00 00 00 00 00 00 00

[-- Attachment #2: usb_audio_show_race.diff --]
[-- Type: text/x-diff, Size: 496 bytes --]

diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index f782ce1..7ffb394 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -453,6 +453,10 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
 	unsigned int channels, rate, format;
 	int ret, changed;
 
+	printk("in snd_usb_hw_params sleeping\n");
+	msleep(10000);
+	printk("in snd_usb_hw_params sleeping exit\n");
+
 	ret = snd_pcm_lib_alloc_vmalloc_buffer(substream,
 					       params_buffer_bytes(hw_params));
 	if (ret < 0)

[-- Attachment #3: usb_audio_show_use_after_free.diff --]
[-- Type: text/x-diff, Size: 607 bytes --]

diff --git a/sound/usb/card.c b/sound/usb/card.c
index 4a469f0..7c72e41 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -134,6 +134,7 @@ static void snd_usb_stream_disconnect(struct list_head *head)
 		subs->interface = -1;
 		subs->data_endpoint = NULL;
 		subs->sync_endpoint = NULL;
+		subs->dev = NULL;
 	}
 }
 
@@ -582,6 +583,7 @@ static void snd_usb_audio_disconnect(struct usb_device *dev,
 			snd_usb_mixer_disconnect(p);
 		}
 		usb_chip[chip->index] = NULL;
+		chip->dev = NULL;
 		mutex_unlock(&chip->shutdown_mutex);
 		mutex_unlock(&register_mutex);
 		snd_card_free_when_closed(card);

[-- Attachment #4: Type: text/plain, Size: 0 bytes --]

Re: usb audio race at disconnect time

[Alan Stern]

On Thu, 11 Oct 2012, Matthieu CASTET wrote:

> Hi,
> 
> while doing some monkey tests on a product we found races in usb audio code when
> the device in unplugged from usb (on linus master tree).
> 
> This can be reproduced with usb_audio_show_race.diff and CONFIG_DEBUG_SLAB.
> With this patch, start a stream :
> # arecord -D hw:0 -r 44100 -c 2  -f S16_LE > /dev/null
> you will see the kernel log : "in snd_usb_hw_params sleeping"
> Unplug the device before "in snd_usb_hw_params sleeping exit", and you will see
> an oops in snd_pcm_hw_params
> 
> 
> Instead of using CONFIG_DEBUG_SLAB, usb_audio_show_use_after_free.diff can show
> use after free by setting usb_device pointer to NULL in
> snd_usb_audio_disconnect. [1]
> 
> 
> In order to protect from all the races, before using any usb_device we need to
> check if it is not freed.

This should never be a problem.  Take a reference to the interface 
(usb_get_intf) and drop the reference (usb_put_intf) when you are 
finished accessing the usb_device structure.  This will prevent the 
usb_device from being deallocated while it is in use.

More important is a restriction you did not mention: Drivers are not 
allowed to communicate with a USB device after their disconnect routine 
has returned.

> What's the best way to do that ?

You could protect all occurrences of usb_submit_urb() with a spinlock.  
While holding the lock, check a flag to see if the disconnect routine
has been called.

In the disconnect routine, set this flag while holding the spinlock and 
then kill all the outstanding URBs.

I'm not very familiar with the snd-usb-audio driver; maybe it already 
does some of these things.

Alan Stern

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Takashi Iwai]

[Added Daniel and Clemens in the loop]

At Thu, 11 Oct 2012 17:17:59 +0200,
Matthieu CASTET wrote:
> 
> Hi,
> 
> while doing some monkey tests on a product we found races in usb audio code when
> the device in unplugged from usb (on linus master tree).
> 
> This can be reproduced with usb_audio_show_race.diff and CONFIG_DEBUG_SLAB.
> With this patch, start a stream :
> # arecord -D hw:0 -r 44100 -c 2  -f S16_LE > /dev/null
> you will see the kernel log : "in snd_usb_hw_params sleeping"
> Unplug the device before "in snd_usb_hw_params sleeping exit", and you will see
> an oops in snd_pcm_hw_params
> 
> 
> Instead of using CONFIG_DEBUG_SLAB, usb_audio_show_use_after_free.diff can show
> use after free by setting usb_device pointer to NULL in
> snd_usb_audio_disconnect. [1]
> 
> 
> In order to protect from all the races, before using any usb_device we need to
> check if it is not freed.
> 
> What's the best way to do that ?
> 
> A trival fix would be to take a mutex in all snd_pcm_ops callback that access usb :
> 
> {
> mutex_lock(&chip->shutdown_mutex);
> if (!chip->dev) {
> 	mutex_unlock(&chip->shutdown_mutex);
> 	return -ENODEV;
> }
> [...]
> mutex_unlock(&chip->shutdown_mutex);
> }
> 
> 
> But that will serialize all snd_pcm_ops callbacks.

We had already some protections but they don't cover the recent code
rewrites at all, so this bad result for now.

Yes, the easiest and maybe sane way would be to put the mutex in each
ops except for trigger.  open, close, hw_params, hw_free and prepare
are ops that don't need much parallelism, so this can be protected
well.  Or, we may introduce a new mutex per stream if we really want
parallel operations, but I don't think it's worth.

The trigger callback is an atomic ops, so it won't need the check.
Maybe the spinlock is needed to avoid the race in
snd_usb_stream_disconnect().

> Another solution could be to use refcounting or rwlock patern :
> - snd_pcm_ops callbacks call rdlock_trylock/rdlock_unlock
> - usb_driver disconnect callback take rwlock_lock and never release it

I don't think this is needed.

So... the below is a quick hack I did without testing at all.
Hopefully this can give some advance.


Takashi

---
diff --git a/sound/usb/card.c b/sound/usb/card.c
index 561bb74..115484e 100644
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -131,9 +131,13 @@ static void snd_usb_stream_disconnect(struct list_head *head)
 		subs = &as->substream[idx];
 		if (!subs->num_formats)
 			continue;
+		if (subs->pcm_substream)
+			snd_pcm_stream_lock_irq(subs->pcm_substream);
 		subs->interface = -1;
 		subs->data_endpoint = NULL;
 		subs->sync_endpoint = NULL;
+		if (subs->pcm_substream)
+			snd_pcm_stream_unlock_irq(subs->pcm_substream);
 	}
 }
 
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index 55e19e1..01e82ac 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -444,7 +444,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
 {
 	int ret;
 
-	mutex_lock(&subs->stream->chip->shutdown_mutex);
 	/* format changed */
 	stop_endpoints(subs, 0, 0, 0);
 	ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -455,7 +454,7 @@ static int configure_endpoint(struct snd_usb_substream *subs)
 					  subs->cur_audiofmt,
 					  subs->sync_endpoint);
 	if (ret < 0)
-		goto unlock;
+		return ret;
 
 	if (subs->sync_endpoint)
 		ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -466,8 +465,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
 						  subs->cur_audiofmt,
 						  NULL);
 
-unlock:
-	mutex_unlock(&subs->stream->chip->shutdown_mutex);
 	return ret;
 }
 
@@ -488,10 +485,15 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
 	struct audioformat *fmt;
 	int ret;
 
+	mutex_lock(&subs->stream->chip->shutdown_mutex);
+	if (subs->stream->chip->shutdown) {
+		ret = -ENODEV;
+		goto unlock;
+	}
 	ret = snd_pcm_lib_alloc_vmalloc_buffer(substream,
 					       params_buffer_bytes(hw_params));
 	if (ret < 0)
-		return ret;
+		goto unlock;
 
 	subs->pcm_format = params_format(hw_params);
 	subs->period_bytes = params_period_bytes(hw_params);
@@ -502,17 +504,20 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
 	if (!fmt) {
 		snd_printd(KERN_DEBUG "cannot set format: format = %#x, rate = %d, channels = %d\n",
 			   subs->pcm_format, subs->cur_rate, subs->channels);
-		return -EINVAL;
+		ret = -EINVAL;
+		goto unlock;
 	}
 
 	if ((ret = set_format(subs, fmt)) < 0)
-		return ret;
+		goto unlock;
 
 	subs->interface = fmt->iface;
 	subs->altset_idx = fmt->altset_idx;
 	subs->need_setup_ep = true;
 
-	return 0;
+ unlock:
+	mutex_unlock(&subs->stream->chip->shutdown_mutex);
+	return ret;
 }
 
 /*
@@ -547,17 +552,26 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
 	struct usb_interface *iface;
 	int ret;
 
+	mutex_lock(&subs->stream->chip->shutdown_mutex);
+	if (subs->stream->chip->shutdown) {
+		ret = -ENODEV;
+		goto unlock;
+	}
+
 	if (! subs->cur_audiofmt) {
 		snd_printk(KERN_ERR "usbaudio: no format is specified!\n");
-		return -ENXIO;
+		ret = -ENXIO;
+		goto unlock;
 	}
 
-	if (snd_BUG_ON(!subs->data_endpoint))
-		return -EIO;
+	if (snd_BUG_ON(!subs->data_endpoint)) {
+		ret = -EIO;
+		goto unlock;
+	}
 
 	ret = set_format(subs, subs->cur_audiofmt);
 	if (ret < 0)
-		return ret;
+		goto unlock;
 
 	iface = usb_ifnum_to_if(subs->dev, subs->cur_audiofmt->iface);
 	alts = &iface->altsetting[subs->cur_audiofmt->altset_idx];
@@ -567,12 +581,12 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
 				       subs->cur_audiofmt,
 				       subs->cur_rate);
 	if (ret < 0)
-		return ret;
+		goto unlock;
 
 	if (subs->need_setup_ep) {
 		ret = configure_endpoint(subs);
 		if (ret < 0)
-			return ret;
+			goto unlock;
 		subs->need_setup_ep = false;
 	}
 
@@ -592,8 +606,10 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
 	/* for playback, submit the URBs now; otherwise, the first hwptr_done
 	 * updates for all URBs would happen at the same time when starting */
 	if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
-		return start_endpoints(subs, 1);
+		ret = start_endpoints(subs, 1);
 
+ unlock:
+	mutex_unlock(&subs->stream->chip->shutdown_mutex);
 	return 0;
 }
 
@@ -980,14 +996,18 @@ static int snd_usb_pcm_open(struct snd_pcm_substream *substream, int direction)
 	struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
 	struct snd_pcm_runtime *runtime = substream->runtime;
 	struct snd_usb_substream *subs = &as->substream[direction];
+	int ret;
 
+	mutex_lock(&as->chip->shutdown_mutex);
 	subs->interface = -1;
 	subs->altset_idx = 0;
 	runtime->hw = snd_usb_hardware;
 	runtime->private_data = subs;
 	subs->pcm_substream = substream;
 	/* runtime PM is also done there */
-	return setup_hw_info(runtime, subs);
+	ret = setup_hw_info(runtime, subs);
+	mutex_unlock(&as->chip->shutdown_mutex);
+	return ret;
 }
 
 static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
@@ -995,6 +1015,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
 	struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
 	struct snd_usb_substream *subs = &as->substream[direction];
 
+	mutex_lock(&as->chip->shutdown_mutex);
 	stop_endpoints(subs, 0, 0, 0);
 
 	if (!as->chip->shutdown && subs->interface >= 0) {
@@ -1004,6 +1025,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
 
 	subs->pcm_substream = NULL;
 	snd_usb_autosuspend(subs->stream->chip);
+	mutex_unlock(&as->chip->shutdown_mutex);
 
 	return 0;
 }
@@ -1222,6 +1244,9 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea
 {
 	struct snd_usb_substream *subs = substream->runtime->private_data;
 
+	if (subs->stream->chip->shutdown)
+		return -ENODEV;
+
 	switch (cmd) {
 	case SNDRV_PCM_TRIGGER_START:
 	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [alsa-devel] usb audio race at disconnect time

[Takashi Iwai]

At Thu, 11 Oct 2012 18:41:52 +0200,
Takashi Iwai wrote:
> 
> [Added Daniel and Clemens in the loop]
> 
> At Thu, 11 Oct 2012 17:17:59 +0200,
> Matthieu CASTET wrote:
> > 
> > Hi,
> > 
> > while doing some monkey tests on a product we found races in usb audio code when
> > the device in unplugged from usb (on linus master tree).
> > 
> > This can be reproduced with usb_audio_show_race.diff and CONFIG_DEBUG_SLAB.
> > With this patch, start a stream :
> > # arecord -D hw:0 -r 44100 -c 2  -f S16_LE > /dev/null
> > you will see the kernel log : "in snd_usb_hw_params sleeping"
> > Unplug the device before "in snd_usb_hw_params sleeping exit", and you will see
> > an oops in snd_pcm_hw_params
> > 
> > 
> > Instead of using CONFIG_DEBUG_SLAB, usb_audio_show_use_after_free.diff can show
> > use after free by setting usb_device pointer to NULL in
> > snd_usb_audio_disconnect. [1]
> > 
> > 
> > In order to protect from all the races, before using any usb_device we need to
> > check if it is not freed.
> > 
> > What's the best way to do that ?
> > 
> > A trival fix would be to take a mutex in all snd_pcm_ops callback that access usb :
> > 
> > {
> > mutex_lock(&chip->shutdown_mutex);
> > if (!chip->dev) {
> > 	mutex_unlock(&chip->shutdown_mutex);
> > 	return -ENODEV;
> > }
> > [...]
> > mutex_unlock(&chip->shutdown_mutex);
> > }
> > 
> > 
> > But that will serialize all snd_pcm_ops callbacks.
> 
> We had already some protections but they don't cover the recent code
> rewrites at all, so this bad result for now.
> 
> Yes, the easiest and maybe sane way would be to put the mutex in each
> ops except for trigger.  open, close, hw_params, hw_free and prepare
> are ops that don't need much parallelism, so this can be protected
> well.  Or, we may introduce a new mutex per stream if we really want
> parallel operations, but I don't think it's worth.
> 
> The trigger callback is an atomic ops, so it won't need the check.
> Maybe the spinlock is needed to avoid the race in
> snd_usb_stream_disconnect().
> 
> > Another solution could be to use refcounting or rwlock patern :
> > - snd_pcm_ops callbacks call rdlock_trylock/rdlock_unlock
> > - usb_driver disconnect callback take rwlock_lock and never release it
> 
> I don't think this is needed.
> 
> So... the below is a quick hack I did without testing at all.
> Hopefully this can give some advance.

I checked this issue again actually with a real machine, and tried a
bit better version.  I'm going to send a series of fix patches.


Takashi
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Matthieu CASTET]

Hi,


Takashi Iwai a écrit :
> [Added Daniel and Clemens in the loop]
> 
> 
> I don't think this is needed.
> 
> So... the below is a quick hack I did without testing at all.
> Hopefully this can give some advance.
Thanks for the quick patch.

The patch didn't apply cleany of linus tree, of which tree is based your patch ?

It solve the race in snd_usb_hw_params.

But I wonder if snd_usb_substream_playback_trigger,
snd_usb_substream_capture_trigger, snd_usb_pcm_pointer are safe : they don't
take shutdown_mutex.

Also it is hard to check if everything is safe. Sometimes the chip->shutdown is
far from the shutdown_mutex. For example snd_usb_pcm_open take shutdown_mutex,
but the check is done in snd_usb_autoresume.

I will do more testing.

