double fault in 2.6.19rc4-git5 while unplugging/replugging a USB headset

double fault in 2.6.19rc4-git5 while unplugging/replugging a USB headset

[Andi Kleen]

FYI

usb 5-2: USB disconnect, address 2
ALSA /home/lsrc/quilt/linux/sound/usb/usbaudio.c:845: cannot submit datapipe for urb 0, error -19: no device
[... repeated a lot ...]
ACPI: PCI interrupt for device 0000:00:1b.0 disabled
usb 5-2: new full speed USB device using uhci_hcd and address 3
usb 5-2: configuration #1 chosen from 1 choice
input: C-Media USB Headphone Set   as /class/input/input3
input: USB HID v1.00 Device [C-Media USB Headphone Set  ] on usb-0000:00:1d.3-2
usb 5-2: USB disconnect, address 3
Unable to handle kernel paging request at ffffffff880e57d4 RIP: 
 [<ffffffff880e57d4>]
PGD 203027 PUD 205027 PMD 7f41e067 PTE 0
Oops: 0010 [1] SMP 
CPU 0 
Modules linked in: snd_pcm_oss snd_mixer_oss snd_seq snd_atiixp snd_ac97_codec snd_ac97_bus speedstep_centrino pppoe pppox ppp_generic slhc ipt_MASQUERADE iptable_nat ip_nat_h323 ip_conntrack_h323 ip_nat_sip ip_conntrack_sip ip_nat_ftp ip_nat_irc i2c_isa ip_nat ip6t_LOG ip6t_REJECT ip6table_filter ip6_tables xt_tcpudp xt_state ip_conntrack_ftp ip_conntrack_irc ip_conntrack ipt_LOG ipt_REJECT iptable_filter ip_tables x_tables pl2303 snd_usb_audio snd_pcm snd_timer snd_page_alloc snd_usb_lib snd_rawmidi snd_seq_device snd_hwdep snd usbserial i2c_i801 i2c_core
Pid: 8104, comm: xmms Not tainted 2.6.19-rc4-git5-BASIL #99
RIP: 0010:[<ffffffff880e57d4>]  [<ffffffff880e57d4>]
RSP: 0018:ffff81004730fd50  EFLAGS: 00010286
RAX: ffffffff880e57d4 RBX: ffff810075368000 RCX: 0000000000000000
RDX: 000000000000001d RSI: 0000000000000002 RDI: ffff810075368230
RBP: ffff810075368230 R08: ffff81007a5711f0 R09: ffff81005e5345c0
R10: 00000000454e8c24 R11: ffff81007bd030b8 R12: 00000000000001f8
R13: ffff810057422460 R14: ffff810045b7a5c0 R15: ffff81007a4b9080
FS:  0000000000000000(0000) GS:ffffffff80662000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: ffffffff880e57d4 CR3: 0000000000201000 CR4: 00000000000006e0
Process xmms (pid: 8104, threadinfo ffff81004730e000, task ffff810076fee180)
Stack:  ffffffff880a2cd6 0000000000000000 0000000000000001 ffff81007604bcf0
 ffffffff8024c42b 0000000000000000 ffffffff8058b290 0000001f45880508
 ffff810001f3fe50 0000000300000000 ffff81007a5711e8 0000000000000000
Call Trace:
 [<ffffffff880a2cd6>] :snd_mixer_oss:snd_mixer_oss_notify_handler+0x23e/0x271
 [<ffffffff8024c42b>] free_pages_bulk+0x2c/0x1f4
 [<ffffffff802229d2>] __wake_up+0x36/0x4d
 [<ffffffff880166d7>] :snd:snd_card_do_free+0x17/0xe4
 [<ffffffff88016e3d>] :snd:snd_card_file_remove+0xfd/0x135
 [<ffffffff88041fc7>] :snd_pcm:snd_pcm_release+0xb6/0xc1
 [<ffffffff8026745a>] __fput+0xac/0x18a
 [<ffffffff802653d4>] filp_close+0x5c/0x64
 [<ffffffff8022a913>] put_files_struct+0x6b/0xbd
 [<ffffffff8022ba84>] do_exit+0x233/0x814
 [<ffffffff8022c0eb>] sys_exit_group+0x0/0xe
 [<ffffffff802093fe>] system_call+0x7e/0x83


Code:  Bad RIP value.
RIP  [<ffffffff880e57d4>]
 RSP <ffff81004730fd50>
CR2: ffffffff880e57d4
 <1>Fixing recursive fault but reboot is needed!

-Andi

Re: [Alsa-devel] double fault in 2.6.19rc4-git5 while unplugging/replugging a USB headset

[Takashi Iwai]

