[OOPS] Removing USB Bluetooth dongle Oopses 2.6.4

[OOPS] Removing USB Bluetooth dongle Oopses 2.6.4

[Silla Rizzoli]

[-- Attachment #1: Type: text/plain, Size: 3804 bytes --]

Hello lkml!

Here comes the oops:

PREEMPT
CPU:	0
EIP:	0060:[<e1921149>]	Not tainted
EIP is at urb_unlink+0x31/0x8e [usbcore]
eax: c17c069c	ebx: 00000000	ecx: 00000000	edx: dec74000
esi: 00000246	edi: c17c0694	ebp: de5aa1f0	esp: dec75e14
ds: 007b   es: 007b   ss: 0068
Process hotplug (pid: 6150, threadinfo=dec74000 task=dfa6a100)
Stack: c17c0694 de5aa000 dec75edc c17c0694 dec75edc de5aa000 e19218af c17c0694
       c17c0694 dec74000 c17c0694 e19f5db4 de5aa000 c17c0694 dec75edc dec75edc
       de5aa1d0 de5aa1d0 de5aa000 dec75edc e19f5f72 de5aa000 dec75edc 00701300
Call trace:
 [<e19218af>] usb_hcd_giveback_urb+0x1b/0x39 [usbcore]
 [<e19f5db4>] uhci_finish_completion+0x61/0x9c [uhci_hcd]
 [<e19f5f72>] uhci_irq+0x103/0x165 [uhci_hcd]
 [<e1921903>] usb_hcd_irq+0x36/0x67 [usbcore]
 [<c010ae8a>] handle_IRQ_event+0x3a/0x64
 [<c010b1f7>] do_IRQ+0x94/0x136
 [<c0116eea>] do_page_fault+0x0/0x50c
 [<c0109750>] common_interrupt+0x18/0x20
 [<c0116eea>] do_page_fault+0x0/0x50c
 [<c0116f11>] do_page_fault+0x27/0x50c
 [<c0141c0b>] unmap_vmas+0xdc/0x212
 [<c01451b7>] unmap_vma+0x40/0x7d
 [<c0145210>] unmap_vma_list+0x1c/0x28
 [<c0145625>] do_munmap+0x146/0x183
 [<c0116eea>] do_page_fault+0x0/0x50c
 [<c010980d>] error_code+0x2d/0x38

Code: 89 59 04 89 0b 89 40 04 89 47 08 8b 5f 14 56 9d 8b 42 08 83
 <0>Kernel panic: Fatal exception in interrupt
In interrupt handler - not syncing


Here is the modules list:

Module                  Size  Used by
rfcomm                 33820  0 
l2cap                  21124  3 rfcomm
hci_usb                 9728  1 
bluetooth              43108  3 rfcomm,l2cap,hci_usb
ide_cd                 37636  0 
cdrom                  35872  1 ide_cd
ds                     11524  2 
hid                    23040  0 
intel_agp              15772  1 
agpgart                25896  1 intel_agp
uhci_hcd               29200  0 
ehci_hcd               23428  0 
snd_intel8x0           28804  0 
snd_ac97_codec         58756  1 snd_intel8x0
snd_mpu401_uart         6272  1 snd_intel8x0
snd_rawmidi            20128  1 snd_mpu401_uart
snd_seq_oss            31488  0 
snd_seq_midi_event      6272  1 snd_seq_oss
snd_seq                50192  4 snd_seq_oss,snd_seq_midi_event
snd_seq_device          6536  3 snd_rawmidi,snd_seq_oss,snd_seq
snd_pcm_oss            48164  0 
snd_pcm                84900  2 snd_intel8x0,snd_pcm_oss
snd_page_alloc          9348  2 snd_intel8x0,snd_pcm
snd_timer              21380  2 snd_seq,snd_pcm
snd_mixer_oss          17280  1 snd_pcm_oss
snd                    45796  12 
snd_intel8x0,snd_ac97_codec,snd_mpu401_uart,snd_rawmidi,snd_seq_oss,snd_seq_midi_event,snd_seq,snd_seq_device,snd_pcm_oss,snd_pcm,snd_timer,snd_mixer_oss
soundcore               7392  1 snd
rtc                    10552  0 
usbcore                89820  6 hci_usb,hid,uhci_hcd,ehci_hcd
md5                     3712  1 
ipv6                  228160  11 
fan                     4236  0 
button                  6296  0 
thermal                16400  0 
processor              24496  1 thermal
battery                10636  0 
ac                      5004  0 
e100                   29056  0 
yenta_socket           14336  0 
pcmcia_core            59872  2 ds,yenta_socket
unix                   23472  12 


You'll find the kernel config attached:

Steps to reproduce the problem:

1) Insert the usb bt dongle
2) Start the bluetooth services (rfcomm, hcid...)
3) Stop the bluetooth services
4) Extrach the dongle - Doing rmmod uhci_hcd also causes the same oops.

