Re: oops with USB Storage on 2.6.14

Re: oops with USB Storage on 2.6.14

[Andrew Morton]

Masanari Iida <standby24x7@gmail.com> wrote:
>
> Hello,
> I updated my system's kernel from 2.6.13.2 to 2.6.14,
> then it oops when I connect my Digital Camera via USB connection
> as USB storage device.
> I went back to 2.6.14-rc1, still the same panic happen.
> 2.6.13.2 and before, the kernel has been worked as expected.
> 
> CPU Intel P4(2.4Ghz)
> USB Device   Pentax Optio S40.
> 
> Unable to handle kernel paging request at virtual address dc9d1f4c
>  printing eip:
> c02b44cc
> *pde = 00073067
> *pte = 1c9d1000
> Oops: 0000 [#1]
> SMP DEBUG_PAGEALLOC
> Modules linked in: autofs e100 ipt_LOG ipt_state ip_conntrack
> ipt_recent iptable
> _filter ip_tables video rtc
> CPU:    1
> EIP:    0060:[<c02b44cc>]    Not tainted VLI
> EFLAGS: 00010286   (2.6.14)
> EIP is at scsi_run_queue+0xc/0xd0
> eax: 00000001   ebx: dc9d1e3c   ecx: d6b67910   edx: dc9d1e3c
> esi: d5048eb0   edi: dc9d1e3c   ebp: c1507e98   esp: c1507e84
> ds: 007b   es: 007b   ss: 0068
> Process ksoftirqd/1 (pid: 6, threadinfo=c1506000 task=dfe2dad0)
> Stack: 00000292 de3a7bf8 dc9d1e3c d5048eb0 dc9d1e3c c1507ea8 c02b4612 dc9d1e3c
>        da51bf60 c1507ecc c02b473f d5048eb0 00000000 00000024 00000286 00000001
>        d5048eb0 00000000 c1507f10 c02b4b2e d5048eb0 00000000 00000024 00000001
> 
> Call Trace:
>  [<c0103abf>] show_stack+0x7f/0xa0
>  [<c0103c72>] show_registers+0x162/0x1d0
>  [<c0103e90>] die+0x100/0x1a0
>  [<c039d7ae>] do_page_fault+0x31e/0x640
>  [<c0103763>] error_code+0x4f/0x54
>  [<c02b4612>] scsi_next_command+0x22/0x30
>  [<c02b473f>] scsi_end_request+0xcf/0xf0
>  [<c02b4b2e>] scsi_io_completion+0x26e/0x470
>  [<c02b4fc7>] scsi_generic_done+0x37/0x50
>  [<c02af9e5>] scsi_finish_command+0x85/0xa0
>  [<c02af89c>] scsi_softirq+0xcc/0x140
>  [<c0122085>] __do_softirq+0xd5/0xf0
>  [<c01220d8>] do_softirq+0x38/0x40
>  [<c0122685>] ksoftirqd+0x95/0xe0
>  [<c0131cfa>] kthread+0xba/0xc0
>  [<c0100ecd>] kernel_thread_helper+0x5/0x18
> Code: f0 8b 42 44 e8 16 7f 0e 00 89 45 ec 89 1c 24 e8 6b b7 ff ff eb aa 89 f6 8d
>  bc 27 00 00 00 00 55 89 e5 57 56 53 83 ec 08 8b 55 08 <8b> 82 10 01 00 00 8b 38
>  f6 80 85 01 00 00 80 0f 85 9e 00 00 00
>   <0>Kernel panic - not syncing: Fatal exception in interrupt
> 

Either a scsi bug or a USB bug.  Either way, regressions like this are a
top priority.

Could you please try disabling CONFIG_DEBUG_PAGEALLOC and retest?  If that
works OK, it's probably a use-after-free.

Thanks. 

Re: oops with USB Storage on 2.6.14

[Andrew Morton]

Masanari Iida <standby24x7@gmail.com> wrote:
>

You removed linux-scis and linux-usb from cc.  Please retain them.

> >
> > Could you please try disabling CONFIG_DEBUG_PAGEALLOC and retest?  If that
> > works OK, it's probably a use-after-free.
> >
> Hello Andrew,
> 
> I did disabled CONFIG_DEBUG_PAGEALLOC and re-tested on 2.6.14-rc1.
> Now the oops didn't happen when I connect digital camera to the USB.

So the first oops was probably use-after-free.

