From: Gustavo Padovan <gustavo@padovan.org>
To: Sasha Levin <sasha.levin@oracle.com>
Cc: marcel@holtmann.org, Johan Hedberg <johan.hedberg@gmail.com>,
"David S. Miller" <davem@davemloft.net>,
linux-bluetooth@vger.kernel.org, netdev@vger.kernel.org,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
Dave Jones <davej@redhat.com>
Subject: Re: net, bluetooth: object debug warning in bt_host_release()
Date: Wed, 21 Nov 2012 15:27:09 -0200 [thread overview]
Message-ID: <20121121172709.GB15370@joana> (raw)
In-Reply-To: <50A272E7.9080103@oracle.com>
[-- Attachment #1: Type: text/plain, Size: 5585 bytes --]
* Sasha Levin <sasha.levin@oracle.com> [2012-11-13 11:18:47 -0500]:
> Hi all,
>
> While fuzzing with trinity on a KVM tools (lkvm) guest running latest -next kernel I've
> stumbled on the following:
>
> [ 1434.201149] ------------[ cut here ]------------
> [ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
> [ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint: hci_power_on+0x0/0x90
> [ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-next-20121112-sasha-00018-g2f4ce0e #127
> [ 1434.210760] Call Trace:
> [ 1434.210760] [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
> [ 1434.210760] [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
> [ 1434.210760] [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
> [ 1434.210760] [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
> [ 1434.210760] [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
> [ 1434.210760] [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
> [ 1434.210760] [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
> [ 1434.210760] [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
> [ 1434.210760] [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
> [ 1434.210760] [<ffffffff8125eee7>] kfree+0x227/0x330
> [ 1434.210760] [<ffffffff83785db0>] bt_host_release+0x10/0x20
> [ 1434.210760] [<ffffffff81e539e5>] device_release+0x65/0xc0
> [ 1434.210760] [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
> [ 1434.210760] [<ffffffff819d39cd>] kobject_release+0xd/0x10
> [ 1434.210760] [<ffffffff819d33cc>] kobject_put+0x4c/0x60
> [ 1434.210760] [<ffffffff81e548b2>] put_device+0x12/0x20
> [ 1434.210760] [<ffffffff8376a334>] hci_free_dev+0x24/0x30
> [ 1434.210760] [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
> [ 1434.210760] [<ffffffff8127be12>] __fput+0x122/0x250
> [ 1434.210760] [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
> [ 1434.210760] [<ffffffff8127bf49>] ____fput+0x9/0x10
> [ 1434.210760] [<ffffffff81133402>] task_work_run+0xb2/0xf0
> [ 1434.210760] [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
> [ 1434.210760] [<ffffffff83bfb0ea>] int_signal+0x12/0x17
> [ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---
>
> Not that the guest doesn't emulate anything that looks like a bluetooth device or
> has bluetooth capabilities.
You have a virtual bluetooth device (vhci). That is why you get a bluetooth
crash. I think the following patch will fix this issue.
Gustavo
---
Author: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Date: Wed Nov 21 00:50:21 2012 -0200
Bluetooth: cancel power_on work when unregistering the device
We need to cancel the hci_power_on work in order to avoid it run when we
try to free the hdev.
[ 1434.201149] ------------[ cut here ]------------
[ 1434.204998] WARNING: at lib/debugobjects.c:261 debug_print_object+0x8e/0xb0()
[ 1434.208324] ODEBUG: free active (active state 0) object type: work_struct hint:
_power_on+0x0/0x90
[ 1434.210386] Pid: 8564, comm: trinity-child25 Tainted: G W 3.7.0-rc5-n
20121112-sasha-00018-g2f4ce0e #127
[ 1434.210760] Call Trace:
[ 1434.210760] [<ffffffff819f3d6e>] ? debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8110b887>] warn_slowpath_common+0x87/0xb0
[ 1434.210760] [<ffffffff8110b911>] warn_slowpath_fmt+0x41/0x50
[ 1434.210760] [<ffffffff819f3d6e>] debug_print_object+0x8e/0xb0
[ 1434.210760] [<ffffffff8376b750>] ? hci_dev_open+0x310/0x310
[ 1434.210760] [<ffffffff83bf94e5>] ? _raw_spin_unlock_irqrestore+0x55/0xa0
[ 1434.210760] [<ffffffff819f3ee5>] __debug_check_no_obj_freed+0xa5/0x230
[ 1434.210760] [<ffffffff83785db0>] ? bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff819f4d15>] debug_check_no_obj_freed+0x15/0x20
[ 1434.210760] [<ffffffff8125eee7>] kfree+0x227/0x330
[ 1434.210760] [<ffffffff83785db0>] bt_host_release+0x10/0x20
[ 1434.210760] [<ffffffff81e539e5>] device_release+0x65/0xc0
[ 1434.210760] [<ffffffff819d3975>] kobject_cleanup+0x145/0x190
[ 1434.210760] [<ffffffff819d39cd>] kobject_release+0xd/0x10
[ 1434.210760] [<ffffffff819d33cc>] kobject_put+0x4c/0x60
[ 1434.210760] [<ffffffff81e548b2>] put_device+0x12/0x20
[ 1434.210760] [<ffffffff8376a334>] hci_free_dev+0x24/0x30
[ 1434.210760] [<ffffffff82fd8fe1>] vhci_release+0x31/0x60
[ 1434.210760] [<ffffffff8127be12>] __fput+0x122/0x250
[ 1434.210760] [<ffffffff811cab0d>] ? rcu_user_exit+0x9d/0xd0
[ 1434.210760] [<ffffffff8127bf49>] ____fput+0x9/0x10
[ 1434.210760] [<ffffffff81133402>] task_work_run+0xb2/0xf0
[ 1434.210760] [<ffffffff8106cfa7>] do_notify_resume+0x77/0xa0
[ 1434.210760] [<ffffffff83bfb0ea>] int_signal+0x12/0x17
[ 1434.210760] ---[ end trace a6d57fefbc8a8cc7 ]---
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 81f4bac..69eb644 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1854,6 +1854,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
for (i = 0; i < NUM_REASSEMBLY; i++)
kfree_skb(hdev->reassembly[i]);
+ cancel_work_sync(&hdev->power_on);
+
if (!test_bit(HCI_INIT, &hdev->flags) &&
!test_bit(HCI_SETUP, &hdev->dev_flags)) {
hci_dev_lock(hdev);
[-- Attachment #2: Type: application/pgp-signature, Size: 836 bytes --]
prev parent reply other threads:[~2012-11-21 17:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-11-13 16:18 net, bluetooth: object debug warning in bt_host_release() Sasha Levin
2012-11-21 17:27 ` Gustavo Padovan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20121121172709.GB15370@joana \
--to=gustavo@padovan.org \
--cc=davej@redhat.com \
--cc=davem@davemloft.net \
--cc=johan.hedberg@gmail.com \
--cc=linux-bluetooth@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marcel@holtmann.org \
--cc=netdev@vger.kernel.org \
--cc=sasha.levin@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox