[Bluez-devel] Oops in hci_usb when disconnecting built-in controller

[Andy Ross <andy@plausible.org>]

[-- Attachment #1: Type: text/plain, Size: 614 bytes --]

I have a new laptop, a Compaq R3000Z (AMD64, but currently running a
32 bit kernel).  It has a built-in USB Bluetooth device, which
identifies itself as ID 049f:0086.  It works great with the hci_usb
driver from boot.

The laptop also has a "wireless enable/disable" switch, which is a
hardware switch that when pressed drops power to the internal 802.11b
antenna and (apparently) disconnects the HCI controller from the USB
bus.  When I use this, I get a 100% repeatable oops in the hci_usb
driver.  The driver then locks up and refuses to unload, although the
rest of the kernel appears to be unaffected.

Andy


[-- Attachment #2: usb-oops.txt --]
[-- Type: text/plain, Size: 1592 bytes --]

usb 3-2: USB disconnect, address 3
Unable to handle kernel NULL pointer dereference at virtual address 00000068
 printing eip:
c018661f
*pde = 00000000
Oops: 0002 [#1]
CPU:    0
EIP:    0060:[<c018661f>]    Tainted: P
EFLAGS: 00010246   (2.6.6)
EIP is at sysfs_hash_and_remove+0x2f/0x9b
eax: 00000000   ebx: 00000068   ecx: 00000068   edx: ffff0001
esi: 00000000   edi: f7550520   ebp: f88a39c0   esp: c1981e48
ds: 007b   es: 007b   ss: 0068
Process khubd (pid: 5, threadinfo=c1980000 task=f7f7a030)
Stack: c02f541a 00000077 f88a39c0 f7134530 f88a3960 c020f3fa f7550520 c0307cda
       c020f7fd f7134530 00000042 f88a39ac f7134400 f7134400 f72a97a4 f7428c24
       f889bd13 f7134530 f72a98a4 f73652e8 f887b855 f7134400 f72a9894 f887c8c0
Call Trace:
 [<c020f3fa>] class_device_dev_unlink+0x1a/0x20
 [<c020f7fd>] class_device_del+0x8d/0xd0
 [<f889bd13>] hci_unregister_dev+0x13/0x80 [bluetooth]
 [<f887b855>] hci_usb_disconnect+0x35/0x80 [hci_usb]
 [<c025ad7a>] usb_unbind_interface+0x7a/0x80
 [<c020ea34>] device_release_driver+0x64/0x70
 [<c020eba3>] bus_remove_device+0x73/0xc0
 [<c020da0c>] device_del+0x6c/0xb0
 [<c020da63>] device_unregister+0x13/0x30
 [<c0260b1f>] usb_disable_device+0x6f/0xb0
 [<c025b94b>] usb_disconnect+0xbb/0x110
 [<c025d9af>] hub_port_connect_change+0x27f/0x290
 [<c025d373>] hub_port_status+0x43/0xb0
 [<c025dc60>] hub_events+0x2a0/0x300
 [<c025dced>] hub_thread+0x2d/0xf0
 [<c0119c30>] default_wake_function+0x0/0x20
 [<c025dcc0>] hub_thread+0x0/0xf0
 [<c0104291>] kernel_thread_helper+0x5/0x14
 
Code: ff 4e 68 78 67 89 3c 24 8b 44 24 1c 89 44 24 04 e8 3c ff ff