Thanks,

Matthieu
> 
> 
> Takashi
> 
> ---
> diff --git a/sound/usb/card.c b/sound/usb/card.c
> index 561bb74..115484e 100644
> --- a/sound/usb/card.c
> +++ b/sound/usb/card.c
> @@ -131,9 +131,13 @@ static void snd_usb_stream_disconnect(struct list_head *head)
>  		subs = &as->substream[idx];
>  		if (!subs->num_formats)
>  			continue;
> +		if (subs->pcm_substream)
> +			snd_pcm_stream_lock_irq(subs->pcm_substream);
>  		subs->interface = -1;
>  		subs->data_endpoint = NULL;
>  		subs->sync_endpoint = NULL;
> +		if (subs->pcm_substream)
> +			snd_pcm_stream_unlock_irq(subs->pcm_substream);
>  	}
>  }
>  
> diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
> index 55e19e1..01e82ac 100644
> --- a/sound/usb/pcm.c
> +++ b/sound/usb/pcm.c
> @@ -444,7 +444,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
>  {
>  	int ret;
>  
> -	mutex_lock(&subs->stream->chip->shutdown_mutex);
>  	/* format changed */
>  	stop_endpoints(subs, 0, 0, 0);
>  	ret = snd_usb_endpoint_set_params(subs->data_endpoint,
> @@ -455,7 +454,7 @@ static int configure_endpoint(struct snd_usb_substream *subs)
>  					  subs->cur_audiofmt,
>  					  subs->sync_endpoint);
>  	if (ret < 0)
> -		goto unlock;
> +		return ret;
>  
>  	if (subs->sync_endpoint)
>  		ret = snd_usb_endpoint_set_params(subs->data_endpoint,
> @@ -466,8 +465,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
>  						  subs->cur_audiofmt,
>  						  NULL);
>  
> -unlock:
> -	mutex_unlock(&subs->stream->chip->shutdown_mutex);
>  	return ret;
>  }
>  
> @@ -488,10 +485,15 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
>  	struct audioformat *fmt;
>  	int ret;
>  
> +	mutex_lock(&subs->stream->chip->shutdown_mutex);
> +	if (subs->stream->chip->shutdown) {
> +		ret = -ENODEV;
> +		goto unlock;
> +	}
>  	ret = snd_pcm_lib_alloc_vmalloc_buffer(substream,
>  					       params_buffer_bytes(hw_params));
>  	if (ret < 0)
> -		return ret;
> +		goto unlock;
>  
>  	subs->pcm_format = params_format(hw_params);
>  	subs->period_bytes = params_period_bytes(hw_params);
> @@ -502,17 +504,20 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
>  	if (!fmt) {
>  		snd_printd(KERN_DEBUG "cannot set format: format = %#x, rate = %d, channels = %d\n",
>  			   subs->pcm_format, subs->cur_rate, subs->channels);
> -		return -EINVAL;
> +		ret = -EINVAL;
> +		goto unlock;
>  	}
>  
>  	if ((ret = set_format(subs, fmt)) < 0)
> -		return ret;
> +		goto unlock;
>  
>  	subs->interface = fmt->iface;
>  	subs->altset_idx = fmt->altset_idx;
>  	subs->need_setup_ep = true;
>  
> -	return 0;
> + unlock:
> +	mutex_unlock(&subs->stream->chip->shutdown_mutex);
> +	return ret;
>  }
>  
>  /*
> @@ -547,17 +552,26 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
>  	struct usb_interface *iface;
>  	int ret;
>  
> +	mutex_lock(&subs->stream->chip->shutdown_mutex);
> +	if (subs->stream->chip->shutdown) {
> +		ret = -ENODEV;
> +		goto unlock;
> +	}
> +
>  	if (! subs->cur_audiofmt) {
>  		snd_printk(KERN_ERR "usbaudio: no format is specified!\n");
> -		return -ENXIO;
> +		ret = -ENXIO;
> +		goto unlock;
>  	}
>  
> -	if (snd_BUG_ON(!subs->data_endpoint))
> -		return -EIO;
> +	if (snd_BUG_ON(!subs->data_endpoint)) {
> +		ret = -EIO;
> +		goto unlock;
> +	}
>  
>  	ret = set_format(subs, subs->cur_audiofmt);
>  	if (ret < 0)
> -		return ret;
> +		goto unlock;
>  
>  	iface = usb_ifnum_to_if(subs->dev, subs->cur_audiofmt->iface);
>  	alts = &iface->altsetting[subs->cur_audiofmt->altset_idx];
> @@ -567,12 +581,12 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
>  				       subs->cur_audiofmt,
>  				       subs->cur_rate);
>  	if (ret < 0)
> -		return ret;
> +		goto unlock;
>  
>  	if (subs->need_setup_ep) {
>  		ret = configure_endpoint(subs);
>  		if (ret < 0)
> -			return ret;
> +			goto unlock;
>  		subs->need_setup_ep = false;
>  	}
>  
> @@ -592,8 +606,10 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
>  	/* for playback, submit the URBs now; otherwise, the first hwptr_done
>  	 * updates for all URBs would happen at the same time when starting */
>  	if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
> -		return start_endpoints(subs, 1);
> +		ret = start_endpoints(subs, 1);
>  
> + unlock:
> +	mutex_unlock(&subs->stream->chip->shutdown_mutex);
>  	return 0;
>  }
>  
> @@ -980,14 +996,18 @@ static int snd_usb_pcm_open(struct snd_pcm_substream *substream, int direction)
>  	struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
>  	struct snd_pcm_runtime *runtime = substream->runtime;
>  	struct snd_usb_substream *subs = &as->substream[direction];
> +	int ret;
>  
> +	mutex_lock(&as->chip->shutdown_mutex);
>  	subs->interface = -1;
>  	subs->altset_idx = 0;
>  	runtime->hw = snd_usb_hardware;
>  	runtime->private_data = subs;
>  	subs->pcm_substream = substream;
>  	/* runtime PM is also done there */
> -	return setup_hw_info(runtime, subs);
> +	ret = setup_hw_info(runtime, subs);
> +	mutex_unlock(&as->chip->shutdown_mutex);
> +	return ret;
>  }
>  
>  static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
> @@ -995,6 +1015,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
>  	struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
>  	struct snd_usb_substream *subs = &as->substream[direction];
>  
> +	mutex_lock(&as->chip->shutdown_mutex);
>  	stop_endpoints(subs, 0, 0, 0);
>  
>  	if (!as->chip->shutdown && subs->interface >= 0) {
> @@ -1004,6 +1025,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
>  
>  	subs->pcm_substream = NULL;
>  	snd_usb_autosuspend(subs->stream->chip);
> +	mutex_unlock(&as->chip->shutdown_mutex);
>  
>  	return 0;
>  }
> @@ -1222,6 +1244,9 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea
>  {
>  	struct snd_usb_substream *subs = substream->runtime->private_data;
>  
> +	if (subs->stream->chip->shutdown)
> +		return -ENODEV;
> +
>  	switch (cmd) {
>  	case SNDRV_PCM_TRIGGER_START:
>  	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Takashi Iwai]

At Fri, 12 Oct 2012 17:42:19 +0200,
Matthieu CASTET wrote:
> 
> Hi,
> 
> 
> Takashi Iwai a écrit :
> > [Added Daniel and Clemens in the loop]
> > 
> > 
> > I don't think this is needed.
> > 
> > So... the below is a quick hack I did without testing at all.
> > Hopefully this can give some advance.
> Thanks for the quick patch.
> 
> The patch didn't apply cleany of linus tree, of which tree is based your patch ?

Did you try the second one?
The second one covers races in more places.

The only uncovered place is the autosuspend stuff in mixer.c (for PCM,
it's used only in open/close, so it's no problem).  I'll fix it later.


thanks,

Takashi

> 
> It solve the race in snd_usb_hw_params.
> 
> But I wonder if snd_usb_substream_playback_trigger,
> snd_usb_substream_capture_trigger, snd_usb_pcm_pointer are safe : they don't
> take shutdown_mutex.
> 
> Also it is hard to check if everything is safe. Sometimes the chip->shutdown is
> far from the shutdown_mutex. For example snd_usb_pcm_open take shutdown_mutex,
> but the check is done in snd_usb_autoresume.
> 
> I will do more testing.
> 
> Thanks,
> 
> Matthieu
> > 
> > 
> > Takashi
> > 
> > ---
> > diff --git a/sound/usb/card.c b/sound/usb/card.c
> > index 561bb74..115484e 100644
> > --- a/sound/usb/card.c
> > +++ b/sound/usb/card.c
> > @@ -131,9 +131,13 @@ static void snd_usb_stream_disconnect(struct list_head *head)
> >  		subs = &as->substream[idx];
> >  		if (!subs->num_formats)
> >  			continue;
> > +		if (subs->pcm_substream)
> > +			snd_pcm_stream_lock_irq(subs->pcm_substream);
> >  		subs->interface = -1;
> >  		subs->data_endpoint = NULL;
> >  		subs->sync_endpoint = NULL;
> > +		if (subs->pcm_substream)
> > +			snd_pcm_stream_unlock_irq(subs->pcm_substream);
> >  	}
> >  }
> >  
> > diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
> > index 55e19e1..01e82ac 100644
> > --- a/sound/usb/pcm.c
> > +++ b/sound/usb/pcm.c
> > @@ -444,7 +444,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
> >  {
> >  	int ret;
> >  
> > -	mutex_lock(&subs->stream->chip->shutdown_mutex);
> >  	/* format changed */
> >  	stop_endpoints(subs, 0, 0, 0);
> >  	ret = snd_usb_endpoint_set_params(subs->data_endpoint,
> > @@ -455,7 +454,7 @@ static int configure_endpoint(struct snd_usb_substream *subs)
> >  					  subs->cur_audiofmt,
> >  					  subs->sync_endpoint);
> >  	if (ret < 0)
> > -		goto unlock;
> > +		return ret;
> >  
> >  	if (subs->sync_endpoint)
> >  		ret = snd_usb_endpoint_set_params(subs->data_endpoint,
> > @@ -466,8 +465,6 @@ static int configure_endpoint(struct snd_usb_substream *subs)
> >  						  subs->cur_audiofmt,
> >  						  NULL);
> >  
> > -unlock:
> > -	mutex_unlock(&subs->stream->chip->shutdown_mutex);
> >  	return ret;
> >  }
> >  
> > @@ -488,10 +485,15 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
> >  	struct audioformat *fmt;
> >  	int ret;
> >  
> > +	mutex_lock(&subs->stream->chip->shutdown_mutex);
> > +	if (subs->stream->chip->shutdown) {
> > +		ret = -ENODEV;
> > +		goto unlock;
> > +	}
> >  	ret = snd_pcm_lib_alloc_vmalloc_buffer(substream,
> >  					       params_buffer_bytes(hw_params));
> >  	if (ret < 0)
> > -		return ret;
> > +		goto unlock;
> >  
> >  	subs->pcm_format = params_format(hw_params);
> >  	subs->period_bytes = params_period_bytes(hw_params);
> > @@ -502,17 +504,20 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream,
> >  	if (!fmt) {
> >  		snd_printd(KERN_DEBUG "cannot set format: format = %#x, rate = %d, channels = %d\n",
> >  			   subs->pcm_format, subs->cur_rate, subs->channels);
> > -		return -EINVAL;
> > +		ret = -EINVAL;
> > +		goto unlock;
> >  	}
> >  
> >  	if ((ret = set_format(subs, fmt)) < 0)
> > -		return ret;
> > +		goto unlock;
> >  
> >  	subs->interface = fmt->iface;
> >  	subs->altset_idx = fmt->altset_idx;
> >  	subs->need_setup_ep = true;
> >  
> > -	return 0;
> > + unlock:
> > +	mutex_unlock(&subs->stream->chip->shutdown_mutex);
> > +	return ret;
> >  }
> >  
> >  /*
> > @@ -547,17 +552,26 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
> >  	struct usb_interface *iface;
> >  	int ret;
> >  
> > +	mutex_lock(&subs->stream->chip->shutdown_mutex);
> > +	if (subs->stream->chip->shutdown) {
> > +		ret = -ENODEV;
> > +		goto unlock;
> > +	}
> > +
> >  	if (! subs->cur_audiofmt) {
> >  		snd_printk(KERN_ERR "usbaudio: no format is specified!\n");
> > -		return -ENXIO;
> > +		ret = -ENXIO;
> > +		goto unlock;
> >  	}
> >  
> > -	if (snd_BUG_ON(!subs->data_endpoint))
> > -		return -EIO;
> > +	if (snd_BUG_ON(!subs->data_endpoint)) {
> > +		ret = -EIO;
> > +		goto unlock;
> > +	}
> >  
> >  	ret = set_format(subs, subs->cur_audiofmt);
> >  	if (ret < 0)
> > -		return ret;
> > +		goto unlock;
> >  
> >  	iface = usb_ifnum_to_if(subs->dev, subs->cur_audiofmt->iface);
> >  	alts = &iface->altsetting[subs->cur_audiofmt->altset_idx];
> > @@ -567,12 +581,12 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
> >  				       subs->cur_audiofmt,
> >  				       subs->cur_rate);
> >  	if (ret < 0)
> > -		return ret;
> > +		goto unlock;
> >  
> >  	if (subs->need_setup_ep) {
> >  		ret = configure_endpoint(subs);
> >  		if (ret < 0)
> > -			return ret;
> > +			goto unlock;
> >  		subs->need_setup_ep = false;
> >  	}
> >  
> > @@ -592,8 +606,10 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream)
> >  	/* for playback, submit the URBs now; otherwise, the first hwptr_done
> >  	 * updates for all URBs would happen at the same time when starting */
> >  	if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
> > -		return start_endpoints(subs, 1);
> > +		ret = start_endpoints(subs, 1);
> >  
> > + unlock:
> > +	mutex_unlock(&subs->stream->chip->shutdown_mutex);
> >  	return 0;
> >  }
> >  
> > @@ -980,14 +996,18 @@ static int snd_usb_pcm_open(struct snd_pcm_substream *substream, int direction)
> >  	struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
> >  	struct snd_pcm_runtime *runtime = substream->runtime;
> >  	struct snd_usb_substream *subs = &as->substream[direction];
> > +	int ret;
> >  
> > +	mutex_lock(&as->chip->shutdown_mutex);
> >  	subs->interface = -1;
> >  	subs->altset_idx = 0;
> >  	runtime->hw = snd_usb_hardware;
> >  	runtime->private_data = subs;
> >  	subs->pcm_substream = substream;
> >  	/* runtime PM is also done there */
> > -	return setup_hw_info(runtime, subs);
> > +	ret = setup_hw_info(runtime, subs);
> > +	mutex_unlock(&as->chip->shutdown_mutex);
> > +	return ret;
> >  }
> >  
> >  static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
> > @@ -995,6 +1015,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
> >  	struct snd_usb_stream *as = snd_pcm_substream_chip(substream);
> >  	struct snd_usb_substream *subs = &as->substream[direction];
> >  
> > +	mutex_lock(&as->chip->shutdown_mutex);
> >  	stop_endpoints(subs, 0, 0, 0);
> >  
> >  	if (!as->chip->shutdown && subs->interface >= 0) {
> > @@ -1004,6 +1025,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
> >  
> >  	subs->pcm_substream = NULL;
> >  	snd_usb_autosuspend(subs->stream->chip);
> > +	mutex_unlock(&as->chip->shutdown_mutex);
> >  
> >  	return 0;
> >  }
> > @@ -1222,6 +1244,9 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea
> >  {
> >  	struct snd_usb_substream *subs = substream->runtime->private_data;
> >  
> > +	if (subs->stream->chip->shutdown)
> > +		return -ENODEV;
> > +
> >  	switch (cmd) {
> >  	case SNDRV_PCM_TRIGGER_START:
> >  	case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
> > 
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Matthieu CASTET]

[-- Attachment #1: Type: text/plain, Size: 6866 bytes --]

Hi Takashi,

Takashi Iwai a écrit :
> At Fri, 12 Oct 2012 17:42:19 +0200,
> Matthieu CASTET wrote:
>> Hi,
>>
>>
>> Takashi Iwai a écrit :
>>> [Added Daniel and Clemens in the loop]
>>>
>>>
>>> I don't think this is needed.
>>>
>>> So... the below is a quick hack I did without testing at all.
>>> Hopefully this can give some advance.
>> Thanks for the quick patch.
>>
>> The patch didn't apply cleany of linus tree, of which tree is based your patch ?
> 
> Did you try the second one?
> The second one covers races in more places.
> 
> The only uncovered place is the autosuspend stuff in mixer.c (for PCM,
> it's used only in open/close, so it's no problem).  I'll fix it later.
> 
> 
I didn't have time to test your latest patches : I will test them tomorrow.
On which git tree are they based ? gregkh/usb.git ?


But I believe I found other races in the alsa char device handling. With the
attached patch, if you disconnect the usb audio device between "msleep o" and
"msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].

I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...

Matthieu


[1]
[   30.768341] Alignment trap: not handling instruction e1960f9f at [<c0087ba4>]
[   30.775878] Unhandled fault: alignment exception (0x001) at 0x6b6b6c6f
[   30.782775] Internal error: : 1 [#1] SMP ARM
[   30.787292] Modules linked in:
[   30.790557] CPU: 0    Tainted: G        W     (3.6.0-03888-g9c0226d-dirty #25)
[   30.798187] PC is at __lock_acquire.clone.19+0x164/0xd40
[   30.803802] LR is at lock_acquire+0x5c/0x70
[   30.808227] pc : [<c0087ba8>]    lr : [<c0088d54>]    psr: 20000093
[   30.808227] sp : cd727c70  ip : 00000001  fp : cd727ccc
[   30.820343] r10: c05c3994  r9 : c328c218  r8 : 6b6b6b6b
[   30.825866] r7 : cd74f640  r6 : 6b6b6c6f  r5 : c05a4d5c  r4 : cd726000
[   30.832763] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : c328c218
[   30.839660] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[   30.847290] Control: 10c5387d  Table: 8329c019  DAC: 00000015
[   30.853363] Process arecord (pid: 635, stack limit = 0xcd7262f8)
[   30.859680] Stack: (0xcd727c70 to 0xcd728000)
[   30.864288] 7c60:                                     000000ec 00000000
c059ce68 00000001
[   30.872955] 7c80: 00000000 c05c2cc0 00000009 c059ce38 60000013 00000004
cd727d14 cd727ca8
[   30.881591] 7ca0: c00455b0 00000000 cd726000 60000013 cd74f640 c09c7d70
00000024 c3297440
[   30.890228] 7cc0: cd727cfc cd727cd0 c0088d54 c0087a50 00000000 00000000
c02e3984 00000000
[   30.898864] 7ce0: c328c208 00000001 c318cf40 c328c208 cd727d24 cd727d00
c03d8274 c0088d04
[   30.907501] 7d00: 00000001 00000000 c02e3984 c32c7a48 c328c000 c32c7a48
cd727d44 cd727d28
[   30.916107] 7d20: c02e3984 c03d824c c32c7a48 c328c000 00000000 07400000
cd727d64 cd727d48
[   30.924774] 7d40: c02e68cc c02e3940 c04042d0 c32c7a48 c3291b20 07400000
cd727d8c cd727d68
[   30.933380] 7d60: c02e3494 c02e6868 c3291b20 c32c7a48 cf9f83c0 00000000
c00f18c8 00000000
[   30.942047] 7d80: cd727db4 cd727d90 c00f1960 c02e33f8 c00eedcc 00000000
c32c7a48 c3291b20
[   30.950683] 7da0: c32c7a50 00000001 cd727ddc cd727db8 c00eb8b0 c00f18d4
cd727ea0 cd727f60
[   30.959320] 7dc0: 00000000 00000000 cd727e98 00000000 cd727df4 cd727de0
c00eb96c c00eb6ec
[   30.967956] 7de0: cd727ea0 cd727ee0 cd727e6c cd727df8 c00fb974 c00eb950
cd727e6c cd727e08
[   30.976593] 7e00: c00f8bd4 c00f8b1c c00f97fc 00000000 cd727ee0 00000001
00000000 cd727ee8
[   30.985229] 7e20: 00000000 00000000 cf737178 c32c7a48 00000000 00000000
c3291b20 cd67f848
[   30.993865] 7e40: 00000020 cd727ee0 c32c7a48 cd727f60 cd727e98 00000000
cd727ea0 cd726000
[   31.002502] 7e60: cd727ed4 cd727e70 c00fc028 c00fb39c cd727ea0 cd727e80
00000000 c32cad64
[   31.011138] 7e80: cd74f640 00000000 cd74f968 00000000 00000004 00000000
cf815e58 cf74a8f8
[   31.019775] 7ea0: 00000000 00000000 cd726000 cd727f60 00000001 ffffff9c
cfb07000 ffffff9c
[   31.028411] 7ec0: cd726000 00000000 cd727f54 cd727ed8 c00fc730 c00fbf84
00000041 00000000
[   31.037048] 7ee0: cf815e58 cf74a8f8 35c12985 00000009 cfb07009 cd727e30
00000000 cf4fcb38
[   31.045684] 7f00: c3291b20 00000101 00000008 00000000 00000000 cd773e98
cd727f54 cd727f28
[   31.054321] 7f20: c0109814 c03d8818 00000000 cfb07000 00000000 00026150
cfb07000 00000000
[   31.062957] 7f40: 00000003 00000001 cd727f94 cd727f58 c00ec7bc c00fc708
00000000 cd726000
[   31.071594] 7f60: 00000000 00000000 00000024 00000100 becb28da b6eef8a0
00026150 00000005
[   31.080261] 7f80: c0014728 00000000 cd727fa4 cd727f98 c00ec880 c00ec6d8
00000000 cd727fa8
[   31.088897] 7fa0: c00145a0 c00ec864 becb28da b6eef8a0 becb28da 00000000
becb28ec ffffffff
[   31.097534] 7fc0: becb28da b6eef8a0 00026150 00000005 00000001 0001c3b8
000260b8 ffffffff
[   31.106170] 7fe0: 00000000 becb28d8 b6ea8c10 b6dc078c 60000010 becb28da
de10c4ff be918a5f
[   31.114807] Backtrace:
[   31.117401] [<c0087a44>] (__lock_acquire.clone.19+0x0/0xd40) from
[<c0088d54>] (lock_acquire+0x5c/0x70)
[   31.127349] [<c0088cf8>] (lock_acquire+0x0/0x70) from [<c03d8274>]
(_raw_spin_lock+0x34/0x44)
[   31.136322]  r7:c328c208 r6:c318cf40 r5:00000001 r4:c328c208
[   31.142364] [<c03d8240>] (_raw_spin_lock+0x0/0x44) from [<c02e3984>]
(snd_card_file_add+0x50/0xc0)
[   31.151824]  r5:c32c7a48 r4:c328c000
[   31.155639] [<c02e3934>] (snd_card_file_add+0x0/0xc0) from [<c02e68cc>]
(snd_ctl_open+0x70/0x190)
[   31.164978]  r7:07400000 r6:00000000 r5:c328c000 r4:c32c7a48
[   31.170989] [<c02e685c>] (snd_ctl_open+0x0/0x190) from [<c02e3494>]
(snd_open+0xa8/0x1a0)
[   31.179595]  r7:07400000 r6:c3291b20 r5:c32c7a48 r4:c04042d0
[   31.185638] [<c02e33ec>] (snd_open+0x0/0x1a0) from [<c00f1960>]
(chrdev_open+0x98/0x160)
[   31.194183] [<c00f18c8>] (chrdev_open+0x0/0x160) from [<c00eb8b0>]
(do_dentry_open.clone.18+0x1d0/0x264)
[   31.204193]  r7:00000001 r6:c32c7a50 r5:c3291b20 r4:c32c7a48
[   31.210205] [<c00eb6e0>] (do_dentry_open.clone.18+0x0/0x264) from
[<c00eb96c>] (finish_open+0x28/0x40)
[   31.220062] [<c00eb944>] (finish_open+0x0/0x40) from [<c00fb974>]
(do_last.clone.40+0x5e4/0xbe8)
[   31.229309]  r4:cd727ee0 r3:cd727ea0
[   31.233123] [<c00fb390>] (do_last.clone.40+0x0/0xbe8) from [<c00fc028>]
(path_openat+0xb0/0x488)
[   31.242401] [<c00fbf78>] (path_openat+0x0/0x488) from [<c00fc730>]
(do_filp_open+0x34/0x88)
[   31.251190] [<c00fc6fc>] (do_filp_open+0x0/0x88) from [<c00ec7bc>]
(do_sys_open+0xf0/0x18c)
[   31.260009]  r7:00000001 r6:00000003 r5:00000000 r4:cfb07000
[   31.266021] [<c00ec6cc>] (do_sys_open+0x0/0x18c) from [<c00ec880>]
(sys_open+0x28/0x2c)
[   31.274475] [<c00ec858>] (sys_open+0x0/0x2c) from [<c00145a0>]
(ret_fast_syscall+0x0/0x30)
[   31.283203] Code: e3580000 0affffbe e2886f41 e1960f9f (e2800001)
[   31.289642] ---[ end trace e749a1146c99522c ]---
[   31.294525] Kernel panic - not syncing: Fatal exception

[-- Attachment #2: diff --]
[-- Type: text/plain, Size: 661 bytes --]

diff --git a/sound/core/control.c b/sound/core/control.c
index 2487a6b..34c80d4 100644
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -45,6 +45,7 @@ static LIST_HEAD(snd_control_ioctls);
 static LIST_HEAD(snd_control_compat_ioctls);
 #endif
 
+#include <linux/delay.h>
 static int snd_ctl_open(struct inode *inode, struct file *file)
 {
 	unsigned long flags;
@@ -61,6 +62,10 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
 		err = -ENODEV;
 		goto __error1;
 	}
+       printk("msleep o %p\n", card);
+       msleep(5000);
+       printk("msleep o+\n");
+
 	err = snd_card_file_add(card, file);
 	if (err < 0) {
 		err = -ENODEV;

Re: usb audio race at disconnect time

[Takashi Iwai]

At Mon, 15 Oct 2012 19:41:40 +0200,
Matthieu CASTET wrote:
> 
> Hi Takashi,
> 
> Takashi Iwai a écrit :
> > At Fri, 12 Oct 2012 17:42:19 +0200,
> > Matthieu CASTET wrote:
> >> Hi,
> >>
> >>
> >> Takashi Iwai a écrit :
> >>> [Added Daniel and Clemens in the loop]
> >>>
> >>>
> >>> I don't think this is needed.
> >>>
> >>> So... the below is a quick hack I did without testing at all.
> >>> Hopefully this can give some advance.
> >> Thanks for the quick patch.
> >>
> >> The patch didn't apply cleany of linus tree, of which tree is based your patch ?
> > 
> > Did you try the second one?
> > The second one covers races in more places.
> > 
> > The only uncovered place is the autosuspend stuff in mixer.c (for PCM,
> > it's used only in open/close, so it's no problem).  I'll fix it later.
> > 
> > 
> I didn't have time to test your latest patches : I will test them tomorrow.
> On which git tree are they based ? gregkh/usb.git ?

3.7-rc1.

> But I believe I found other races in the alsa char device handling. With the
> attached patch, if you disconnect the usb audio device between "msleep o" and
> "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
> 
> I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...

OK, we'd need a generic open/close protection.
For PCM, there is already a fix in my last patchset, so it should
work, but for other devices, the paths are still uncovered.


Takashi


> 
> Matthieu
> 
> 
> [1]
> [   30.768341] Alignment trap: not handling instruction e1960f9f at [<c0087ba4>]
> [   30.775878] Unhandled fault: alignment exception (0x001) at 0x6b6b6c6f
> [   30.782775] Internal error: : 1 [#1] SMP ARM
> [   30.787292] Modules linked in:
> [   30.790557] CPU: 0    Tainted: G        W     (3.6.0-03888-g9c0226d-dirty #25)
> [   30.798187] PC is at __lock_acquire.clone.19+0x164/0xd40
> [   30.803802] LR is at lock_acquire+0x5c/0x70
> [   30.808227] pc : [<c0087ba8>]    lr : [<c0088d54>]    psr: 20000093
> [   30.808227] sp : cd727c70  ip : 00000001  fp : cd727ccc
> [   30.820343] r10: c05c3994  r9 : c328c218  r8 : 6b6b6b6b
> [   30.825866] r7 : cd74f640  r6 : 6b6b6c6f  r5 : c05a4d5c  r4 : cd726000
> [   30.832763] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : c328c218
> [   30.839660] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
> [   30.847290] Control: 10c5387d  Table: 8329c019  DAC: 00000015
> [   30.853363] Process arecord (pid: 635, stack limit = 0xcd7262f8)
> [   30.859680] Stack: (0xcd727c70 to 0xcd728000)
> [   30.864288] 7c60:                                     000000ec 00000000
> c059ce68 00000001
> [   30.872955] 7c80: 00000000 c05c2cc0 00000009 c059ce38 60000013 00000004
> cd727d14 cd727ca8
> [   30.881591] 7ca0: c00455b0 00000000 cd726000 60000013 cd74f640 c09c7d70
> 00000024 c3297440
> [   30.890228] 7cc0: cd727cfc cd727cd0 c0088d54 c0087a50 00000000 00000000
> c02e3984 00000000
> [   30.898864] 7ce0: c328c208 00000001 c318cf40 c328c208 cd727d24 cd727d00
> c03d8274 c0088d04
> [   30.907501] 7d00: 00000001 00000000 c02e3984 c32c7a48 c328c000 c32c7a48
> cd727d44 cd727d28
> [   30.916107] 7d20: c02e3984 c03d824c c32c7a48 c328c000 00000000 07400000
> cd727d64 cd727d48
> [   30.924774] 7d40: c02e68cc c02e3940 c04042d0 c32c7a48 c3291b20 07400000
> cd727d8c cd727d68
> [   30.933380] 7d60: c02e3494 c02e6868 c3291b20 c32c7a48 cf9f83c0 00000000
> c00f18c8 00000000
> [   30.942047] 7d80: cd727db4 cd727d90 c00f1960 c02e33f8 c00eedcc 00000000
> c32c7a48 c3291b20
> [   30.950683] 7da0: c32c7a50 00000001 cd727ddc cd727db8 c00eb8b0 c00f18d4
> cd727ea0 cd727f60
> [   30.959320] 7dc0: 00000000 00000000 cd727e98 00000000 cd727df4 cd727de0
> c00eb96c c00eb6ec
> [   30.967956] 7de0: cd727ea0 cd727ee0 cd727e6c cd727df8 c00fb974 c00eb950
> cd727e6c cd727e08
> [   30.976593] 7e00: c00f8bd4 c00f8b1c c00f97fc 00000000 cd727ee0 00000001
> 00000000 cd727ee8
> [   30.985229] 7e20: 00000000 00000000 cf737178 c32c7a48 00000000 00000000
> c3291b20 cd67f848
> [   30.993865] 7e40: 00000020 cd727ee0 c32c7a48 cd727f60 cd727e98 00000000
> cd727ea0 cd726000
> [   31.002502] 7e60: cd727ed4 cd727e70 c00fc028 c00fb39c cd727ea0 cd727e80
> 00000000 c32cad64
> [   31.011138] 7e80: cd74f640 00000000 cd74f968 00000000 00000004 00000000
> cf815e58 cf74a8f8
> [   31.019775] 7ea0: 00000000 00000000 cd726000 cd727f60 00000001 ffffff9c
> cfb07000 ffffff9c
> [   31.028411] 7ec0: cd726000 00000000 cd727f54 cd727ed8 c00fc730 c00fbf84
> 00000041 00000000
> [   31.037048] 7ee0: cf815e58 cf74a8f8 35c12985 00000009 cfb07009 cd727e30
> 00000000 cf4fcb38
> [   31.045684] 7f00: c3291b20 00000101 00000008 00000000 00000000 cd773e98
> cd727f54 cd727f28
> [   31.054321] 7f20: c0109814 c03d8818 00000000 cfb07000 00000000 00026150
> cfb07000 00000000
> [   31.062957] 7f40: 00000003 00000001 cd727f94 cd727f58 c00ec7bc c00fc708
> 00000000 cd726000
> [   31.071594] 7f60: 00000000 00000000 00000024 00000100 becb28da b6eef8a0
> 00026150 00000005
> [   31.080261] 7f80: c0014728 00000000 cd727fa4 cd727f98 c00ec880 c00ec6d8
> 00000000 cd727fa8
> [   31.088897] 7fa0: c00145a0 c00ec864 becb28da b6eef8a0 becb28da 00000000
> becb28ec ffffffff
> [   31.097534] 7fc0: becb28da b6eef8a0 00026150 00000005 00000001 0001c3b8
> 000260b8 ffffffff
> [   31.106170] 7fe0: 00000000 becb28d8 b6ea8c10 b6dc078c 60000010 becb28da
> de10c4ff be918a5f
> [   31.114807] Backtrace:
> [   31.117401] [<c0087a44>] (__lock_acquire.clone.19+0x0/0xd40) from
> [<c0088d54>] (lock_acquire+0x5c/0x70)
> [   31.127349] [<c0088cf8>] (lock_acquire+0x0/0x70) from [<c03d8274>]
> (_raw_spin_lock+0x34/0x44)
> [   31.136322]  r7:c328c208 r6:c318cf40 r5:00000001 r4:c328c208
> [   31.142364] [<c03d8240>] (_raw_spin_lock+0x0/0x44) from [<c02e3984>]
> (snd_card_file_add+0x50/0xc0)
> [   31.151824]  r5:c32c7a48 r4:c328c000
> [   31.155639] [<c02e3934>] (snd_card_file_add+0x0/0xc0) from [<c02e68cc>]
> (snd_ctl_open+0x70/0x190)
> [   31.164978]  r7:07400000 r6:00000000 r5:c328c000 r4:c32c7a48
> [   31.170989] [<c02e685c>] (snd_ctl_open+0x0/0x190) from [<c02e3494>]
> (snd_open+0xa8/0x1a0)
> [   31.179595]  r7:07400000 r6:c3291b20 r5:c32c7a48 r4:c04042d0
> [   31.185638] [<c02e33ec>] (snd_open+0x0/0x1a0) from [<c00f1960>]
> (chrdev_open+0x98/0x160)
> [   31.194183] [<c00f18c8>] (chrdev_open+0x0/0x160) from [<c00eb8b0>]
> (do_dentry_open.clone.18+0x1d0/0x264)
> [   31.204193]  r7:00000001 r6:c32c7a50 r5:c3291b20 r4:c32c7a48
> [   31.210205] [<c00eb6e0>] (do_dentry_open.clone.18+0x0/0x264) from
> [<c00eb96c>] (finish_open+0x28/0x40)
> [   31.220062] [<c00eb944>] (finish_open+0x0/0x40) from [<c00fb974>]
> (do_last.clone.40+0x5e4/0xbe8)
> [   31.229309]  r4:cd727ee0 r3:cd727ea0
> [   31.233123] [<c00fb390>] (do_last.clone.40+0x0/0xbe8) from [<c00fc028>]
> (path_openat+0xb0/0x488)
> [   31.242401] [<c00fbf78>] (path_openat+0x0/0x488) from [<c00fc730>]
> (do_filp_open+0x34/0x88)
> [   31.251190] [<c00fc6fc>] (do_filp_open+0x0/0x88) from [<c00ec7bc>]
> (do_sys_open+0xf0/0x18c)
> [   31.260009]  r7:00000001 r6:00000003 r5:00000000 r4:cfb07000
> [   31.266021] [<c00ec6cc>] (do_sys_open+0x0/0x18c) from [<c00ec880>]
> (sys_open+0x28/0x2c)
> [   31.274475] [<c00ec858>] (sys_open+0x0/0x2c) from [<c00145a0>]
> (ret_fast_syscall+0x0/0x30)
> [   31.283203] Code: e3580000 0affffbe e2886f41 e1960f9f (e2800001)
> [   31.289642] ---[ end trace e749a1146c99522c ]---
> [   31.294525] Kernel panic - not syncing: Fatal exception
> [2 diff <text/plain (base64)>]
> diff --git a/sound/core/control.c b/sound/core/control.c
> index 2487a6b..34c80d4 100644
> --- a/sound/core/control.c
> +++ b/sound/core/control.c
> @@ -45,6 +45,7 @@ static LIST_HEAD(snd_control_ioctls);
>  static LIST_HEAD(snd_control_compat_ioctls);
>  #endif
>  
> +#include <linux/delay.h>
>  static int snd_ctl_open(struct inode *inode, struct file *file)
>  {
>  	unsigned long flags;
> @@ -61,6 +62,10 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
>  		err = -ENODEV;
>  		goto __error1;
>  	}
> +       printk("msleep o %p\n", card);
> +       msleep(5000);
> +       printk("msleep o+\n");
> +
>  	err = snd_card_file_add(card, file);
>  	if (err < 0) {
>  		err = -ENODEV;
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Takashi Iwai]

At Mon, 15 Oct 2012 20:45:44 +0200,
Takashi Iwai wrote:
> 
> At Mon, 15 Oct 2012 19:41:40 +0200,
> Matthieu CASTET wrote:
> > 
> > Hi Takashi,
> > 
> > Takashi Iwai a écrit :
> > > At Fri, 12 Oct 2012 17:42:19 +0200,
> > > Matthieu CASTET wrote:
> > >> Hi,
> > >>
> > >>
> > >> Takashi Iwai a écrit :
> > >>> [Added Daniel and Clemens in the loop]
> > >>>
> > >>>
> > >>> I don't think this is needed.
> > >>>
> > >>> So... the below is a quick hack I did without testing at all.
> > >>> Hopefully this can give some advance.
> > >> Thanks for the quick patch.
> > >>
> > >> The patch didn't apply cleany of linus tree, of which tree is based your patch ?
> > > 
> > > Did you try the second one?
> > > The second one covers races in more places.
> > > 
> > > The only uncovered place is the autosuspend stuff in mixer.c (for PCM,
> > > it's used only in open/close, so it's no problem).  I'll fix it later.
> > > 
> > > 
> > I didn't have time to test your latest patches : I will test them tomorrow.
> > On which git tree are they based ? gregkh/usb.git ?
> 
> 3.7-rc1.
> 
> > But I believe I found other races in the alsa char device handling. With the
> > attached patch, if you disconnect the usb audio device between "msleep o" and
> > "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
> > 
> > I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
> 
> OK, we'd need a generic open/close protection.
> For PCM, there is already a fix in my last patchset, so it should
> work, but for other devices, the paths are still uncovered.