> I could mount the camera as USB storage.
> But oops still happen when I turned the camera power off.
> (This oops didn't halt my system, BTW)
> 
> # Unable to handle kernel paging request at virtual address 6b6b6bb3
>   printing eip:
> c02b88ca
> *pde = 00000000
> Oops: 0002 [#1]
> SMP
> Modules linked in: autofs e100 ipt_LOG ipt_state ip_conntrack
> ipt_recent iptable_filter ip_tables video rtc
> CPU:    0
> EIP:    0060:[<c02b88ca>]    Not tainted VLI
> EFLAGS: 00010296   (2.6.14-rc1)
> EIP is at scsi_remove_device+0x3a/0x50
> eax: 00000001   ebx: dee9f478   ecx: 00000000   edx: 6b6b6b6b
> esi: de6655c4   edi: de6655bc   ebp: dfd4fdb4   esp: dfd4fda4
> ds: 007b   es: 007b   ss: 0068
> Process khubd (pid: 15, threadinfo=dfd4e000 task=dff1f030)
> Stack: dee9f478 00000066 dee9f478 de6655c4 dfd4fdcc c02b89a1 dee9f478 de6655c8
>        de213c98 de6655c4 dfd4fde8 c02b8a16 de213c84 dfd4fde8 00000282 de6655c8
>        de6655c8 dfd4fe04 c02b7655 de213c98 de6655cc de6655c4 de6656e0 de213a8c
> Call Trace:
>  [<c0103aaf>] show_stack+0x7f/0xa0
>  [<c0103c62>] show_registers+0x162/0x1d0
>  [<c0103e74>] die+0xf4/0x1a0
>  [<c039cfce>] do_page_fault+0x31e/0x640
>  [<c0103753>] error_code+0x4f/0x54
>  [<c02b89a1>] __scsi_remove_target+0xc1/0xe0
>  [<c02b8a16>] scsi_remove_target+0x26/0x60
>  [<c02b7655>] scsi_forget_host+0x45/0x70
>  [<c02afd97>] scsi_remove_host+0x57/0xa0
>  [<c02e5145>] quiesce_and_remove_host+0x75/0xb0
>  [<c02e55fd>] storage_disconnect+0x1d/0x2c
>  [<c02c8286>] usb_unbind_interface+0x86/0x90
>  [<c025617b>] __device_release_driver+0x8b/0x90
>  [<c02561b6>] device_release_driver+0x36/0x50
>  [<c02557c9>] bus_remove_device+0x79/0x90
>  [<c0254525>] device_del+0x35/0x70
>  [<c02d00fb>] usb_disable_device+0xfb/0x130
>  [<c02caa46>] usb_disconnect+0xc6/0x180
>  [<c02cbe2f>] hub_port_connect_change+0x3cf/0x400
>  [<c02cc12e>] hub_events+0x2ce/0x410
>  [<c02cc285>] hub_thread+0x15/0xf0
>   [<c0131aaa>] kthread+0xba/0xc0
>  [<c0100ecd>] kernel_thread_helper+0x5/0x18
> Code: 5d 08 89 75 fc 8b 33 89 44 24 04 c7 04 24 e8 a8 3b c0 e8 9a 14
> e6 ff f0 ff 4e 48 0f 88 a8 04 00 00 89 1c
>   24 e8 38 ff ff ff 8b 13 <f0> ff 42 48 0f 8e a1 04 00 00 8b 5d f8 8b
> 75 fc 89 ec 5d c3 89
> 
> If you need some more test, let me know.
> In that case, please specify which version of kernel you want me to test.
> 

OK, thanks.  This is a different bug.  Presumably in USB.

Re: [linux-usb-devel] Re: oops with USB Storage on 2.6.14

[Alan Stern]

On Sun, 30 Oct 2005, Andrew Morton wrote:

> Masanari Iida <standby24x7@gmail.com> wrote:

> > Hello Andrew,
> > 
> > I did disabled CONFIG_DEBUG_PAGEALLOC and re-tested on 2.6.14-rc1.
> > Now the oops didn't happen when I connect digital camera to the USB.
> 
> So the first oops was probably use-after-free.
> 
> > I could mount the camera as USB storage.
> > But oops still happen when I turned the camera power off.
> > (This oops didn't halt my system, BTW)
> > 
> > # Unable to handle kernel paging request at virtual address 6b6b6bb3
> >   printing eip:
> > c02b88ca
> > *pde = 00000000
> > Oops: 0002 [#1]
> > SMP
> > Modules linked in: autofs e100 ipt_LOG ipt_state ip_conntrack
> > ipt_recent iptable_filter ip_tables video rtc
> > CPU:    0
> > EIP:    0060:[<c02b88ca>]    Not tainted VLI
> > EFLAGS: 00010296   (2.6.14-rc1)
> > EIP is at scsi_remove_device+0x3a/0x50