Notice that SCO BT support is NOT compiled into the kernel, so this is a 
different oops than similar ones reported before.
After step 3 it is possible to remove rfcomm and l2cap, but hci_usb and 
bluetooth seem to lock one another, making it impossible to remove them from 
the running kernel.

Regards,
Silla

[-- Attachment #2: 2.6.4.cfg.bz2 --]
[-- Type: application/x-bzip2, Size: 8329 bytes --]

Re: [OOPS] Removing USB Bluetooth dongle Oopses 2.6.4

[Marcel Holtmann]

Hi Silla,

> Here comes the oops:
> 
> PREEMPT
> CPU:	0
> EIP:	0060:[<e1921149>]	Not tainted
> EIP is at urb_unlink+0x31/0x8e [usbcore]
> eax: c17c069c	ebx: 00000000	ecx: 00000000	edx: dec74000
> esi: 00000246	edi: c17c0694	ebp: de5aa1f0	esp: dec75e14
> ds: 007b   es: 007b   ss: 0068
> Process hotplug (pid: 6150, threadinfo=dec74000 task=dfa6a100)
> Stack: c17c0694 de5aa000 dec75edc c17c0694 dec75edc de5aa000 e19218af c17c0694
>        c17c0694 dec74000 c17c0694 e19f5db4 de5aa000 c17c0694 dec75edc dec75edc
>        de5aa1d0 de5aa1d0 de5aa000 dec75edc e19f5f72 de5aa000 dec75edc 00701300
> Call trace:
>  [<e19218af>] usb_hcd_giveback_urb+0x1b/0x39 [usbcore]
>  [<e19f5db4>] uhci_finish_completion+0x61/0x9c [uhci_hcd]
>  [<e19f5f72>] uhci_irq+0x103/0x165 [uhci_hcd]
>  [<e1921903>] usb_hcd_irq+0x36/0x67 [usbcore]
>  [<c010ae8a>] handle_IRQ_event+0x3a/0x64
>  [<c010b1f7>] do_IRQ+0x94/0x136
>  [<c0116eea>] do_page_fault+0x0/0x50c
>  [<c0109750>] common_interrupt+0x18/0x20
>  [<c0116eea>] do_page_fault+0x0/0x50c
>  [<c0116f11>] do_page_fault+0x27/0x50c
>  [<c0141c0b>] unmap_vmas+0xdc/0x212
>  [<c01451b7>] unmap_vma+0x40/0x7d
>  [<c0145210>] unmap_vma_list+0x1c/0x28
>  [<c0145625>] do_munmap+0x146/0x183
>  [<c0116eea>] do_page_fault+0x0/0x50c
>  [<c010980d>] error_code+0x2d/0x38
> 
> Code: 89 59 04 89 0b 89 40 04 89 47 08 8b 5f 14 56 9d 8b 42 08 83
>  <0>Kernel panic: Fatal exception in interrupt
> In interrupt handler - not syncing

this looks like another unlink-during-submit bug in the uhci-hcd host
driver. With the latest 2.6.4-bk2 the ohci-hcd is now free from it and
an unplug works again without any oops or freezes. Post your oops to the
USB developer mailing list.

Regards

Marcel

Re: [OOPS] Removing USB Bluetooth dongle Oopses 2.6.4

[Silla Rizzoli]

> this looks like another unlink-during-submit bug in the uhci-hcd host
> driver. With the latest 2.6.4-bk2 the ohci-hcd is now free from it and
> an unplug works again without any oops or freezes. Post your oops to the
> USB developer mailing list.
>
> Regards
>
> Marcel

I've just tried 2.6.4-bk3 but the oops is still there; I'll forward it to the 
usb mailing list.

Regards, Silla