I hacked a bit more fixes but had no time to test them due to another
bug (hit an NFS problem on server).  If you are interested, feel free
to test topic/usb-disconnect-fix branch of sound-unstable git tree

  git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-unstable.git

The master branch of sound-unstable tree contains all patches but is
likely broken.  Just pull topic/usb-disconnect-fix branch onto the
upstream Linus tree.


thanks,

Takashi


> 
> 
> Takashi
> 
> 
> > 
> > Matthieu
> > 
> > 
> > [1]
> > [   30.768341] Alignment trap: not handling instruction e1960f9f at [<c0087ba4>]
> > [   30.775878] Unhandled fault: alignment exception (0x001) at 0x6b6b6c6f
> > [   30.782775] Internal error: : 1 [#1] SMP ARM
> > [   30.787292] Modules linked in:
> > [   30.790557] CPU: 0    Tainted: G        W     (3.6.0-03888-g9c0226d-dirty #25)
> > [   30.798187] PC is at __lock_acquire.clone.19+0x164/0xd40
> > [   30.803802] LR is at lock_acquire+0x5c/0x70
> > [   30.808227] pc : [<c0087ba8>]    lr : [<c0088d54>]    psr: 20000093
> > [   30.808227] sp : cd727c70  ip : 00000001  fp : cd727ccc
> > [   30.820343] r10: c05c3994  r9 : c328c218  r8 : 6b6b6b6b
> > [   30.825866] r7 : cd74f640  r6 : 6b6b6c6f  r5 : c05a4d5c  r4 : cd726000
> > [   30.832763] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : c328c218
> > [   30.839660] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
> > [   30.847290] Control: 10c5387d  Table: 8329c019  DAC: 00000015
> > [   30.853363] Process arecord (pid: 635, stack limit = 0xcd7262f8)
> > [   30.859680] Stack: (0xcd727c70 to 0xcd728000)
> > [   30.864288] 7c60:                                     000000ec 00000000
> > c059ce68 00000001
> > [   30.872955] 7c80: 00000000 c05c2cc0 00000009 c059ce38 60000013 00000004
> > cd727d14 cd727ca8
> > [   30.881591] 7ca0: c00455b0 00000000 cd726000 60000013 cd74f640 c09c7d70
> > 00000024 c3297440
> > [   30.890228] 7cc0: cd727cfc cd727cd0 c0088d54 c0087a50 00000000 00000000
> > c02e3984 00000000
> > [   30.898864] 7ce0: c328c208 00000001 c318cf40 c328c208 cd727d24 cd727d00
> > c03d8274 c0088d04
> > [   30.907501] 7d00: 00000001 00000000 c02e3984 c32c7a48 c328c000 c32c7a48
> > cd727d44 cd727d28
> > [   30.916107] 7d20: c02e3984 c03d824c c32c7a48 c328c000 00000000 07400000
> > cd727d64 cd727d48
> > [   30.924774] 7d40: c02e68cc c02e3940 c04042d0 c32c7a48 c3291b20 07400000
> > cd727d8c cd727d68
> > [   30.933380] 7d60: c02e3494 c02e6868 c3291b20 c32c7a48 cf9f83c0 00000000
> > c00f18c8 00000000
> > [   30.942047] 7d80: cd727db4 cd727d90 c00f1960 c02e33f8 c00eedcc 00000000
> > c32c7a48 c3291b20
> > [   30.950683] 7da0: c32c7a50 00000001 cd727ddc cd727db8 c00eb8b0 c00f18d4
> > cd727ea0 cd727f60
> > [   30.959320] 7dc0: 00000000 00000000 cd727e98 00000000 cd727df4 cd727de0
> > c00eb96c c00eb6ec
> > [   30.967956] 7de0: cd727ea0 cd727ee0 cd727e6c cd727df8 c00fb974 c00eb950
> > cd727e6c cd727e08
> > [   30.976593] 7e00: c00f8bd4 c00f8b1c c00f97fc 00000000 cd727ee0 00000001
> > 00000000 cd727ee8
> > [   30.985229] 7e20: 00000000 00000000 cf737178 c32c7a48 00000000 00000000
> > c3291b20 cd67f848
> > [   30.993865] 7e40: 00000020 cd727ee0 c32c7a48 cd727f60 cd727e98 00000000
> > cd727ea0 cd726000
> > [   31.002502] 7e60: cd727ed4 cd727e70 c00fc028 c00fb39c cd727ea0 cd727e80
> > 00000000 c32cad64
> > [   31.011138] 7e80: cd74f640 00000000 cd74f968 00000000 00000004 00000000
> > cf815e58 cf74a8f8
> > [   31.019775] 7ea0: 00000000 00000000 cd726000 cd727f60 00000001 ffffff9c
> > cfb07000 ffffff9c
> > [   31.028411] 7ec0: cd726000 00000000 cd727f54 cd727ed8 c00fc730 c00fbf84
> > 00000041 00000000
> > [   31.037048] 7ee0: cf815e58 cf74a8f8 35c12985 00000009 cfb07009 cd727e30
> > 00000000 cf4fcb38
> > [   31.045684] 7f00: c3291b20 00000101 00000008 00000000 00000000 cd773e98
> > cd727f54 cd727f28
> > [   31.054321] 7f20: c0109814 c03d8818 00000000 cfb07000 00000000 00026150
> > cfb07000 00000000
> > [   31.062957] 7f40: 00000003 00000001 cd727f94 cd727f58 c00ec7bc c00fc708
> > 00000000 cd726000
> > [   31.071594] 7f60: 00000000 00000000 00000024 00000100 becb28da b6eef8a0
> > 00026150 00000005
> > [   31.080261] 7f80: c0014728 00000000 cd727fa4 cd727f98 c00ec880 c00ec6d8
> > 00000000 cd727fa8
> > [   31.088897] 7fa0: c00145a0 c00ec864 becb28da b6eef8a0 becb28da 00000000
> > becb28ec ffffffff
> > [   31.097534] 7fc0: becb28da b6eef8a0 00026150 00000005 00000001 0001c3b8
> > 000260b8 ffffffff
> > [   31.106170] 7fe0: 00000000 becb28d8 b6ea8c10 b6dc078c 60000010 becb28da
> > de10c4ff be918a5f
> > [   31.114807] Backtrace:
> > [   31.117401] [<c0087a44>] (__lock_acquire.clone.19+0x0/0xd40) from
> > [<c0088d54>] (lock_acquire+0x5c/0x70)
> > [   31.127349] [<c0088cf8>] (lock_acquire+0x0/0x70) from [<c03d8274>]
> > (_raw_spin_lock+0x34/0x44)
> > [   31.136322]  r7:c328c208 r6:c318cf40 r5:00000001 r4:c328c208
> > [   31.142364] [<c03d8240>] (_raw_spin_lock+0x0/0x44) from [<c02e3984>]
> > (snd_card_file_add+0x50/0xc0)
> > [   31.151824]  r5:c32c7a48 r4:c328c000
> > [   31.155639] [<c02e3934>] (snd_card_file_add+0x0/0xc0) from [<c02e68cc>]
> > (snd_ctl_open+0x70/0x190)
> > [   31.164978]  r7:07400000 r6:00000000 r5:c328c000 r4:c32c7a48
> > [   31.170989] [<c02e685c>] (snd_ctl_open+0x0/0x190) from [<c02e3494>]
> > (snd_open+0xa8/0x1a0)
> > [   31.179595]  r7:07400000 r6:c3291b20 r5:c32c7a48 r4:c04042d0
> > [   31.185638] [<c02e33ec>] (snd_open+0x0/0x1a0) from [<c00f1960>]
> > (chrdev_open+0x98/0x160)
> > [   31.194183] [<c00f18c8>] (chrdev_open+0x0/0x160) from [<c00eb8b0>]
> > (do_dentry_open.clone.18+0x1d0/0x264)
> > [   31.204193]  r7:00000001 r6:c32c7a50 r5:c3291b20 r4:c32c7a48
> > [   31.210205] [<c00eb6e0>] (do_dentry_open.clone.18+0x0/0x264) from
> > [<c00eb96c>] (finish_open+0x28/0x40)
> > [   31.220062] [<c00eb944>] (finish_open+0x0/0x40) from [<c00fb974>]
> > (do_last.clone.40+0x5e4/0xbe8)
> > [   31.229309]  r4:cd727ee0 r3:cd727ea0
> > [   31.233123] [<c00fb390>] (do_last.clone.40+0x0/0xbe8) from [<c00fc028>]
> > (path_openat+0xb0/0x488)
> > [   31.242401] [<c00fbf78>] (path_openat+0x0/0x488) from [<c00fc730>]
> > (do_filp_open+0x34/0x88)
> > [   31.251190] [<c00fc6fc>] (do_filp_open+0x0/0x88) from [<c00ec7bc>]
> > (do_sys_open+0xf0/0x18c)
> > [   31.260009]  r7:00000001 r6:00000003 r5:00000000 r4:cfb07000
> > [   31.266021] [<c00ec6cc>] (do_sys_open+0x0/0x18c) from [<c00ec880>]
> > (sys_open+0x28/0x2c)
> > [   31.274475] [<c00ec858>] (sys_open+0x0/0x2c) from [<c00145a0>]
> > (ret_fast_syscall+0x0/0x30)
> > [   31.283203] Code: e3580000 0affffbe e2886f41 e1960f9f (e2800001)
> > [   31.289642] ---[ end trace e749a1146c99522c ]---
> > [   31.294525] Kernel panic - not syncing: Fatal exception
> > [2 diff <text/plain (base64)>]
> > diff --git a/sound/core/control.c b/sound/core/control.c
> > index 2487a6b..34c80d4 100644
> > --- a/sound/core/control.c
> > +++ b/sound/core/control.c
> > @@ -45,6 +45,7 @@ static LIST_HEAD(snd_control_ioctls);
> >  static LIST_HEAD(snd_control_compat_ioctls);
> >  #endif
> >  
> > +#include <linux/delay.h>
> >  static int snd_ctl_open(struct inode *inode, struct file *file)
> >  {
> >  	unsigned long flags;
> > @@ -61,6 +62,10 @@ static int snd_ctl_open(struct inode *inode, struct file *file)
> >  		err = -ENODEV;
> >  		goto __error1;
> >  	}
> > +       printk("msleep o %p\n", card);
> > +       msleep(5000);
> > +       printk("msleep o+\n");
> > +
> >  	err = snd_card_file_add(card, file);
> >  	if (err < 0) {
> >  		err = -ENODEV;
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Matthieu CASTET]

[-- Attachment #1: Type: text/plain, Size: 7395 bytes --]

Takashi Iwai a écrit :
> At Mon, 15 Oct 2012 19:41:40 +0200,
> Matthieu CASTET wrote:
>> Hi Takashi,
>>
>> But I believe I found other races in the alsa char device handling. With the
>> attached patch, if you disconnect the usb audio device between "msleep o" and
>> "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
>>
>> I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
> 
> OK, we'd need a generic open/close protection.
> For PCM, there is already a fix in my last patchset, so it should
> work, but for other devices, the paths are still uncovered.
> 
I don't think it will work for pcm : the begin of snd_pcm_open is not protected
by any lock even with your patch
In snd_open we release sound_mutex before calling file->f_op->open.

The snd_lookup_minor_data and snd_card_file_add should be protected by a lock.
Attached a patch (pcm.crash) that help to trigger [1].


One idea could be to do the snd_card_file_add in snd_lookup_minor_data : it will
be protected by sound_mutex.

That what rfc attachement does (with debug printk and delay) : it add a
snd_lookup_minor_data2 that do the snd_card_file_add.


Matthieu



[1]

# cat /dev/pcmC0D0c
[  572.187866] msleep o cf1e1200
[  573.534454] usb 1-2: USB disconnect, device number 2
[  573.543670] usb 1-2.1: USB disconnect, device number 3
[  573.561645] usb 1-2.1.2: USB disconnect, device number 4
[  577.337005] msleep o+
[  577.339477] Unable to handle kernel paging request at virtual address 6b6b6d87
[  577.347106] pgd = cccf4000
[  577.349975] [6b6b6d87] *pgd=00000000
[  577.353759] Internal error: Oops: 5 [#1] PREEMPT SMP ARM
[  577.359374] Modules linked in:
[  577.362640] CPU: 0    Not tainted  (3.7.0-rc1-00004-gd6355f5-dirty #27)
[  577.369628] PC is at __lock_acquire.clone.19+0x150/0xd40
[  577.375274] LR is at lock_acquire+0x5c/0x70
[  577.379699] pc : [<c0088b10>]    lr : [<c0089cd0>]    psr: 80000093
[  577.379699] sp : cca01c28  ip : 00000001  fp : cca01c84
[  577.391784] r10: c05d5814  r9 : 6b6b6d83  r8 : 00000080
[  577.397308] r7 : cf15f480  r6 : 00000000  r5 : c05b67bc  r4 : cca00000
[  577.404205] r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : 6b6b6d83
[  577.411102] Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  577.418731] Control: 10c5387d  Table: 8ccf4019  DAC: 00000015
[  577.424804] Process cat (pid: 642, stack limit = 0xcca00240)
[  577.430786] Stack: (0xcca01c28 to 0xcca02000)
[  577.435394] 1c20:                   00000001 20000093 000000c4 00000000
c05ae4a8 00000001
[  577.444030] 1c40: 00000000 c05d4b40 00000009 c05ae478 60000013 00000004
cca01ccc 00000000
[  577.452667] 1c60: cca00000 60000013 cf15f480 00000001 00000024 cf7bcd40
cca01cb4 cca01c88
[  577.461334] 1c80: c0089cd0 c00889cc 00000000 00000000 c02eacec 00000000
6b6b6d73 c02eacec
[  577.469970] 1ca0: ccd12f00 6b6b6d73 cca01cdc cca01cb8 c03e5234 c0089c80
00000001 00000000
[  577.478607] 1cc0: c02eacec cf0980a8 6b6b6b6b cf0980a8 cca01cfc cca01ce0
c02eacec c03e51f8
[  577.487243] 1ce0: cf0980a8 ffffffff c05b65d4 cf1e1200 cca01d4c cca01d00
c02fbb84 c02eaca8
[  577.495880] 1d00: 22222222 cf1e1200 00000018 cd9d0120 07400018 c09d9af8
cca01d34 cca01d28
[  577.504547] 1d20: c03e33fc cf0980a8 cd9d0120 cd9d0120 07400018 c09d9af8
00000024 cf7bcd40
[  577.513183] 1d40: cca01d64 cca01d50 c02fbd90 c02fbb20 c0411378 cf0980a8
cca01d8c cca01d68
[  577.521820] 1d60: c02ea810 c02fbd58 cd9d0120 cf0980a8 cf1fb1c0 00000000
c00f505c 00000000
[  577.530456] 1d80: cca01db4 cca01d90 c00f50f4 c02ea774 c00f25cc 00000018
cf0980a8 cd9d0120
[  577.539093] 1da0: cf0980b0 00020001 cca01ddc cca01db8 c00ef404 c00f5068
cca01ea0 cca01f60
[  577.547729] 1dc0: 00000000 00020000 cca01e98 00000000 cca01df4 cca01de0
c00ef4c0 c00ef240
[  577.556365] 1de0: cca01ea0 cca01ee0 cca01e6c cca01df8 c00fe348 c00ef4a4
cca01e6c cca01e08
[  577.565002] 1e00: c00fb704 c00fb4a8 cca01e3c cca01e18 c004b2c8 c007d99c
00000000 cca01ee8
[  577.573638] 1e20: 00000000 00000000 ceb2f178 cf0980a8 cf016e58 ceb2f178
cd9d0120 cf2fa830
[  577.582275] 1e40: 386d45b8 cca01ee0 ceb42bf8 cca01e98 cca01f60 00000000
cca01ea0 cca00000
[  577.590911] 1e60: cca01ed4 cca01e70 c00fec00 c00fdd70 cca01ea0 00000000
00000004 00000000
[  577.599548] 1e80: 000000e5 00000000 cf0980a8 cca01e90 cf016e58 ceb42bf8
cf016e58 ceb40d38
[  577.608215] 1ea0: 00000000 00000000 cca01ee4 cca01f60 00000001 ffffff9c
cf30f000 ffffff9c
[  577.616851] 1ec0: cca00000 00000000 cca01f54 cca01ed8 c00ff0f8 c00fe958
00000041 cf0235e0
[  577.625488] 1ee0: cf016e58 ceb40d38 d24edc20 00000008 ce487d44 cf7b3d90
cf016318 ce8021f8
[  577.634124] 1f00: cd9d0120 00000101 00000004 00000000 00000000 ce487d40
00020000 cf30f000
[  577.642761] 1f20: 00020000 be9ecf92 00000001 ffffff9c cca00000 00000000
cf30f000 00020000
[  577.651397] 1f40: 00000003 00000001 cca01f94 cca01f58 c00f044c c00ff0d0
c0060598 c03e44d0
[  577.660034] 1f60: 00020000 cca00000 00000024 00000100 00000000 00000000
be9ecf92 00000005
[  577.668701] 1f80: c0014808 00000000 cca01fa4 cca01f98 c00f0504 c00f036c
00000000 cca01fa8
[  577.677337] 1fa0: c0014660 c00f04e8 00000000 00000000 be9ecf92 00020000
00000000 000030ec
[  577.685974] 1fc0: 00000000 00000000 be9ecf92 00000005 00000008 00000000
b6f5f000 00000000
[  577.694610] 1fe0: b6e163b0 be9eccd0 0000d898 b6e16400 60000010 be9ecf92
00000000 00000000
[  577.703247] Backtrace:
[  577.705841] [<c00889c0>] (__lock_acquire.clone.19+0x0/0xd40) from
[<c0089cd0>] (lock_acquire+0x5c/0x70)
[  577.715789] [<c0089c74>] (lock_acquire+0x0/0x70) from [<c03e5234>]
(_raw_spin_lock+0x48/0x58)
[  577.724792]  r7:6b6b6d73 r6:ccd12f00 r5:c02eacec r4:6b6b6d73
[  577.730834] [<c03e51ec>] (_raw_spin_lock+0x0/0x58) from [<c02eacec>]
(snd_card_file_add+0x50/0xac)
[  577.740295]  r5:cf0980a8 r4:6b6b6b6b
[  577.744110] [<c02eac9c>] (snd_card_file_add+0x0/0xac) from [<c02fbb84>]
(snd_pcm_open+0x70/0x238)
[  577.753479]  r7:cf1e1200 r6:c05b65d4 r5:ffffffff r4:cf0980a8
[  577.759521] [<c02fbb14>] (snd_pcm_open+0x0/0x238) from [<c02fbd90>]
(snd_pcm_capture_open+0x44/0x48)
[  577.769165] [<c02fbd4c>] (snd_pcm_capture_open+0x0/0x48) from [<c02ea810>]
(snd_open+0xa8/0x1a0)
[  577.778442]  r5:cf0980a8 r4:c0411378
[  577.782257] [<c02ea768>] (snd_open+0x0/0x1a0) from [<c00f50f4>]
(chrdev_open+0x98/0x160)
[  577.790832] [<c00f505c>] (chrdev_open+0x0/0x160) from [<c00ef404>]
(do_dentry_open.clone.16+0x1d0/0x264)
[  577.800842]  r7:00020001 r6:cf0980b0 r5:cd9d0120 r4:cf0980a8
[  577.806884] [<c00ef234>] (do_dentry_open.clone.16+0x0/0x264) from
[<c00ef4c0>] (finish_open+0x28/0x40)
[  577.816711] [<c00ef498>] (finish_open+0x0/0x40) from [<c00fe348>]
(do_last.clone.47+0x5e4/0xbe8)
[  577.825988]  r4:cca01ee0 r3:cca01ea0
[  577.829803] [<c00fdd64>] (do_last.clone.47+0x0/0xbe8) from [<c00fec00>]
(path_openat.clone.48+0x2b4/0x488)
[  577.839996] [<c00fe94c>] (path_openat.clone.48+0x0/0x488) from [<c00ff0f8>]
(do_filp_open+0x34/0x88)
[  577.849670] [<c00ff0c4>] (do_filp_open+0x0/0x88) from [<c00f044c>]
(do_sys_open+0xec/0x17c)
[  577.858489]  r7:00000001 r6:00000003 r5:00020000 r4:cf30f000
[  577.864532] [<c00f0360>] (do_sys_open+0x0/0x17c) from [<c00f0504>]
(sys_open+0x28/0x2c)
[  577.872985] [<c00f04dc>] (sys_open+0x0/0x2c) from [<c0014660>]
(ret_fast_syscall+0x0/0x30)
[  577.881744] Code: ebfeebea e1a00004 ea000038 e0890106 (e5908004)
[  577.888183] ---[ end trace 5c43a835149de569 ]---