> > If you need some more test, let me know.
> > In that case, please specify which version of kernel you want me to test.
> > 
> 
> OK, thanks.  This is a different bug.  Presumably in USB.

This was fixed in later releases of 2.6.14-rc.

I wasn't able to reproduce the original problem, even after setting 
CONFIG_DEBUG_PAGEALLOC.

Alan Stern

Re: [linux-usb-devel] Re: oops with USB Storage on 2.6.14

[Masanari Iida]

On 11/1/05, Alan Stern <stern@rowland.harvard.edu> wrote:
> On Sun, 30 Oct 2005, Andrew Morton wrote:
>
> > Masanari Iida <standby24x7@gmail.com> wrote:
>
> > > Hello Andrew,
> > >
> > > I did disabled CONFIG_DEBUG_PAGEALLOC and re-tested on 2.6.14-rc1.
> > > Now the oops didn't happen when I connect digital camera to the USB.
> >
> > So the first oops was probably use-after-free.
> >
> > > I could mount the camera as USB storage.
> > > But oops still happen when I turned the camera power off.
> > > (This oops didn't halt my system, BTW)
> > >
> > > # Unable to handle kernel paging request at virtual address 6b6b6bb3
> > >   printing eip:
> > > c02b88ca
> > > *pde = 00000000
> > > Oops: 0002 [#1]
> > > SMP
> > > Modules linked in: autofs e100 ipt_LOG ipt_state ip_conntrack
> > > ipt_recent iptable_filter ip_tables video rtc
> > > CPU:    0
> > > EIP:    0060:[<c02b88ca>]    Not tainted VLI
> > > EFLAGS: 00010296   (2.6.14-rc1)
> > > EIP is at scsi_remove_device+0x3a/0x50
>
> > > If you need some more test, let me know.
> > > In that case, please specify which version of kernel you want me to test.
> > >
> >
> > OK, thanks.  This is a different bug.  Presumably in USB.
>
> This was fixed in later releases of 2.6.14-rc.
>
> I wasn't able to reproduce the original problem, even after setting
> CONFIG_DEBUG_PAGEALLOC.
>
> Alan Stern
>
Alan,

Confirm the " scsi_remove_device " oops didn't happen on 2.4.14.
Talking about the original PANIC, as I have a workaround
(CONFIG_DEBUG_PAGEALLOC disabled),  I agree to close my report, now.

Thank you.

Masanari Iida

Re: [linux-usb-devel] Re: oops with USB Storage on 2.6.14

[Andrew Morton]

Masanari Iida <standby24x7@gmail.com> wrote:
>
> On 11/1/05, Alan Stern <stern@rowland.harvard.edu> wrote:
> > On Sun, 30 Oct 2005, Andrew Morton wrote:
> >
> > > Masanari Iida <standby24x7@gmail.com> wrote:
> >
> > > > Hello Andrew,
> > > >
> > > > I did disabled CONFIG_DEBUG_PAGEALLOC and re-tested on 2.6.14-rc1.
> > > > Now the oops didn't happen when I connect digital camera to the USB.
> > >
> > > So the first oops was probably use-after-free.
> > >
> > > > I could mount the camera as USB storage.
> > > > But oops still happen when I turned the camera power off.
> > > > (This oops didn't halt my system, BTW)
> > > >
> > > > # Unable to handle kernel paging request at virtual address 6b6b6bb3
> > > >   printing eip:
> > > > c02b88ca
> > > > *pde = 00000000
> > > > Oops: 0002 [#1]
> > > > SMP
> > > > Modules linked in: autofs e100 ipt_LOG ipt_state ip_conntrack
> > > > ipt_recent iptable_filter ip_tables video rtc
> > > > CPU:    0
> > > > EIP:    0060:[<c02b88ca>]    Not tainted VLI
> > > > EFLAGS: 00010296   (2.6.14-rc1)
> > > > EIP is at scsi_remove_device+0x3a/0x50
> >
> > > > If you need some more test, let me know.
> > > > In that case, please specify which version of kernel you want me to test.
> > > >
> > >
> > > OK, thanks.  This is a different bug.  Presumably in USB.
> >
> > This was fixed in later releases of 2.6.14-rc.
> >
> > I wasn't able to reproduce the original problem, even after setting
> > CONFIG_DEBUG_PAGEALLOC.
> >
> > Alan Stern
> >
> Alan,
> 
> Confirm the " scsi_remove_device " oops didn't happen on 2.4.14.

