From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-ID: <4C7E474C.2090803@gmail.com> Date: Wed, 01 Sep 2010 05:30:04 -0700 From: "Justin P. Mattock" MIME-Version: 1.0 To: Suraj Sumangala CC: "Gustavo F. Padovan" , "linux-bluetooth@vger.kernel.org" , "marcel@holtmann.org" , Suraj Sumangala , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH]Bluetooth:net/bluetooth/hci_core.c Fix system crash when creating a new device with bluetooth-applet References: <1283274827-2770-1-git-send-email-justinmattock@gmail.com> <20100901010821.GA28764@vigoh> <4C7E156A.3050403@Atheros.com> In-Reply-To: <4C7E156A.3050403@Atheros.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed List-ID: On 09/01/2010 01:57 AM, Suraj Sumangala wrote: > Hi Justin, > > On 9/1/2010 1:30 PM, Gustavo F. Padovan wrote: >> Hi Justin, >> >> * Justin P. Mattock [2010-08-31 10:13:47 -0700]: >> >>> When using bluetooth-applet adding my apple magic mouse I'm getting a >>> total system freeze. >>> I used firescope to grab the crash data(below) The results of the >>> bisect pointed to here: >>> Bluetooth: Implemented HCI frame reassembly from RX stream >>> commit:9981151086385eecc2febf4ba95a14593f834b3d >>> >>> after looking through, and at the crash log, I couldn't help but >>> notice something in there >>> with IRQ, then after looking at hci_h4.c /* H4 receiver States */ #58 >>> I noticed >>> #define H4_W4_PACKET_TYPE 0 is at zero as well as #define >>> STREAM_REASSEMBLY 0 >>> so changing STREAM_REASSEMBLY to a different number that isn't taken >>> gets my machine to connect >>> perfectly to my magic mouse. Please have a look and let me know if >>> this is a good >>> solution and/or send me something else to test out. >> >> Your patch seems very wrong, H4_W4_PACKET_TYPE and STREAM_REASSEMBLY >> have nothing to do with each other, your commit message doesn't make >> sense. Also the patch corrupts 'struct hci_dev'. >> If you pay attention on the code flow you can check that >> STREAM_REASSEMBLY is never used in the crash log you sent. > Gustavo is correct. This should not have any effect on the code flow for > you as you are using USB transport and STREAM_REASSEMBLY is relevant > only for UART transport. > > So, I guess your problem is not 100% reproducible. easily reproducible open bluetooth applet connect new device once I see the spinning animation ring say connected the whole system just locks up.(keep in mind this is with a apple magic mouse) >> >>> >>> crash: >>> >>> >>> <1>[ 1755.556472] BUG: unable to handle kernel paging request at >>> ffff880224d0c548 >>> <1>[ 1755.556485] IP: [] >>> hci_reassembly.part.13.constprop.18+0x23/0x1b5 [bluetooth] >>> <4>[ 1755.556507] PGD 1609063 PUD 0 >>> <0>[ 1755.556515] Oops: 0000 [#1] SMP >>> <0>[ 1755.556522] last sysfs file: >>> /sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0A:00/power_supply/BAT0/voltage_now >>> >>> <4>[ 1755.556530] CPU 0 >>> <4>[ 1755.556533] Modules linked in: usb_storage xfrm4_mode_transport >>> xcbc rmd160 sha512_generic sco bnep xt_tcpudp ipt_LOG iptable_nat >>> nf_nat xt_state nf_conntrack_ftp nf_conntrack_ipv4 nf_conntrack >>> nf_defrag_ipv4 iptable_filter ip_tables x_tables ath9k firewire_ohci >>> ath9k_common firewire_core