[-- Attachment #2: pcm.crash --]
[-- Type: text/plain, Size: 586 bytes --]

diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 8753c89..0cbe471 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2130,11 +2130,16 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
 	return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
 }
 
+#include <linux/delay.h>
 static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream)
 {
 	int err;
 	wait_queue_t wait;
 
+	printk("msleep o %p\n", pcm);
+	mdelay(5000);
+	printk("msleep o+\n");
+
 	if (pcm == NULL) {
 		err = -ENODEV;
 		goto __error1;

[-- Attachment #3: rfc --]
[-- Type: text/plain, Size: 3632 bytes --]

diff --git a/include/sound/core.h b/include/sound/core.h
index bc05668..9869087 100644
--- a/include/sound/core.h
+++ b/include/sound/core.h
@@ -185,6 +185,7 @@ static inline int snd_power_wait(struct snd_card *card, unsigned int state) { re
 struct snd_minor {
 	int type;			/* SNDRV_DEVICE_TYPE_XXX */
 	int card;			/* card number */
+	struct snd_card *cardp;
 	int device;			/* device number */
 	const struct file_operations *f_ops;	/* file operations */
 	void *private_data;		/* private data for f_ops->open */
@@ -241,6 +242,7 @@ static inline int snd_register_device(int type, struct snd_card *card, int dev,
 
 int snd_unregister_device(int type, struct snd_card *card, int dev);
 void *snd_lookup_minor_data(unsigned int minor, int type);
+void *snd_lookup_minor_data2(unsigned int minor, int type, struct file *file);
 int snd_add_device_sysfs_file(int type, struct snd_card *card, int dev,
 			      struct device_attribute *attr);
 
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 8753c89..c2445c0 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -2114,8 +2114,8 @@ static int snd_pcm_playback_open(struct inode *inode, struct file *file)
 	int err = nonseekable_open(inode, file);
 	if (err < 0)
 		return err;
-	pcm = snd_lookup_minor_data(iminor(inode),
-				    SNDRV_DEVICE_TYPE_PCM_PLAYBACK);
+	pcm = snd_lookup_minor_data2(iminor(inode),
+				    SNDRV_DEVICE_TYPE_PCM_PLAYBACK, file);
 	return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK);
 }
 
@@ -2125,23 +2125,24 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file)
 	int err = nonseekable_open(inode, file);
 	if (err < 0)
 		return err;
-	pcm = snd_lookup_minor_data(iminor(inode),
-				    SNDRV_DEVICE_TYPE_PCM_CAPTURE);
+	pcm = snd_lookup_minor_data2(iminor(inode),
+				    SNDRV_DEVICE_TYPE_PCM_CAPTURE, file);
 	return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE);
 }
 
+#include <linux/delay.h>
 static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream)
 {
 	int err;
 	wait_queue_t wait;
 
+	printk("msleep o2 %p\n", pcm);
+	mdelay(5000);
+	printk("msleep o2+\n");
 	if (pcm == NULL) {
 		err = -ENODEV;
 		goto __error1;
 	}
-	err = snd_card_file_add(pcm->card, file);
-	if (err < 0)
-		goto __error1;
 	if (!try_module_get(pcm->card->module)) {
 		err = -EFAULT;
 		goto __error2;
diff --git a/sound/core/sound.c b/sound/core/sound.c
index 6439760..5ea8010 100644
--- a/sound/core/sound.c
+++ b/sound/core/sound.c
@@ -118,6 +118,35 @@ void *snd_lookup_minor_data(unsigned int minor, int type)
 
 EXPORT_SYMBOL(snd_lookup_minor_data);
 
+#include <linux/delay.h>
+void *snd_lookup_minor_data2(unsigned int minor, int type, struct file *file)
+{
+	struct snd_minor *mreg;
+	void *private_data;
+
+	if (minor >= ARRAY_SIZE(snd_minors))
+		return NULL;
+	mutex_lock(&sound_mutex);
+	mreg = snd_minors[minor];
+	if (mreg && mreg->type == type)
+		private_data = mreg->private_data;
+	else
+		private_data = NULL;
+	printk("msleep o %p\n", NULL);
+	mdelay(5000);
+	printk("msleep o+\n");
+
+
+	if (private_data) {
+		if (snd_card_file_add(mreg->cardp, file) < 0)
+			private_data = NULL;
+	}
+	mutex_unlock(&sound_mutex);
+	return private_data;
+}
+
+EXPORT_SYMBOL(snd_lookup_minor_data2);
+
 #ifdef CONFIG_MODULES
 static struct snd_minor *autoload_device(unsigned int minor)
 {
@@ -272,6 +301,7 @@ int snd_register_device_for_dev(int type, struct snd_card *card, int dev,
 		return -ENOMEM;
 	preg->type = type;
 	preg->card = card ? card->number : -1;
+	preg->cardp = card;
 	preg->device = dev;
 	preg->f_ops = f_ops;
 	preg->private_data = private_data;

Re: usb audio race at disconnect time

[Takashi Iwai]

At Tue, 16 Oct 2012 18:01:13 +0200,
Matthieu CASTET wrote:
> 
> Takashi Iwai a écrit :
> > At Mon, 15 Oct 2012 19:41:40 +0200,
> > Matthieu CASTET wrote:
> >> Hi Takashi,
> >>
> >> But I believe I found other races in the alsa char device handling. With the
> >> attached patch, if you disconnect the usb audio device between "msleep o" and
> >> "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
> >>
> >> I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
> > 
> > OK, we'd need a generic open/close protection.
> > For PCM, there is already a fix in my last patchset, so it should
> > work, but for other devices, the paths are still uncovered.
> > 
> I don't think it will work for pcm : the begin of snd_pcm_open is not protected
> by any lock even with your patch
> In snd_open we release sound_mutex before calling file->f_op->open.
> 
> The snd_lookup_minor_data and snd_card_file_add should be protected by a lock.
> Attached a patch (pcm.crash) that help to trigger [1].

Check out my latest patches in topic/usb-disconnect-fix branch.
It's been fixed there.


Takashi
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Matthieu CASTET]

Takashi Iwai a écrit :
> At Tue, 16 Oct 2012 18:01:13 +0200,
> Matthieu CASTET wrote:
>> Takashi Iwai a écrit :
>>> At Mon, 15 Oct 2012 19:41:40 +0200,
>>> Matthieu CASTET wrote:
>>>> Hi Takashi,
>>>>
>>>> But I believe I found other races in the alsa char device handling. With the
>>>> attached patch, if you disconnect the usb audio device between "msleep o" and
>>>> "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
>>>>
>>>> I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
>>> OK, we'd need a generic open/close protection.
>>> For PCM, there is already a fix in my last patchset, so it should
>>> work, but for other devices, the paths are still uncovered.
>>>
>> I don't think it will work for pcm : the begin of snd_pcm_open is not protected
>> by any lock even with your patch
>> In snd_open we release sound_mutex before calling file->f_op->open.
>>
>> The snd_lookup_minor_data and snd_card_file_add should be protected by a lock.
>> Attached a patch (pcm.crash) that help to trigger [1].
> 
> Check out my latest patches in topic/usb-disconnect-fix branch.
> It's been fixed there.
> 
Thanks,

the first tests seems ok.
We will do more strees test.


Matthieu
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Takashi Iwai]

At Thu, 18 Oct 2012 17:39:05 +0200,
Matthieu CASTET wrote:
> 
> Takashi Iwai a écrit :
> > At Tue, 16 Oct 2012 18:01:13 +0200,
> > Matthieu CASTET wrote:
> >> Takashi Iwai a écrit :
> >>> At Mon, 15 Oct 2012 19:41:40 +0200,
> >>> Matthieu CASTET wrote:
> >>>> Hi Takashi,
> >>>>
> >>>> But I believe I found other races in the alsa char device handling. With the
> >>>> attached patch, if you disconnect the usb audio device between "msleep o" and
> >>>> "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
> >>>>
> >>>> I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
> >>> OK, we'd need a generic open/close protection.
> >>> For PCM, there is already a fix in my last patchset, so it should
> >>> work, but for other devices, the paths are still uncovered.
> >>>
> >> I don't think it will work for pcm : the begin of snd_pcm_open is not protected
> >> by any lock even with your patch
> >> In snd_open we release sound_mutex before calling file->f_op->open.
> >>
> >> The snd_lookup_minor_data and snd_card_file_add should be protected by a lock.
> >> Attached a patch (pcm.crash) that help to trigger [1].
> > 
> > Check out my latest patches in topic/usb-disconnect-fix branch.
> > It's been fixed there.
> > 
> Thanks,
> 
> the first tests seems ok.
> We will do more strees test.

OK, thanks!

I seem to have forgotten to send two patches in that branch to ML.
Will follow soon.


Takashi
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Takashi Iwai]

At Thu, 18 Oct 2012 17:39:05 +0200,
Matthieu CASTET wrote:
> 
> Takashi Iwai a écrit :
> > At Tue, 16 Oct 2012 18:01:13 +0200,
> > Matthieu CASTET wrote:
> >> Takashi Iwai a écrit :
> >>> At Mon, 15 Oct 2012 19:41:40 +0200,
> >>> Matthieu CASTET wrote:
> >>>> Hi Takashi,
> >>>>
> >>>> But I believe I found other races in the alsa char device handling. With the
> >>>> attached patch, if you disconnect the usb audio device between "msleep o" and
> >>>> "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
> >>>>
> >>>> I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
> >>> OK, we'd need a generic open/close protection.
> >>> For PCM, there is already a fix in my last patchset, so it should
> >>> work, but for other devices, the paths are still uncovered.
> >>>
> >> I don't think it will work for pcm : the begin of snd_pcm_open is not protected
> >> by any lock even with your patch
> >> In snd_open we release sound_mutex before calling file->f_op->open.
> >>
> >> The snd_lookup_minor_data and snd_card_file_add should be protected by a lock.
> >> Attached a patch (pcm.crash) that help to trigger [1].
> > 
> > Check out my latest patches in topic/usb-disconnect-fix branch.
> > It's been fixed there.
> > 
> Thanks,
> 
> the first tests seems ok.
> We will do more strees test.

Do you have any good/bad test result?
If no regression is seen, I'm going to apply the patches for 3.7-rc4.


thanks,

Takashi
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Matthieu CASTET]

Takashi Iwai a écrit :
>> Thanks,
>>
>> the first tests seems ok.
>> We will do more strees test.
> 
> Do you have any good/bad test result?
> If no regression is seen, I'm going to apply the patches for 3.7-rc4.
The patches fix the races.

But I saw a failure I didn't saw before during stress test [1].
It is hard to say if it is related to your patches :
- we test on a older kernel version and I backported usbaudio from 3.7 with your
patches
- the start of the trace is missing and it is difficult to understand the list
corruption.