2.6.14, I assume.

> Talking about the original PANIC, as I have a workaround
> (CONFIG_DEBUG_PAGEALLOC disabled),  I agree to close my report, now.

That's not a valid workaround.  We're touching freed, unallocated or simply
wild memory and that is a bad bug.

Re: oops with USB Storage on 2.6.14

[Andrew Morton]

Masanari Iida <standby24x7@gmail.com> wrote:
>
> Hello,
> I updated my system's kernel from 2.6.13.2 to 2.6.14,
> then it oops when I connect my Digital Camera via USB connection
> as USB storage device.
> I went back to 2.6.14-rc1, still the same panic happen.
> 2.6.13.2 and before, the kernel has been worked as expected.
> 
> CPU Intel P4(2.4Ghz)
> USB Device   Pentax Optio S40.
> 
> Unable to handle kernel paging request at virtual address dc9d1f4c
>  printing eip:
> c02b44cc
> *pde = 00073067
> *pte = 1c9d1000
> Oops: 0000 [#1]
> SMP DEBUG_PAGEALLOC
> Modules linked in: autofs e100 ipt_LOG ipt_state ip_conntrack
> ipt_recent iptable
> _filter ip_tables video rtc
> CPU:    1
> EIP:    0060:[<c02b44cc>]    Not tainted VLI
> EFLAGS: 00010286   (2.6.14)
> EIP is at scsi_run_queue+0xc/0xd0
> eax: 00000001   ebx: dc9d1e3c   ecx: d6b67910   edx: dc9d1e3c
> esi: d5048eb0   edi: dc9d1e3c   ebp: c1507e98   esp: c1507e84
> ds: 007b   es: 007b   ss: 0068
> Process ksoftirqd/1 (pid: 6, threadinfo=c1506000 task=dfe2dad0)
> Stack: 00000292 de3a7bf8 dc9d1e3c d5048eb0 dc9d1e3c c1507ea8 c02b4612 dc9d1e3c
>        da51bf60 c1507ecc c02b473f d5048eb0 00000000 00000024 00000286 00000001
>        d5048eb0 00000000 c1507f10 c02b4b2e d5048eb0 00000000 00000024 00000001
> 
> Call Trace:
>  [<c0103abf>] show_stack+0x7f/0xa0
>  [<c0103c72>] show_registers+0x162/0x1d0
>  [<c0103e90>] die+0x100/0x1a0
>  [<c039d7ae>] do_page_fault+0x31e/0x640
>  [<c0103763>] error_code+0x4f/0x54
>  [<c02b4612>] scsi_next_command+0x22/0x30
>  [<c02b473f>] scsi_end_request+0xcf/0xf0
>  [<c02b4b2e>] scsi_io_completion+0x26e/0x470
>  [<c02b4fc7>] scsi_generic_done+0x37/0x50
>  [<c02af9e5>] scsi_finish_command+0x85/0xa0
>  [<c02af89c>] scsi_softirq+0xcc/0x140
>  [<c0122085>] __do_softirq+0xd5/0xf0
>  [<c01220d8>] do_softirq+0x38/0x40
>  [<c0122685>] ksoftirqd+0x95/0xe0
>  [<c0131cfa>] kthread+0xba/0xc0
>  [<c0100ecd>] kernel_thread_helper+0x5/0x18
> Code: f0 8b 42 44 e8 16 7f 0e 00 89 45 ec 89 1c 24 e8 6b b7 ff ff eb aa 89 f6 8d
>  bc 27 00 00 00 00 55 89 e5 57 56 53 83 ec 08 8b 55 08 <8b> 82 10 01 00 00 8b 38
>  f6 80 85 01 00 00 80 0f 85 9e 00 00 00
>   <0>Kernel panic - not syncing: Fatal exception in interrupt
> 

Has there been any progress on this?