ath9k_hw battery ac ohci1394 evdev thermal >>> ath sky2 joydev button snd_hda_codec_idt snd_hda_intel snd_hda_codec >>> snd_hwdep snd_pcm snd_timer i2c_i801 snd soundcore snd_page_alloc >>> video aes_x86_64 lzo lzo_compress tun kvm_intel ipcomp xfrm_ipcomp >>> crypto_null sha256_generic cbc des_generic cast5 blowfish serpent >>> camellia twofish_generic twofish_x86_64 twofish_common ctr ah4 esp4 >>> authenc raw1394 ieee1394 uhci_hcd ehci_hcd hci_uart rfcomm btusb hidp >>> l2cap bluetooth coretemp acpi_cpufreq processor mperf appletouch >>> applesmc >>> <4>[ 1755.556676] >>> <4>[ 1755.556682] Pid: 0, comm: swapper Not tainted 2.6.36-rc3 #3 >>> Mac-F42187C8/MacBookPro2,2 >>> <4>[ 1755.556688] RIP: 0010:[] [] >>> hci_reassembly.part.13.constprop.18+0x23/0x1b5 [bluetooth] >>> <4>[ 1755.556705] RSP: 0018:ffff880001803ca8 EFLAGS: 00010092 >>> <4>[ 1755.556710] RAX: 000000003df64001 RBX: 0000000000000014 RCX: >>> 0000000000000014 >>> <4>[ 1755.556716] RDX: ffff8800372018d8 RSI: 0000000000000002 RDI: >>> ffff8800351ec240 >>> <4>[ 1755.556722] RBP: ffff880001803cf8 R08: ffff88003df64001 R09: >>> ffff88000180f398 >>> <4>[ 1755.556728] R10: dead000000100100 R11: dead000000200200 R12: >>> ffff8800351ec240 >>> <4>[ 1755.556733] R13: 0000000000000002 R14: 000000003df64001 R15: >>> 0000000000000001 >>> <4>[ 1755.556740] FS: 0000000000000000(0000) >>> GS:ffff880001800000(0000) knlGS:0000000000000000 >>> <4>[ 1755.556746] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b >>> <4>[ 1755.556752] CR2: ffff880224d0c548 CR3: 0000000001608000 CR4: >>> 00000000000006f0 >>> <4>[ 1755.556758] DR0: 0000000000000000 DR1: 0000000000000000 DR2: >>> 0000000000000000 >>> <4>[ 1755.556763] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: >>> 0000000000000400 >>> <4>[ 1755.556770] Process swapper (pid: 0, threadinfo >>> ffffffff815f0000, task ffffffff81610020) >>> <0>[ 1755.556774] Stack: >>> <4>[ 1755.556778] ffffea0000b9fdc8 ffff88003df64000 ffff8800372018d8 >>> ffffffffa00a189f >>> <4>[ 1755.556787]<0> ffff880001803d08 0000000000000014 >>> 0000000000000002 ffff8800372018d8 >>> <4>[ 1755.556797]<0> ffff8800351ec240 0000000000000001 >>> ffff880001803d38 ffffffffa0042dc5 >>> <0>[ 1755.556809] Call Trace: >>> <0>[ 1755.556813] >>> <4>[ 1755.556825] [] ? uhci_free_urb_priv+0xa6/0xb3 >>> [uhci_hcd] >>> <4>[ 1755.556839] [] hci_recv_fragment+0x47/0x65 >>> [bluetooth] >>> <4>[ 1755.556851] [] btusb_bulk_complete+0x56/0xd6 >>> [btusb] >>> <4>[ 1755.556862] [] usb_hcd_giveback_urb+0x5d/0x8d >>> <4>[ 1755.556873] [] uhci_giveback_urb+0x11a/0x1a9 >>> [uhci_hcd] >>> <4>[ 1755.556884] [] uhci_scan_schedule+0x544/0x84e >>> [uhci_hcd] >>> <4>[ 1755.556896] [] uhci_irq+0xee/0x104 [uhci_hcd] >>> <4>[ 1755.556903] [] usb_hcd_irq+0x43/0x79 >>> <4>[ 1755.556913] [] handle_IRQ_event+0x6e/0x14b >>> <4>[ 1755.556922] [] handle_fasteoi_irq+0x92/0xd2 >>> <4>[ 1755.556931] [] handle_irq+0x86/0x8c >>> <4>[ 1755.556938] [] do_IRQ+0x57/0xbe >>> <4>[ 1755.556948] [] ret_from_intr+0x0/0x11 >>> <0>[ 1755.556952] >>> <4>[ 1755.556966] [] ? >>> acpi_idle_enter_bm+0x252/0x28a [processor] >>> <4>[ 1755.556979] [] ? >>> acpi_idle_enter_bm+0x24b/0x28a [processor] >>> <4>[ 1755.556988] [] ? menu_select+0x16f/0x296 >>> <4>[ 1755.556996] [] cpuidle_idle_call+0x9f/0x119 >>> <4>[ 1755.557004] [] cpu_idle+0x62/0xc5 >>> <4>[ 1755.557014] [] rest_init+0x68/0x6a >>> <4>[ 1755.557024] [] start_kernel+0x365/0x370 >>> <4>[ 1755.557033] [] >>> x86_64_start_reservations+0xad/0xb1 >>> <4>[ 1755.557042] [] ? early_idt_handler+0x0/0x71 >>> <4>[ 1755.557050] [] x86_64_start_kernel+0xf9/0x108 >>> <0>[ 1755.557055] Code: 41 5c 41 5d 41 5e c9 c3 55 49 63 c0 48 89 e5 >>> 41 57 41 56 45 89 c6 41 55 41 89 f5 41 54 49 89 fc 53 89 cb 48 83 ec >>> 28 48 89 55 c0<48> 8b 94 c7 00 03 00 00 48 85 d2 0f 85 61 01 00 00 41 >>> 8d 45 fe >>> <1>[ 1755.557139] RIP [] >>> hci_reassembly.part.13.constprop.18+0x23/0x1b5 [bluetooth] >>> <4>[ 1755.557154] RSP >>> <0>[ 1755.557158] CR2: ffff880224d0c548 >>> <4>[ 1755.557164] ---[ end trace 6c64514f0ad01ea5 ]--- >>> <0>[ 1755.557169] Kernel panic - not syncing: Fatal exception in >>> interrupt >>> <4>[ 1755.557176] Pid: 0, comm: swapper Tainted: G D 2.6.36-rc3 #3 >>> <4>[ 1755.557180] Call Trace: >>> <4>[ 1755.557183] [] panic+0x8c/0x189 >>> <4>[ 1755.557199] [] oops_end+0x87/0x94 >>> <4>[ 1755.557206] [] no_context+0x1f4/0x203 >>> <4>[ 1755.557216] [] >>> __bad_area_nosemaphore+0x17f/0x1a2 >>> <4>[ 1755.557224] [] bad_area_nosemaphore+0xe/0x10 >>> <4>[ 1755.557233] [] do_page_fault+0x1ee/0x3c2 >>> <4>[ 1755.557243] [] ? check_object+0x151/0x202 >>> <4>[ 1755.557254] [] ? >>> uhci_alloc_td.isra.22+0x16/0x44 [uhci_hcd] >>> <4>[ 1755.557265] [] ? >>> uhci_submit_common.isra.24+0x233/0x2d3 [uhci_hcd] >>> <4>[ 1755.557273] [] page_fault+0x25/0x30 >>> <4>[ 1755.557287] [] ? >>> hci_reassembly.part.13.constprop.18+0x23/0x1b5 [bluetooth] >>> <4>[ 1755.557298] [] ? uhci_free_urb_priv+0xa6/0xb3 >>> [uhci_hcd] >>> <4>[ 1755.557311] [] hci_recv_fragment+0x47/0x65 >>> [bluetooth] >>> <4>[ 1755.557322] [] btusb_bulk_complete+0x56/0xd6 >>> [btusb] >>> <4>[ 1755.557330] [] usb_hcd_giveback_urb+0x5d/0x8d >>> <4>[ 1755.557340] [] uhci_giveback_urb+0x11a/0x1a9 >>> [uhci_hcd] >>> <4>[ 1755.557351] [] uhci_scan_schedule+0x544/0x84e >>> [uhci_hcd] >>> <4>[ 1755.557362] [] uhci_irq+0xee/0x104 [uhci_hcd] >>> <4>[ 1755.557369] [] usb_hcd_irq+0x43/0x79 >>> <4>[ 1755.557377] [] handle_IRQ_event+0x6e/0x14b >>> <4>[ 1755.557386] [] handle_fasteoi_irq+0x92/0xd2 >>> <4>[ 1755.557393] [] handle_irq+0x86/0x8c >>> <4>[ 1755.557401] [] do_IRQ+0x57/0xbe >>> <4>[ 1755.557408] [] ret_from_intr+0x0/0x11 >>> <4>[ 1755.557413] [] ? >>> acpi_idle_enter_bm+0x252/0x28a [processor] >>> <4>[ 1755.557420] [] ? >>> acpi_idle_enter_bm+0x24b/0x28a [processor] >>> <4>[ 1755.557420] [] ? menu_select+0x16f/0x296 >>> <4>[ 1755.557420] [] cpuidle_idle_call+0x9f/0x119> >>> <4>[ 1755.557420] [] cpu_idle+0x62/0xc5> <4>[ >>> 1755.557420] [] rest_init+0x68/0x6a> <4>[ >>> 1755.557420] [] start_kernel+0x365/0x370 >>> <4>[ 1755.557420] [] >>> x86_64_start_reservations+0xad/0xb1 >>> <4>[ 1755.557420] [] ? early_idt_handler+0x0/0x71 >>> <4>[ 1755.557420] [] x86_64_start_kernel+0xf9/0x108 >> >> Suraj, do you have any idea on that? >> > > can you verify the return status of hci_reassembly()? I guess there > could be some mismatch in the packet received. > > Regards > Suraj > > Ill have to look into to that and see. Justin P. Mattock