Matthieu

[1]
<4>[  570.313385] bf40: c06ae6a0 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.313385] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.313415] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.313446] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.313476] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.313476] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.313507] unwind: Unknown symbol address c0108984
<4>[  570.313507] unwind: Index not found c0108984
<4>[  570.313507] ---[ end trace 069f4a4f8aedac20 ]---
<4>[  570.324859] ------------[ cut here ]------------
<4>[  570.324890] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.324920] Process swapper (0)
<4>[  570.324920] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.324951] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.325012] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.325012] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.325042] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.325073] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.325103] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.325103] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.325134] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.325164] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.325195] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.325195] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.325225] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.325256] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.325256] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.325286] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.325317] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.325347] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.325347] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.325347] bf20:                                     000e4e42 00000000
000e4e42 00000000
<4>[  570.325378] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.325408] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.325408] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.325439] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.325469] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.325469] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.325500] unwind: Unknown symbol address c0108984
<4>[  570.325500] unwind: Index not found c0108984
<4>[  570.325500] ---[ end trace 069f4a4f8aedac21 ]---
<4>[  570.336883] ------------[ cut here ]------------
<4>[  570.336914] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.336914] Process swapper (0)
<4>[  570.336944] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.336944] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.337005] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.337036] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.337066] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.337066] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.337097] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.337127] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.337158] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.337158] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.337188] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.337219] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.337219] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.337249] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.337280] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.337310] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.337310] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.337341] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.337341] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.337371] bf20:                                     0008fe22 00000000
0008fe22 00000000
<4>[  570.337371] bf40: c06ae6a0 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.337402] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.337402] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.337432] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.337463] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.337493] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.337493] unwind: Unknown symbol address c0108984
<4>[  570.337493] unwind: Index not found c0108984
<4>[  570.337524] ---[ end trace 069f4a4f8aedac22 ]---
<4>[  570.348876] ------------[ cut here ]------------
<4>[  570.348907] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.348937] Process swapper (0)
<4>[  570.348937] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.348968] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.349029] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.349060] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.349060] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.349090] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.349121] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.349151] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.349182] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.349212] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.349212] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.349243] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.349273] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.349273] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.349304] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.349334] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.349365] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.349365] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.349395] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.349395] bf20:                                     0007ad24 00000000
0007ad24 00000000
<4>[  570.349426] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.349426] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.349456] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.349487] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.349487] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.349517] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.349548] unwind: Unknown symbol address c0108984
<4>[  570.349548] unwind: Index not found c0108984
<4>[  570.349548] ---[ end trace 069f4a4f8aedac23 ]---
<4>[  570.360900] ------------[ cut here ]------------
<4>[  570.360931] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.360931] Process swapper (0)
<4>[  570.360961] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.360961] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.361053] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.361053] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.361083] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.361114] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.361145] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.361175] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.361175] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.361206] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.361236] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.361267] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.361267] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.361297] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.361328] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.361358] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.361358] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.361389] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.361389] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.361419] bf20:                                     000198f4 00000000
000198f4 00000000
<4>[  570.361419] bf40: c06ae6a0 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.361450] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.361480] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.361480] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.361511] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.361541] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.361541] unwind: Unknown symbol address c0108984
<4>[  570.361541] unwind: Index not found c0108984
<4>[  570.361572] ---[ end trace 069f4a4f8aedac24 ]---
<4>[  570.372894] ------------[ cut here ]------------
<4>[  570.372924] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.372924] Process swapper (0)
<4>[  570.372955] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.372955] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.373016] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.373046] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.373077] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.373107] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.373138] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.373138] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.373168] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.373199] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.373229] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.373229] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.373260] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.373260] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.373291] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.373321] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.373352] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.373382] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.373382] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.373382] bf20:                                     0004747a 00000000
0004747a 00000000
<4>[  570.373413] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.373443] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.373443] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.373474] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.373504] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.373504] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.373535] unwind: Unknown symbol address c0108984
<4>[  570.373535] unwind: Index not found c0108984
<4>[  570.373535] ---[ end trace 069f4a4f8aedac25 ]---
<4>[  570.384857] ------------[ cut here ]------------
<4>[  570.384887] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.384918] Process swapper (0)
<4>[  570.384918] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.384948] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.385009] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.385009] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.385040] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.385070] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.385101] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.385101] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.385131] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.385162] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.385192] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.385192] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.385223] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.385253] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.385253] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.385284] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.385314] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.385314] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.385345] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.385345] bf20:                                     000e8cc2 00000000
000e8cc2 00000000
<4>[  570.385375] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.385375] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.385406] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.385437] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.385437] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.385467] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.385498] unwind: Unknown symbol address c0108984
<4>[  570.385498] unwind: Index not found c0108984
<4>[  570.385498] ---[ end trace 069f4a4f8aedac26 ]---
<4>[  570.396881] ------------[ cut here ]------------
<4>[  570.396911] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.396942] Process swapper (0)
<4>[  570.396942] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.396942] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.397003] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.397033] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.397064] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.397094] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.397094] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.397125] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.397155] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.397186] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.397186] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.397216] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.397247] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.397247] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.397277] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.397308] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.397308] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.397338] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.397369] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.397369] bf20:                                     00018d63 00000000
00018d63 00000000
<4>[  570.397399] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.397399] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.397430] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.397430] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.397460] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.397491] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.397491] unwind: Unknown symbol address c0108984
<4>[  570.397521] unwind: Index not found c0108984
<4>[  570.397521] ---[ end trace 069f4a4f8aedac27 ]---
<4>[  570.408874] ------------[ cut here ]------------
<4>[  570.408905] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.408905] Process swapper (0)
<4>[  570.408935] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.408935] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.408996] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.409027] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.409057] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.409057] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.409088] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.409118] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.409149] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.409179] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.409179] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.409210] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.409210] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.409240] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.409271] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.409301] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.409301] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.409332] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.409332] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.409362] bf20:                                     00019941 00000000
00019941 00000000
<4>[  570.409362] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.409393] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.409423] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.409423] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.409454] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.409484] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.409484] unwind: Unknown symbol address c0108984
<4>[  570.409484] unwind: Index not found c0108984
<4>[  570.409515] ---[ end trace 069f4a4f8aedac28 ]---
<4>[  570.420837] ------------[ cut here ]------------
<4>[  570.420867] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.420898] Process swapper (0)
<4>[  570.420898] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.420898] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.420989] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.421020] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.421020] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.421051] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.421081] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.421112] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.421142] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.421142] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.421173] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.421203] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.421203] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.421234] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.421264] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.421295] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.421295] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.421325] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.421325] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.421356] bf20:                                     0002af59 00000000
0002af59 00000000
<4>[  570.421356] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.421386] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.421417] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.421417] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.421447] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.421478] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.421478] unwind: Unknown symbol address c0108984
<4>[  570.421478] unwind: Index not found c0108984
<4>[  570.421508] ---[ end trace 069f4a4f8aedac29 ]---
<4>[  570.432861] ------------[ cut here ]------------
<4>[  570.432891] WARNING: at /kernel/omap/lib/list_debug.c:30
__list_add+0x60/0x80()
<4>[  570.432922] Process swapper (0)