If not, can you please test the latest snapshot from
ftp://ftp.kernel.org/pub/linux/kernel/v2.6/snapshots and if it still fails, raise a bug at bugzilla.kernel.org?

Thanks.

Re: oops with USB Storage on 2.6.14

[Masanari Iida]

On 11/8/05, Andrew Morton <akpm@osdl.org> wrote:
> Masanari Iida <standby24x7@gmail.com> wrote:
> >
> > Hello,
> > I updated my system's kernel from 2.6.13.2 to 2.6.14,
> > then it oops when I connect my Digital Camera via USB connection
> > as USB storage device.
> > I went back to 2.6.14-rc1, still the same panic happen.
> > 2.6.13.2 and before, the kernel has been worked as expected.
> >
> > CPU Intel P4(2.4Ghz)
> > USB Device   Pentax Optio S40.
> >
> > Unable to handle kernel paging request at virtual address dc9d1f4c
> >  printing eip:
> > c02b44cc
> > *pde = 00073067
> > *pte = 1c9d1000
> > Oops: 0000 [#1]
> > SMP DEBUG_PAGEALLOC
> > Modules linked in: autofs e100 ipt_LOG ipt_state ip_conntrack
> > ipt_recent iptable
> > _filter ip_tables video rtc
> > CPU:    1
> > EIP:    0060:[<c02b44cc>]    Not tainted VLI
> > EFLAGS: 00010286   (2.6.14)
> > EIP is at scsi_run_queue+0xc/0xd0
> > eax: 00000001   ebx: dc9d1e3c   ecx: d6b67910   edx: dc9d1e3c
> > esi: d5048eb0   edi: dc9d1e3c   ebp: c1507e98   esp: c1507e84
> > ds: 007b   es: 007b   ss: 0068
> > Process ksoftirqd/1 (pid: 6, threadinfo=c1506000 task=dfe2dad0)
> > Stack: 00000292 de3a7bf8 dc9d1e3c d5048eb0 dc9d1e3c c1507ea8 c02b4612 dc9d1e3c
> >        da51bf60 c1507ecc c02b473f d5048eb0 00000000 00000024 00000286 00000001
> >        d5048eb0 00000000 c1507f10 c02b4b2e d5048eb0 00000000 00000024 00000001
> >
> > Call Trace:
> >  [<c0103abf>] show_stack+0x7f/0xa0
> >  [<c0103c72>] show_registers+0x162/0x1d0
> >  [<c0103e90>] die+0x100/0x1a0
> >  [<c039d7ae>] do_page_fault+0x31e/0x640
> >  [<c0103763>] error_code+0x4f/0x54
> >  [<c02b4612>] scsi_next_command+0x22/0x30
> >  [<c02b473f>] scsi_end_request+0xcf/0xf0
> >  [<c02b4b2e>] scsi_io_completion+0x26e/0x470
> >  [<c02b4fc7>] scsi_generic_done+0x37/0x50
> >  [<c02af9e5>] scsi_finish_command+0x85/0xa0
> >  [<c02af89c>] scsi_softirq+0xcc/0x140
> >  [<c0122085>] __do_softirq+0xd5/0xf0
> >  [<c01220d8>] do_softirq+0x38/0x40
> >  [<c0122685>] ksoftirqd+0x95/0xe0
> >  [<c0131cfa>] kthread+0xba/0xc0
> >  [<c0100ecd>] kernel_thread_helper+0x5/0x18
> > Code: f0 8b 42 44 e8 16 7f 0e 00 89 45 ec 89 1c 24 e8 6b b7 ff ff eb aa 89 f6 8d
> >  bc 27 00 00 00 00 55 89 e5 57 56 53 83 ec 08 8b 55 08 <8b> 82 10 01 00 00 8b 38
> >  f6 80 85 01 00 00 80 0f 85 9e 00 00 00
> >   <0>Kernel panic - not syncing: Fatal exception in interrupt
> >
>
> Has there been any progress on this?
>
> If not, can you please test the latest snapshot from
> ftp://ftp.kernel.org/pub/linux/kernel/v2.6/snapshots and if it still fails, raise a bug at bugzilla.kernel.org?
>
> Thanks.
>

Hello again, Andrew,

I have tested on 2.6.14-git10 with CONFIG_DEBUG_PAGEALLOC=y.
The original oops with USB Storage (Camera)  is fixed now.
Thank you.

Masanari