<4>[  570.432922] list_add corruption. prev->next should be next (d76f3e50), but
was ced0bd98. (prev=ced0bb18).
<4>[  570.432922] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.433013] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>]
(warn_slowpath_common+0x6c/0x88)
<4>[  570.433013] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from
[<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c)
<4>[  570.433044] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>]
(__list_add+0x60/0x80)
<4>[  570.433074] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>]
(usb_hcd_link_urb_to_ep+0x88/0xb8)
<4>[  570.433074] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from
[<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0)
<4>[  570.433105] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>]
(usb_hcd_submit_urb+0x92c/0x960)
<4>[  570.433135] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from
[<c042403c>] (snd_complete_urb+0x204/0x258)
<4>[  570.433166] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  570.433197] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  570.433197] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  570.433227] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  570.433227] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  570.433258] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  570.433288] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  570.433319] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  570.433319] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  570.433349] Exception stack(0xc065bf30 to 0xc065bf78)
<4>[  570.433349] bf20:                                     0007764f 00000000
0007764f 00000000
<4>[  570.433380] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082
00000000 00000000
<4>[  570.433380] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff
<4>[  570.433410] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>]
(omap3_enter_idle+0x104/0x134)
<4>[  570.433441] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>]
(cpuidle_idle_call+0xa4/0x108)
<4>[  570.433441] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>]
(cpu_idle+0x40/0x94)
<4>[  570.433471] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>]
(start_kernel+0x280/0x2e0)
<4>[  570.433471] unwind: Unknown symbol address c0108984
<4>[  570.433502] unwind: Index not found c0108984
<4>[  570.433502] ---[ end trace 069f4a4f8aedac2a ]---
<6>[  570.442962] usb 1-2.4: USB disconnect, address 8
<1>[  570.453521] Unable to handle kernel paging request at virtual address 6b6b6b6b
<1>[  570.461120] pgd = c0104000
<1>[  570.463958] [6b6b6b6b] *pgd=00000000
<0>[  570.467712] Internal error: Oops: 5 [#1] PREEMPT
<0>[  570.472534] last sysfs file:
/sys/devices/platform/ehci-omap.0/usb1/1-2/1-2.4/idProduct
<4>[  570.480926] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  570.495025] CPU: 0    Tainted: G        W    (2.6.35.13-02836-g764dcf5 #12)
<4>[  570.502349] PC is at usb_hcd_flush_endpoint+0x9c/0x160
<4>[  570.507751] LR is at usb_disable_endpoint+0x6c/0x84
<4>[  570.512847] pc : [<c034f6b4>]    lr : [<c03518b0>]    psr: 20000093
<4>[  570.512878] sp : dfd89e38  ip : 00000002  fp : d7691280
<4>[  570.524902] r10: 6b6b6b53  r9 : 00000100  r8 : df42a100
<4>[  570.530395] r7 : d76f3e50  r6 : d76f3e40  r5 : 6b6b6b53  r4 : dfd88000
<4>[  570.537231] r3 : 6b6b6b6b  r2 : 6b6b6b6b  r1 : d76f3e40  r0 : d7691280
<4>[  570.544067] Flags: nzCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment
kernel
<4>[  570.551818] Control: 10c5387d  Table: 9f7a4019  DAC: 00000015
<4>[  570.557861]
<4>[  570.557861] PC: 0xc034f634:
<4>[  570.562316] f634  e3c4403f e5943004 e2833001 e5843004 e2867010 e5965010
e2455018 ea000016
<4>[  570.570953] f654  e5952010 e3520000 12435018 1a000012 e1a00005 eb000664
e5943004 e2433001
<4>[  570.579559] f674  e5843004 e5943000 e3130002 0a000000 eb06adc2 e1a01005
e3e0206b e1a00008
<4>[  570.588165] f694  ebffff91 e1a00005 eb000687 e5943004 e2833001 e5843004
eaffffe5 e1a0a005
<4>[  570.596771] f6b4  e5ba3018 f5d3f000 e15a0007 1affffe3 f1080080 e1a0200d
e3c23d7f e3c3303f
<4>[  570.605377] f6d4  e5932004 e2422001 e5832004 e5933000 e3130002 0a000000
eb06ada8 e1a0300d
<4>[  570.613983] f6f4  e3c34d7f e3c4403f ea000019 f10c0080 e5943004 e2833001
e5843004 e5963010
<4>[  570.622589] f714  e153000a 03a05000 0a000003 e5965014 e2455018 e1a00005
eb000633 f1080080
<4>[  570.631195]
<4>[  570.631195] LR: 0xc0351830:
<4>[  570.635681] 1830  059111c4 15911184 e3510000 012fff1e eafff28e e92d4070
e2504000 e1a06002
<4>[  570.644287] 1850  08bd8070 e2113080 e201100f 1a000005 e2811070 e3520000
e0841101 e5915004
<4>[  570.652893] 1870  0a000007 ea000005 e2811060 e3520000 e0841101 e5915004
0a000001 e3a03000
<4>[  570.661499] 1890  e5813004 e3550000 08bd8070 e3a03000 e1a00004 e5853028
e1a01005 ebfff759
<4>[  570.670104] 18b0  e3560000 08bd8070 e1a00004 e1a01005 e8bd4070 eafff265
e92d41f0 e5903180
<4>[  570.678710] 18d0  e1a04000 e1a05001 e3530000 13a07000 1a00000b ea00002d
e7936101 e5d63048
<4>[  570.687316] 18f0  e3130002 0a000006 e5d63018 e1a00006 e3833004 e5c63018
ebffff85 e2860020
<4>[  570.695922] 1910  ebfecade e5943180 e2871014 e5d32004 e1570002 e2877001
baffffee e3a06000
<4>[  570.704528]
<4>[  570.704528] SP: 0xdfd89db8:
<4>[  570.709014] 9db8  dfc00080 dfc02e40 0000000f c01e2060 ceca0258 dfc05c10
00000010 dfc0010c
<4>[  570.717620] 9dd8  ceca0000 ffffffff dfd89e24 d76f3e40 d76f3e50 c0138a6c
d7691280 d76f3e40
<4>[  570.726226] 9df8  6b6b6b6b 6b6b6b6b dfd88000 6b6b6b53 d76f3e40 d76f3e50
df42a100 00000100
<4>[  570.734832] 9e18  6b6b6b53 d7691280 00000002 dfd89e38 c03518b0 c034f6b4
20000093 ffffffff
<4>[  570.743438] 9e38  d7691280 d76f3e40 00000000 00000000 d7691280 00000100
c069ac48 c03518b0
<4>[  570.752044] 9e58  0000002c 00000001 d76f30e4 c03519e8 d57c9aa0 d57c9a80
d7691280 00000000
<4>[  570.760650] 9e78  c069ac18 c0354750 d57c9aa0 c069ac48 c068d208 00000002
df5902bc 00000100
<4>[  570.769256] 9e98  0000001f c0306708 d57c9ad4 d57c9aa0 c068d208 c0306858
d57c9aa0 d76912e8
<4>[  570.777862]
<4>[  570.777893] FP: 0xd7691200:
<4>[  570.782348] 1200  4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439
c0000000 00a00000
<4>[  570.790954] 1220  00004000 80080080 00000000 00000022 635688c0 d84156c5
00000021 c0406b78
<4>[  570.799560] 1240  4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439
c0000000 0800c000
<4>[  570.808166] 1260  00000001 0a200000 00a00008 40000028 84004000 00000000
635688c0 d84156c5
<4>[  570.816772] 1280  00000008 00342e32 00000000 00000000 00000000 00000004
00000000 00000003
<4>[  570.825378] 12a0  00000000 00000000 00000009 00000008 df590080 df42a100
00000507 00000040
<4>[  570.833984] 12c0  00000000 00000000 d76912c8 d76912c8 d76f3240 d7545d80
00000000 00000000
<4>[  570.842590] 12e0  00000001 00000000 df5900e8 d76ae7c0 d72e0300 d57c9aac
dc5ec35c df5900f0
<4>[  570.851196]
<4>[  570.851196] R0: 0xd7691200:
<4>[  570.855682] 1200  4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439
c0000000 00a00000
<4>[  570.864288] 1220  00004000 80080080 00000000 00000022 635688c0 d84156c5
00000021 c0406b78
<4>[  570.872894] 1240  4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439
c0000000 0800c000
<4>[  570.881500] 1260  00000001 0a200000 00a00008 40000028 84004000 00000000
635688c0 d84156c5
<4>[  570.890106] 1280  00000008 00342e32 00000000 00000000 00000000 00000004
00000000 00000003
<4>[  570.898712] 12a0  00000000 00000000 00000009 00000008 df590080 df42a100
00000507 00000040
<4>[  570.907318] 12c0  00000000 00000000 d76912c8 d76912c8 d76f3240 d7545d80
00000000 00000000
<4>[  570.915924] 12e0  00000001 00000000 df5900e8 d76ae7c0 d72e0300 d57c9aac
dc5ec35c df5900f0
<4>[  570.924530]
<4>[  570.924530] R1: 0xd76f3dc0:
<4>[  570.929016] 3dc0  4468ffff 00092409 4468ffff 0009241c 46a00701 08092439
c0000000 00040080
<4>[  570.937622] 3de0  00008000 00000000 00000001 00000000 635688c0 d84156c5
00808040 c03558d0
<4>[  570.946228] 3e00  4468ffff 00092409 4468ffff 0009241c 46a8ffff 08092439
c0000000 01000080
<4>[  570.954833] 3e20  00000020 00190020 00000500 05800000 50800000 00200000
635688c0 d84156c5
<4>[  570.963439] 3e40  01810509 000400c0 00000000 00000000 ced0b758 ced0bb18
cf9ee0c0 00000000
<4>[  570.972045] 3e60  d7259175 00000007 00000000 00000000 00000000 00000000
00000000 00000000
<4>[  570.980651] 3e80  4468ffff 00092409 4468ffff 0009241c 46a00b02 08092439
c0000000 00400080
<4>[  570.989257] 3ea0  00002000 80004000 01000000 00810000 635688c0 d84156c5
00a80002 c03558d0
<4>[  570.997894]
<4>[  570.997894] R4: 0xdfd87f80:
<4>[  571.002349] 7f80  635688c0 d84156c5 dfd65180 c023041c 635688c0 d84156c5
00000001 00000000
<4>[  571.010955] 7fa0  dfd87a40 dfd87f08 c05c3c7c 00000000 c068a894 00000000
00000002 00008124
<4>[  571.019561] 7fc0  0000073c 00000000 635688c0 d84156c5 00000013 c023041c
00000000 00000000
<4>[  571.028167] 7fe0  00000000 c01813f8 dfd63400 c0181354 c01399a0 c01399a0
ffeffdfa fffffb5e
<4>[  571.036773] 8000  00000000 00000003 00000000 dfd68c40 c0670c70 00000000
00000015 dfd68c40
<4>[  571.045379] 8020  dfd88000 c06707d8 dc9fdb40 c0670bd4 de3a9690 d74c81c0
dfd89e54 dfd89e28
<4>[  571.053985] 8040  c04fab54 00000000 00000000 00000000 00000000 00000000
00000000 00000000
<4>[  571.062591] 8060  00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000
<4>[  571.071228]
<4>[  571.071228] R6: 0xd76f3dc0:
<4>[  571.075683] 3dc0  4468ffff 00092409 4468ffff 0009241c 46a00701 08092439
c0000000 00040080
<4>[  571.084289] 3de0  00008000 00000000 00000001 00000000 635688c0 d84156c5
00808040 c03558d0
<4>[  571.092895] 3e00  4468ffff 00092409 4468ffff 0009241c 46a8ffff 08092439
c0000000 01000080
<4>[  571.101531] 3e20  00000020 00190020 00000500 05800000 50800000 00200000
635688c0 d84156c5
<4>[  571.110137] 3e40  01810509 000400c0 00000000 00000000 ced0b758 ced0bb18
cf9ee0c0 00000000
<4>[  571.118743] 3e60  d7259175 00000007 00000000 00000000 00000000 00000000
00000000 00000000
<4>[  571.127349] 3e80  4468ffff 00092409 4468ffff 0009241c 46a00b02 08092439
c0000000 00400080
<4>[  571.135955] 3ea0  00002000 80004000 01000000 00810000 635688c0 d84156c5
00a80002 c03558d0
<4>[  571.144561]
<4>[  571.144561] R7: 0xd76f3dd0:
<4>[  571.149017] 3dd0  46a00701 08092439 c0000000 00040080 00008000 00000000
00000001 00000000
<4>[  571.157623] 3df0  635688c0 d84156c5 00808040 c03558d0 4468ffff 00092409
4468ffff 0009241c
<4>[  571.166259] 3e10  46a8ffff 08092439 c0000000 01000080 00000020 00190020
00000500 05800000
<4>[  571.174865] 3e30  50800000 00200000 635688c0 d84156c5 01810509 000400c0
00000000 00000000
<4>[  571.183471] 3e50  ced0b758 ced0bb18 cf9ee0c0 00000000 d7259175 00000007
00000000 00000000
<4>[  571.192077] 3e70  00000000 00000000 00000000 00000000 4468ffff 00092409
4468ffff 0009241c
<4>[  571.200683] 3e90  46a00b02 08092439 c0000000 00400080 00002000 80004000
01000000 00810000
<4>[  571.209289] 3eb0  635688c0 d84156c5 00a80002 c03558d0 4468ffff 00092409
4468ffff 0009241c
<4>[  571.217895]
<4>[  571.217895] R8: 0xdf42a080:
<4>[  571.222351] a080  dfffd040 df510000 000000c0 df42a0c0 00000006 ffffffff
00000000 fffffffe
<4>[  571.230957] a0a0  fffffffe fffffffe fffffffe fffffffe fffffffe 00000000
00000000 00000000
<4>[  571.239562] a0c0  00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000
<4>[  571.248168] a0e0  00000000 00000000 00000000 00000000 00000000 00000000
635688c0 d84156c5
<4>[  571.256774] a100  c066f5d8 00000001 dfcf1d00 00000001 ffffffff 0000000f
000059de 00000000
<4>[  571.265380] a120  00000000 00000000 df522080 00000000 c068d19c dfc73030
00000005 00000005
<4>[  571.273986] a140  00000002 df806aa8 00000000 00000000 0000000c c05f06a6
69636865 6463685f
<4>[  571.282592] a160  6273753a 00000031 00000000 00000000 00000000 00200200
ffff8c07 c06efd80
<0>[  571.291229] Process khubd (pid: 269, stack limit = 0xdfd882e8)
<0>[  571.297332] Stack: (0xdfd89e38 to 0xdfd8a000)
<0>[  571.301910] 9e20:
d7691280 d76f3e40
<0>[  571.310485] 9e40: 00000000 00000000 d7691280 00000100 c069ac48 c03518b0
0000002c 00000001
<0>[  571.319061] 9e60: d76f30e4 c03519e8 d57c9aa0 d57c9a80 d7691280 00000000
c069ac18 c0354750
<0>[  571.327636] 9e80: d57c9aa0 c069ac48 c068d208 00000002 df5902bc 00000100
0000001f c0306708
<0>[  571.336242] 9ea0: d57c9ad4 d57c9aa0 c068d208 c0306858 d57c9aa0 d76912e8
c068d208 c0305d80
<0>[  571.344818] 9ec0: d57c9aa0 d76912e8 d57c9a80 c03045a0 d7691280 00000000
d57c9a80 c0351914
<0>[  571.353393] 9ee0: d7691280 d769131c d76912e8 d76912fc df5902bc c034c780
dfc91700 00000001
<0>[  571.361968] 9f00: 00000004 dfd88000 df590080 00000100 c068d044 c034d630
dfc1db30 dfc1db00
<0>[  571.370574] 9f20: dfc1db30 dfc1db00 00000001 dfd68c70 df42a118 daff45a0
00000000 daff45a0
<0>[  571.379150] 9f40: df42a100 df590080 00000004 df60d280 df59008c dfc91703
dfc91738 daff4580
<0>[  571.387725] 9f60: 00000000 00000003 dfc91740 dfc91790 dfc91708 df59011c
00000009 dfc9173c
<0>[  571.396301] 9f80: dfc91734 dfd89f94 00000000 dfd68c40 c0185954 dfd89f94
dfd89f94 00000101
<0>[  571.404876] 9fa0: 01000001 c018560c 00000000 dfc31f68 dfd89fd4 c034d1c4
00000000 00000000
<0>[  571.413452] 9fc0: 00000000 00000000 00000000 c0185624 00000000 00000000
dfd89fd8 dfd89fd8
<0>[  571.422058] 9fe0: 00000000 dfc31f68 c01855ac c01399a0 00000013 c01399a0
feefff7b ffffd9ef
<4>[  571.430633] [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) from
[<c03518b0>] (usb_disable_endpoint+0x6c/0x84)
<4>[  571.441223] [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) from
[<c03519e8>] (usb_disable_interface+0x30/0x4c)
<4>[  571.451629] [<c03519e8>] (usb_disable_interface+0x30/0x4c) from
[<c0354750>] (usb_unbind_interface+0x50/0x1a8)
<4>[  571.462158] [<c0354750>] (usb_unbind_interface+0x50/0x1a8) from
[<c0306708>] (__device_release_driver+0x84/0xd0)
<4>[  571.472839] [<c0306708>] (__device_release_driver+0x84/0xd0) from
[<c0306858>] (device_release_driver+0x1c/0x28)
<4>[  571.483520] [<c0306858>] (device_release_driver+0x1c/0x28) from
[<c0305d80>] (bus_remove_device+0xa4/0xb4)
<4>[  571.493621] [<c0305d80>] (bus_remove_device+0xa4/0xb4) from [<c03045a0>]
(device_del+0x110/0x16c)
<4>[  571.502960] [<c03045a0>] (device_del+0x110/0x16c) from [<c0351914>]
(usb_disable_device+0x4c/0xf0)
<4>[  571.512359] [<c0351914>] (usb_disable_device+0x4c/0xf0) from [<c034c780>]
(usb_disconnect+0x90/0x134)
<4>[  571.522033] [<c034c780>] (usb_disconnect+0x90/0x134) from [<c034d630>]
(hub_thread+0x46c/0xf00)
<4>[  571.531158] [<c034d630>] (hub_thread+0x46c/0xf00) from [<c0185624>]
(kthread+0x78/0x80)
<4>[  571.539581] [<c0185624>] (kthread+0x78/0x80) from [<c01399a0>]
(kernel_thread_exit+0x0/0x8)
<0>[  571.548339] Code: e2833001 e5843004 eaffffe5 e1a0a005 (e5ba3018)
<1>[  571.554748] Unable to handle kernel paging request at virtual address 6b6b6b6b
<1>[  571.562316] pgd = c0104000
<1>[  571.565155] [6b6b6b6b] *pgd=00000000
<0>[  571.568908] Internal error: Oops: 5 [#2] PREEMPT
<0>[  571.573760] last sysfs file:
/sys/devices/platform/ehci-omap.0/usb1/1-2/1-2.4/idProduct
<4>[  571.582122] Modules linked in: blackberry cdc_acm sierra option usb_wwan
hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc
<4>[  571.596252] CPU: 0    Tainted: G      D W    (2.6.35.13-02836-g764dcf5 #12)
<4>[  571.603546] PC is at snd_complete_urb+0x230/0x258
<4>[  571.608489] LR is at usb_hcd_giveback_urb+0xa0/0xec
<4>[  571.613616] pc : [<c0424068>]    lr : [<c034f494>]    psr: 00000193
<4>[  571.613616] sp : dfd89b38  ip : ced0b898  fp : ffffffb9
<4>[  571.625640] r10: 00000000  r9 : df4d3670  r8 : 00000000
<4>[  571.631134] r7 : df42a100  r6 : ced0b880  r5 : cf9202c8  r4 : 6b6b6b6b
<4>[  571.637969] r3 : 00000000  r2 : ced0b880  r1 : 00000000  r0 : ced0b880
<4>[  571.644805] Flags: nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment
kernel
<4>[  571.652587] Control: 10c5387d  Table: 9f7a4019  DAC: 00000015
<4>[  571.658599]
<4>[  571.658599] PC: 0xc0423fe8:
<4>[  571.663085] 3fe8  e794e00c e082200e e595e014 e2811010 e150000e e2800001
bafffff5 e5832054
<4>[  571.671691] 4008  e5952014 e5832068 ea000006 e3022994 e3a01000 e7942002
e583107c e3520004
<4>[  571.680297] 4028  23a02004 e5832080 e3a01020 e1a00006 ebfcb34f e2501000
08bd81f0 e59f0040
<4>[  571.688903] 4048  eb0359bb e2841da5 e5950010 e281101c e8bd41f0 eaf9992a
e373006c 0afffff8
<4>[  571.697509] 4068  e5943000 e5d3302c e3130001 0affff7a eafffff3 e1a00004
e1a01005 ebfffad9
<4>[  571.706115] 4088  eaffffe8 c060bb8c e92d4ff8 e1a06000 e2807014 e1a04000
e1a00007 e1a05001
<4>[  571.714721] 40a8  e1a0b003 e1a0a002 e59d9028 eb035dcc e5b63040 e30209ac
e30219b0 ea00000d
<4>[  571.723327] 40c8  e2433da6 e2438038 e5133030 e153000a 1a000007 e5d53002
e798c000 e15c0003
<4>[  571.731933]
<4>[  571.731933] LR: 0xc034f414:
<4>[  571.736419] f414  11a05003 1a00000a e5913040 e3130001 0a000007 e5911058
e2753001 33a03000
<4>[  571.745025] f434  e5942054 e1510002 23a03000 e3530000 13e05078 e1a00006
e1a01004 ebffff97
<4>[  571.753631] f454  e596304c e3530000 0a000006 e59f3070 e1a00006 e1a01004
e1a02005 e5933000
<4>[  571.762237] f474  e1a0e00f e593f008 e1a00004 eb00076c e584503c e1a00004
e1a0e00f e594f078
<4>[  571.770843] f494  e2843008 e1932f9f e2422001 e1831f92 e3310000 1afffffa
e594300c e3530000
<4>[  571.779449] f4b4  0a000004 e59f001c e3a01003 e3a02001 e3a03000 ebf86e03
e1a00004 e8bd4070
<4>[  571.788055] f4d4  ea0006f9 c0707b34 c068d194 e92d41f0 e591302c e1a05001
e1a04000 e1a08002
<4>[  571.796661] f4f4  e5933030 e3530000 1a00003f e10f6000 f10c0080 e1a0c00d
e3cc3d7f e3c3303f
<4>[  571.805267]
<4>[  571.805267] SP: 0xdfd89ab8:
<4>[  571.809753] 9ab8  c06b3534 dffe4d00 0000005d 0000005c c0300f4c 00000010
c06af6a8 c02fd7b0
<4>[  571.818359] 9ad8  c06bca8c ffffffff dfd89b24 ced0b880 df42a100 c0138a6c
ced0b880 00000000
<4>[  571.826965] 9af8  ced0b880 00000000 6b6b6b6b cf9202c8 ced0b880 df42a100
00000000 df4d3670
<4>[  571.835571] 9b18  00000000 ffffffb9 ced0b898 dfd89b38 c034f494 c0424068
00000193 ffffffff
<4>[  571.844177] 9b38  ced0b880 00000000 df42a100 df42a100 00000000 c034f494
00000000 00000000
<4>[  571.852783] 9b58  ced0b880 c0360728 df42a1ec ffcea500 df42a100 cf9ee0c0
00000000 c0362600
<4>[  571.861389] 9b78  7268746b 00000acf 00000159 00000430 0000010c ffc02430
ffcea520 00000fff
<4>[  571.869995] 9b98  00000000 00000860 df42a224 df42a22c 352e3137 df42a1ec
df42a100 0000c00b
<4>[  571.878601]
<4>[  571.878601] IP: 0xced0b818:
<4>[  571.883087] b818  f47ffd50 fbedd122 0c5d7d8b e8a18eab c9edf871 fa42458e
9d74e35b 09f91102
<4>[  571.891693] b838  9f7b67b6 c028f924 be7374ea 76cfeff7 3dedf6eb b3bdafca
efeb3cb9 48b9b393
<4>[  571.900299] b858  71e79e75 ff27ed31 ef4af61b edffffc3 7dbafefa c4fff7fd
eefbeff7 e686ee2b
<4>[  571.908905] b878  635688c0 d84156c5 00000001 00000000 00000001 00000000
00000000 00000000
<4>[  571.917510] b898  ced0b898 ced0b898 ced0b8a0 ced0b8a0 00000000 d7691280
d76f3e40 00008880
<4>[  571.926116] b8b8  00000000 00000000 00000206 ffce9200 8ed0c200 00000000
00000000 000000c0
<4>[  571.934722] b8d8  00000000 00000000 00000000 00000867 00000001 00000008
00000002 cf9202c8
<4>[  571.943328] b8f8  c0423e38 00000000 000000c0 00000000 ffffffb9 5a5a5a5a
5a5a5a5a 5a5a5a5a
<4>[  571.951934]
<4>[  571.951934] R0: 0xced0b800:
<4>[  571.956420] b800  e2238576 a5e97707 5bcd6f77 875e9294 feeba4be d0cc4a11
f47ffd50 fbedd122
<4>[  571.965026] b820  0c5d7d8b e8a18eab c9edf871 fa42458e 9d74e35b 09f91102
9f7b67b6 c028f924
<4>[  571.973632] b840  be7374ea 76cfeff7 3dedf6eb b3bdafca efeb3cb9 48b9b393
71e79e75 ff27ed31
<4>[  571.982238] b860  ef4af61b edffffc3 7dbafefa c4fff7fd eefbeff7 e686ee2b
635688c0 d84156c5
<4>[  571.990844] b880  00000001 00000000 00000001 00000000 00000000 00000000
ced0b898 ced0b898
<4>[  571.999450] b8a0  ced0b8a0 ced0b8a0 00000000 d7691280 d76f3e40 00008880
00000000 00000000
<4>[  572.008056] b8c0  00000206 ffce9200 8ed0c200 00000000 00000000 000000c0
00000000 00000000
<4>[  572.016662] b8e0  00000000 00000867 00000001 00000008 00000002 cf9202c8
c0423e38 00000000
<4>[  572.025268]
<4>[  572.025268] R2: 0xced0b800:
<4>[  572.029754] b800  e2238576 a5e97707 5bcd6f77 875e9294 feeba4be d0cc4a11
f47ffd50 fbedd122
<4>[  572.038360] b820  0c5d7d8b e8a18eab c9edf871 fa42458e 9d74e35b 09f91102
9f7b67b6 c028f924
<4>[  572.046966] b840  be7374ea 76cfeff7 3dedf6eb b3bdafca efeb3cb9 48b9b393
71e79e75 ff27ed31
<4>[  572.055572] b860  ef4af61b edffffc3 7dbafefa c4fff7fd eefbeff7 e686ee2b
635688c0 d84156c5
<4>[  572.064178] b880  00000001 00000000 00000001 00000000 00000000 00000000
ced0b898 ced0b898
<4>[  572.072784] b8a0  ced0b8a0 ced0b8a0 00000000 d7691280 d76f3e40 00008880
00000000 00000000
<4>[  572.081390] b8c0  00000206 ffce9200 8ed0c200 00000000 00000000 000000c0
00000000 00000000
<4>[  572.089996] b8e0  00000000 00000867 00000001 00000008 00000002 cf9202c8
c0423e38 00000000
<4>[  572.098602]
<4>[  572.098602] R5: 0xcf920248:
<4>[  572.103088] 0248  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.111694] 0268  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.120300] 0288  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.128906] 02a8  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.137512] 02c8  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.146118] 02e8  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.154724] 0308  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.163330] 0328  6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b
6b6b6b6b 6b6b6b6b
<4>[  572.171936]
<4>[  572.171936] R6: 0xced0b800:
<4>[  572.176422] b800  e2238576 a5e97707 5bcd6f77 875e9294 feeba4be d0cc4a11
f47ffd50 fbedd122
<4>[  572.185028] b820  0c5d7d8b e8a18eab c9edf871 fa42458e 9d74e35b 09f91102
9f7b67b6 c028f924
<4>[  572.193634] b840  be7374ea 76cfeff7 3dedf6eb b3bdafca efeb3cb9 48b9b393
71e79e75 ff27ed31
<4>[  572.202239] b860  ef4af61b edffffc3 7dbafefa c4fff7fd eefbeff7 e686ee2b
635688c0 d84156c5
<4>[  572.210845] b880  00000001 00000000 00000001 00000000 00000000 00000000
ced0b898 ced0b898
<4>[  572.219451] b8a0  ced0b8a0 ced0b8a0 00000000 d7691280 d76f3e40 00008880
00000000 00000000
<4>[  572.228057] b8c0  00000206 ffce9200 8ed0c200 00000000 00000000 000000c0
00000000 00000000
<4>[  572.236663] b8e0  00000000 00000867 00000001 00000008 00000002 cf9202c8
c0423e38 00000000
<4>[  572.245269]
<4>[  572.245269] R7: 0xdf42a080:
<4>[  572.249755] a080  dfffd040 df510000 000000c0 df42a0c0 00000006 ffffffff
00000000 fffffffe
<4>[  572.258361] a0a0  fffffffe fffffffe fffffffe fffffffe fffffffe 00000000
00000000 00000000
<4>[  572.266967] a0c0  00000000 00000000 00000000 00000000 00000000 00000000
00000000 00000000
<4>[  572.275573] a0e0  00000000 00000000 00000000 00000000 00000000 00000000
635688c0 d84156c5
<4>[  572.284179] a100  c066f5d8 00000001 dfcf1d00 00000001 ffffffff 0000000f
000059de 00000000
<4>[  572.292785] a120  00000000 00000000 df522080 00000000 c068d19c dfc73030
00000005 00000005
<4>[  572.301391] a140  00000002 df806aa8 00000000 00000000 0000000c c05f06a6
69636865 6463685f
<4>[  572.309997] a160  6273753a 00000031 00000000 00000000 00000000 00200200
ffff8c07 c06efd80
<4>[  572.318603]
<4>[  572.318603] R9: 0xdf4d35f0:
<4>[  572.323089] 35f0  00000000 00000000 d685a300 00000000 00000000 00000000
d685a300 00000000
<4>[  572.331695] 3610  00000000 00000000 d685a300 00000000 00000000 00000000
d685a300 00000000
<4>[  572.340301] 3630  00000000 00000000 d685a300 00000000 00000000 dfc8c6c0
defc6d00 dedc8dc0
<4>[  572.348907] 3650  d6a42540 00000000 d685a300 00000000 00000000 00000000
d685a300 00000000
<4>[  572.357513] 3670  00000000 ffcea000 d685a300 00000000 00000000 00000000
d685a300 00000000
<4>[  572.366119] 3690  00000000 00000000 d685a300 00000000 00000000 00000000
d685a300 00000000
<4>[  572.374725] 36b0  00000000 00000000 d685a300 00000000 00000000 00000000
d685a300 00000000
<4>[  572.383331] 36d0  00000000 00000000 d685a300 00000000 00000000 00000000
d685a300 00000000
<0>[  572.391937] Process khubd (pid: 269, stack limit = 0xdfd882e8)
<0>[  572.398040] Stack: (0xdfd89b38 to 0xdfd8a000)
<0>[  572.402618] 9b20:
ced0b880 00000000
<0>[  572.411193] 9b40: df42a100 df42a100 00000000 c034f494 00000000 00000000
ced0b880 c0360728
<0>[  572.419769] 9b60: df42a1ec ffcea500 df42a100 cf9ee0c0 00000000 c0362600
7268746b 00000acf
<0>[  572.428375] 9b80: 00000159 00000430 0000010c ffc02430 ffcea520 00000fff
00000000 00000860
<0>[  572.436950] 9ba0: df42a224 df42a22c 352e3137 df42a1ec df42a100 0000c00b
00000000 00010035
<0>[  572.445526] 9bc0: dfd88000 6b6b6b53 d7691280 c0364b88 df42a100 df42a100
00010003 df42a100
<0>[  572.454101] 9be0: 40000193 00000000 0000004d 00000002 dfd88000 6b6b6b53
d7691280 c034ebd0
<0>[  572.462707] 9c00: df508c40 00000000 00000000 c01a8e38 c0674ec8 0000004d
df508c40 00000003
<0>[  572.471282] 9c20: 00000002 c01ab034 0000004d 00000000 dfd68c40 c013806c
ffffffff fa200000
<0>[  572.479858] 9c40: dfd68c40 c0138ac8 00000000 c06af260 00000080 00000080
dfd89df0 dfd882e8
<0>[  572.488433] 9c60: dfd68c40 00000000 00000005 00000005 6b6b6b53 d7691280
00000000 dfd89c90
<0>[  572.497009] 9c80: c013c7fc c013c800 60000113 ffffffff dfd882e8 0000000b
6b6b6b6b dfd89df0
<0>[  572.505615] 9ca0: 00000000 00000005 00000000 c0141754 dfd89df0 c065e988
6b6b6b6b dfd68c40
<0>[  572.514190] 9cc0: 00000000 c0141a08 dfd89d0c 00000000 0000054a d6a790f4
d6a79884 c0138314
<0>[  572.522766] 9ce0: d6a790f4 d6a79884 0000ffff 00000000 db3c9bf4 000000c1
dfd68c40 c0670808
<0>[  572.531341] 9d00: 002d4f8a d1ab29ff dfd89d4c c0169994 0000004d d166b63b
dfd68c40 c0670808
<0>[  572.539916] 9d20: dfd46cb0 00000001 c0670808 00000005 c065e988 6b6b6b6b
dfd89df0 df42a100
<0>[  572.548522] 9d40: 20000193 6b6b6b53 d7691280 c0138314 dfd68c40 c06707d8
00000003 dfd46cb0
<0>[  572.557098] 9d60: dfd68c70 dfd68c40 dfd89d8c c0169ca8 dfd46c80 c06707d8
00000001 40000093
<0>[  572.565673] 9d80: d751d000 dc3ac000 dfc0bd80 dfc10e40 0000000f c01e2060
dfd89db4 dfc11ad0
<0>[  572.574249] 9da0: 00000010 dfc0be0c dfd89e0c dfc0bd80 d751f000 d722f000
dfc00080 dfc02e40
<0>[  572.582824] 9dc0: 0000000f c01e2060 ceca0258 dfc05c10 00000010 dfc0010c
ceca0000 ffffffff
<0>[  572.591430] 9de0: dfd89e24 d76f3e40 d76f3e50 c0138a6c d7691280 d76f3e40
6b6b6b6b 6b6b6b6b
<0>[  572.600006] 9e00: dfd88000 6b6b6b53 d76f3e40 d76f3e50 df42a100 00000100
6b6b6b53 d7691280
<0>[  572.608581] 9e20: 00000002 dfd89e38 c03518b0 c034f6b4 20000093 ffffffff
d7691280 d76f3e40
<0>[  572.617156] 9e40: 00000000 00000000 d7691280 00000100 c069ac48 c03518b0
0000002c 00000001
<0>[  572.625732] 9e60: d76f30e4 c03519e8 d57c9aa0 d57c9a80 d7691280 00000000
c069ac18 c0354750
<0>[  572.634338] 9e80: d57c9aa0 c069ac48 c068d208 00000002 df5902bc 00000100
0000001f c0306708
<0>[  572.642913] 9ea0: d57c9ad4 d57c9aa0 c068d208 c0306858 d57c9aa0 d76912e8
c068d208 c0305d80
<0>[  572.651489] 9ec0: d57c9aa0 d76912e8 d57c9a80 c03045a0 d7691280 00000000
d57c9a80 c0351914
<0>[  572.660064] 9ee0: d7691280 d769131c d76912e8 d76912fc df5902bc c034c780
dfc91700 00000001
<0>[  572.668670] 9f00: 00000004 dfd88000 df590080 00000100 c068d044 c034d630
dfc1db30 dfc1db00
<0>[  572.677246] 9f20: dfc1db30 dfc1db00 00000001 dfd68c70 df42a118 daff45a0
00000000 daff45a0
<0>[  572.685821] 9f40: df42a100 df590080 00000004 df60d280 df59008c dfc91703
dfc91738 daff4580
<0>[  572.694396] 9f60: 00000000 00000003 dfc91740 dfc91790 dfc91708 df59011c
00000009 dfc9173c
<0>[  572.702972] 9f80: dfc91734 dfd89f94 00000000 dfd68c40 c0185954 dfd89f94
dfd89f94 00000101
<0>[  572.711547] 9fa0: 01000001 c018560c 00000000 dfc31f68 dfd89fd4 c034d1c4
00000000 00000000
<0>[  572.720123] 9fc0: 00000000 00000000 00000000 c0185624 00000000 00000000
dfd89fd8 dfd89fd8
<0>[  572.728729] 9fe0: 00000000 dfc31f68 c01855ac c01399a0 00000013 c01399a0
feefff7b ffffd9ef
<4>[  572.737304] [<c0424068>] (snd_complete_urb+0x230/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  572.747436] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  572.757293] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  572.766326] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  572.774932] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  572.783508] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  572.792663] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  572.802337] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  572.811462] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  572.819854] Exception stack(0xdfd89c48 to 0xdfd89c90)
<4>[  572.825164] 9c40:                   00000000 c06af260 00000080 00000080
dfd89df0 dfd882e8
<4>[  572.833740] 9c60: dfd68c40 00000000 00000005 00000005 6b6b6b53 d7691280
00000000 dfd89c90
<4>[  572.842315] 9c80: c013c7fc c013c800 60000113 ffffffff
<4>[  572.847625] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c013c800>]
(die+0x140/0x1e4)
<4>[  572.855560] [<c013c800>] (die+0x140/0x1e4) from [<c0141754>]
(__do_kernel_fault+0x64/0x84)
<4>[  572.864227] [<c0141754>] (__do_kernel_fault+0x64/0x84) from [<c0141a08>]
(do_page_fault+0x294/0x2b4)
<4>[  572.873809] [<c0141a08>] (do_page_fault+0x294/0x2b4) from [<c0138314>]
(do_DataAbort+0x34/0x94)
<4>[  572.882965] [<c0138314>] (do_DataAbort+0x34/0x94) from [<c0138a6c>]
(__dabt_svc+0x4c/0x60)
<4>[  572.891601] Exception stack(0xdfd89df0 to 0xdfd89e38)
<4>[  572.896911] 9de0:                                     d7691280 d76f3e40
6b6b6b6b 6b6b6b6b
<4>[  572.905487] 9e00: dfd88000 6b6b6b53 d76f3e40 d76f3e50 df42a100 00000100
6b6b6b53 d7691280
<4>[  572.914062] 9e20: 00000002 dfd89e38 c03518b0 c034f6b4 20000093 ffffffff
<4>[  572.921020] [<c0138a6c>] (__dabt_svc+0x4c/0x60) from [<c034f6b4>]
(usb_hcd_flush_endpoint+0x9c/0x160)
<4>[  572.930694] [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) from
[<c03518b0>] (usb_disable_endpoint+0x6c/0x84)
<4>[  572.941284] [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) from
[<c03519e8>] (usb_disable_interface+0x30/0x4c)
<4>[  572.951690] [<c03519e8>] (usb_disable_interface+0x30/0x4c) from
[<c0354750>] (usb_unbind_interface+0x50/0x1a8)
<4>[  572.962188] [<c0354750>] (usb_unbind_interface+0x50/0x1a8) from
[<c0306708>] (__device_release_driver+0x84/0xd0)
<4>[  572.972869] [<c0306708>] (__device_release_driver+0x84/0xd0) from
[<c0306858>] (device_release_driver+0x1c/0x28)
<4>[  572.983551] [<c0306858>] (device_release_driver+0x1c/0x28) from
[<c0305d80>] (bus_remove_device+0xa4/0xb4)
<4>[  572.993682] [<c0305d80>] (bus_remove_device+0xa4/0xb4) from [<c03045a0>]
(device_del+0x110/0x16c)
<4>[  573.002990] [<c03045a0>] (device_del+0x110/0x16c) from [<c0351914>]
(usb_disable_device+0x4c/0xf0)
<4>[  573.012390] [<c0351914>] (usb_disable_device+0x4c/0xf0) from [<c034c780>]
(usb_disconnect+0x90/0x134)
<4>[  573.022064] [<c034c780>] (usb_disconnect+0x90/0x134) from [<c034d630>]
(hub_thread+0x46c/0xf00)
<4>[  573.031219] [<c034d630>] (hub_thread+0x46c/0xf00) from [<c0185624>]
(kthread+0x78/0x80)
<4>[  573.039611] [<c0185624>] (kthread+0x78/0x80) from [<c01399a0>]
(kernel_thread_exit+0x0/0x8)
<0>[  573.048370] Code: e8bd41f0 eaf9992a e373006c 0afffff8 (e5943000)
<4>[  573.055084] ---[ end trace 069f4a4f8aedac2b ]---
<0>[  573.060180] Kernel panic - not syncing: Fatal exception in interrupt
<4>[  573.066864] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c04fa6c0>]
(panic+0x6c/0xe8)
<4>[  573.075408] [<c04fa6c0>] (panic+0x6c/0xe8) from [<c013c868>] (die+0x1a8/0x1e4)
<4>[  573.083007] [<c013c868>] (die+0x1a8/0x1e4) from [<c0141754>]
(__do_kernel_fault+0x64/0x84)
<4>[  573.091674] [<c0141754>] (__do_kernel_fault+0x64/0x84) from [<c0141a08>]
(do_page_fault+0x294/0x2b4)
<4>[  573.101287] [<c0141a08>] (do_page_fault+0x294/0x2b4) from [<c0138314>]
(do_DataAbort+0x34/0x94)
<4>[  573.110443] [<c0138314>] (do_DataAbort+0x34/0x94) from [<c0138a6c>]
(__dabt_svc+0x4c/0x60)
<4>[  573.119110] Exception stack(0xdfd89af0 to 0xdfd89b38)
<4>[  573.124420] 9ae0:                                     ced0b880 00000000
ced0b880 00000000
<4>[  573.133026] 9b00: 6b6b6b6b cf9202c8 ced0b880 df42a100 00000000 df4d3670
00000000 ffffffb9
<4>[  573.141601] 9b20: ced0b898 dfd89b38 c034f494 c0424068 00000193 ffffffff
<4>[  573.148559] [<c0138a6c>] (__dabt_svc+0x4c/0x60) from [<c0424068>]
(snd_complete_urb+0x230/0x258)
<4>[  573.157806] [<c0424068>] (snd_complete_urb+0x230/0x258) from [<c034f494>]
(usb_hcd_giveback_urb+0xa0/0xec)
<4>[  573.167938] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from
[<c0360728>] (ehci_urb_done+0x100/0x120)
<4>[  573.177825] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>]
(ehci_work+0x550/0x9b4)
<4>[  573.186889] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>]
(ehci_irq+0x218/0x260)
<4>[  573.195465] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>]
(usb_hcd_irq+0x38/0x90)
<4>[  573.204071] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>]
(handle_IRQ_event+0x24/0xe4)
<4>[  573.213226] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>]
(handle_level_irq+0xdc/0x188)
<4>[  573.222930] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>]
(asm_do_IRQ+0x6c/0x8c)
<4>[  573.232086] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>]
(__irq_svc+0x48/0xa8)
<4>[  573.240478] Exception stack(0xdfd89c48 to 0xdfd89c90)
<4>[  573.245788] 9c40:                   00000000 c06af260 00000080 00000080
dfd89df0 dfd882e8
<4>[  573.254364] 9c60: dfd68c40 00000000 00000005 00000005 6b6b6b53 d7691280
00000000 dfd89c90
<4>[  573.262969] 9c80: c013c7fc c013c800 60000113 ffffffff
<4>[  573.268280] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c013c800>]
(die+0x140/0x1e4)
<4>[  573.276245] [<c013c800>] (die+0x140/0x1e4) from [<c0141754>]
(__do_kernel_fault+0x64/0x84)
<4>[  573.284912] [<c0141754>] (__do_kernel_fault+0x64/0x84) from [<c0141a08>]
(do_page_fault+0x294/0x2b4)
<4>[  573.294525] [<c0141a08>] (do_page_fault+0x294/0x2b4) from [<c0138314>]
(do_DataAbort+0x34/0x94)
<4>[  573.303680] [<c0138314>] (do_DataAbort+0x34/0x94) from [<c0138a6c>]
(__dabt_svc+0x4c/0x60)
<4>[  573.312377] Exception stack(0xdfd89df0 to 0xdfd89e38)
<4>[  573.317657] 9de0:                                     d7691280 d76f3e40
6b6b6b6b 6b6b6b6b
<4>[  573.326263] 9e00: dfd88000 6b6b6b53 d76f3e40 d76f3e50 df42a100 00000100
6b6b6b53 d7691280
<4>[  573.334869] 9e20: 00000002 dfd89e38 c03518b0 c034f6b4 20000093 ffffffff
<4>[  573.341827] [<c0138a6c>] (__dabt_svc+0x4c/0x60) from [<c034f6b4>]
(usb_hcd_flush_endpoint+0x9c/0x160)
<4>[  573.351531] [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) from
[<c03518b0>] (usb_disable_endpoint+0x6c/0x84)
<4>[  573.362121] [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) from
[<c03519e8>] (usb_disable_interface+0x30/0x4c)
<4>[  573.372558] [<c03519e8>] (usb_disable_interface+0x30/0x4c) from
[<c0354750>] (usb_unbind_interface+0x50/0x1a8)
<4>[  573.383056] [<c0354750>] (usb_unbind_interface+0x50/0x1a8) from
[<c0306708>] (__device_release_driver+0x84/0xd0)
<4>[  573.393768] [<c0306708>] (__device_release_driver+0x84/0xd0) from
[<c0306858>] (device_release_driver+0x1c/0x28)
<4>[  573.404449] [<c0306858>] (device_release_driver+0x1c/0x28) from
[<c0305d80>] (bus_remove_device+0xa4/0xb4)
<4>[  573.414611] [<c0305d80>] (bus_remove_device+0xa4/0xb4) from [<c03045a0>]
(device_del+0x110/0x16c)
<4>[  573.423919] [<c03045a0>] (device_del+0x110/0x16c) from [<c0351914>]
(usb_disable_device+0x4c/0xf0)
<4>[  573.433349] [<c0351914>] (usb_disable_device+0x4c/0xf0) from [<c034c780>]
(usb_disconnect+0x90/0x134)
<4>[  573.443054] [<c034c780>] (usb_disconnect+0x90/0x134) from [<c034d630>]
(hub_thread+0x46c/0xf00)
<4>[  573.452178] [<c034d630>] (hub_thread+0x46c/0xf00) from [<c0185624>]
(kthread+0x78/0x80)
<4>[  573.460601] [<c0185624>] (kthread+0x78/0x80) from [<c01399a0>]
(kernel_thread_exit+0x0/0x8)

--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: usb audio race at disconnect time

[Takashi Iwai]

At Tue, 30 Oct 2012 11:52:33 +0100,
Matthieu CASTET wrote:
> 
> 
> Takashi Iwai a écrit :
> >> Thanks,
> >>
> >> the first tests seems ok.
> >> We will do more strees test.
> > 
> > Do you have any good/bad test result?
> > If no regression is seen, I'm going to apply the patches for 3.7-rc4.
> The patches fix the races.
> 
> But I saw a failure I didn't saw before during stress test [1].

Hm, it's a list corruption, so everything is possible, including my
patch...

> It is hard to say if it is related to your patches :
> - we test on a older kernel version and I backported usbaudio from 3.7 with your
> patches
> - the start of the trace is missing and it is difficult to understand the list
> corruption.

Yeah, if you can catch the first trace, let me know.


thanks,

Takashi
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html