At Mon, 6 Nov 2006 02:20:06 +0100,
Andi Kleen wrote:
> 
> 
> FYI
> 
> usb 5-2: USB disconnect, address 2
> ALSA /home/lsrc/quilt/linux/sound/usb/usbaudio.c:845: cannot submit datapipe for urb 0, error -19: no device
> [... repeated a lot ...]
> ACPI: PCI interrupt for device 0000:00:1b.0 disabled
> usb 5-2: new full speed USB device using uhci_hcd and address 3
> usb 5-2: configuration #1 chosen from 1 choice
> input: C-Media USB Headphone Set   as /class/input/input3
> input: USB HID v1.00 Device [C-Media USB Headphone Set  ] on usb-0000:00:1d.3-2
> usb 5-2: USB disconnect, address 3
> Unable to handle kernel paging request at ffffffff880e57d4 RIP: 
>  [<ffffffff880e57d4>]
> PGD 203027 PUD 205027 PMD 7f41e067 PTE 0
> Oops: 0010 [1] SMP 
> CPU 0 
> Modules linked in: snd_pcm_oss snd_mixer_oss snd_seq snd_atiixp snd_ac97_codec snd_ac97_bus speedstep_centrino pppoe pppox ppp_generic slhc ipt_MASQUERADE iptable_nat ip_nat_h323 ip_conntrack_h323 ip_nat_sip ip_conntrack_sip ip_nat_ftp ip_nat_irc i2c_isa ip_nat ip6t_LOG ip6t_REJECT ip6table_filter ip6_tables xt_tcpudp xt_state ip_conntrack_ftp ip_conntrack_irc ip_conntrack ipt_LOG ipt_REJECT iptable_filter ip_tables x_tables pl2303 snd_usb_audio snd_pcm snd_timer snd_page_alloc snd_usb_lib snd_rawmidi snd_seq_device snd_hwdep snd usbserial i2c_i801 i2c_core
> Pid: 8104, comm: xmms Not tainted 2.6.19-rc4-git5-BASIL #99
> RIP: 0010:[<ffffffff880e57d4>]  [<ffffffff880e57d4>]
> RSP: 0018:ffff81004730fd50  EFLAGS: 00010286
> RAX: ffffffff880e57d4 RBX: ffff810075368000 RCX: 0000000000000000
> RDX: 000000000000001d RSI: 0000000000000002 RDI: ffff810075368230
> RBP: ffff810075368230 R08: ffff81007a5711f0 R09: ffff81005e5345c0
> R10: 00000000454e8c24 R11: ffff81007bd030b8 R12: 00000000000001f8
> R13: ffff810057422460 R14: ffff810045b7a5c0 R15: ffff81007a4b9080
> FS:  0000000000000000(0000) GS:ffffffff80662000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> CR2: ffffffff880e57d4 CR3: 0000000000201000 CR4: 00000000000006e0
> Process xmms (pid: 8104, threadinfo ffff81004730e000, task ffff810076fee180)
> Stack:  ffffffff880a2cd6 0000000000000000 0000000000000001 ffff81007604bcf0
>  ffffffff8024c42b 0000000000000000 ffffffff8058b290 0000001f45880508
>  ffff810001f3fe50 0000000300000000 ffff81007a5711e8 0000000000000000
> Call Trace:
>  [<ffffffff880a2cd6>] :snd_mixer_oss:snd_mixer_oss_notify_handler+0x23e/0x271
>  [<ffffffff8024c42b>] free_pages_bulk+0x2c/0x1f4
>  [<ffffffff802229d2>] __wake_up+0x36/0x4d
>  [<ffffffff880166d7>] :snd:snd_card_do_free+0x17/0xe4
>  [<ffffffff88016e3d>] :snd:snd_card_file_remove+0xfd/0x135
>  [<ffffffff88041fc7>] :snd_pcm:snd_pcm_release+0xb6/0xc1
>  [<ffffffff8026745a>] __fput+0xac/0x18a
>  [<ffffffff802653d4>] filp_close+0x5c/0x64
>  [<ffffffff8022a913>] put_files_struct+0x6b/0xbd
>  [<ffffffff8022ba84>] do_exit+0x233/0x814
>  [<ffffffff8022c0eb>] sys_exit_group+0x0/0xe
>  [<ffffffff802093fe>] system_call+0x7e/0x83

How did it happen?  You plugged out a usb adaptor during xmms is
running with OSS output mode?


Takashi

Re: [Alsa-devel] double fault in 2.6.19rc4-git5 while unplugging/replugging a USB headset

[Andi Kleen]

> 
> How did it happen?  You plugged out a usb adaptor during xmms is
> running with OSS output mode?

xmms was running yes. But I think the oops happened on replug.

Long story: i had the headset connected during boot and my XMMS
insisted on outputing its music on it, which wasn't intended -- 
i wanted it on the speakers connected to the motherboard sound chip.

So i unplug the headset and restarted alsa initialization,
but it was very unhappy about cleaning up and couldn't initialize
the other sound card. I replugged the headset and then
I got the oops.

-Andi

Re: [Alsa-devel] double fault in 2.6.19rc4-git5 while unplugging/replugging a USB headset

[Takashi Iwai]

At Mon, 6 Nov 2006 18:03:42 +0100,
Andi Kleen wrote:
> 
> 
> > 
> > How did it happen?  You plugged out a usb adaptor during xmms is
> > running with OSS output mode?
> 
> xmms was running yes. But I think the oops happened on replug.
> 
> Long story: i had the headset connected during boot and my XMMS
> insisted on outputing its music on it, which wasn't intended -- 
> i wanted it on the speakers connected to the motherboard sound chip.
> 
> So i unplug the headset and restarted alsa initialization,
> but it was very unhappy about cleaning up and couldn't initialize
> the other sound card. I replugged the headset and then
> I got the oops.

OK I got a lockup with my laptop and usb-audio replugging and xmms,
too.

The patch below fixed the lockup problem on my machine.
Could you check whether it fixes your case, too?


thanks,

Takashi

diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index 505b23e..e0821eb 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -2359,7 +2359,8 @@ static int snd_pcm_oss_release(struct in
 		substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE];
 	snd_assert(substream != NULL, return -ENXIO);
 	pcm = substream->pcm;
-	snd_pcm_oss_sync(pcm_oss_file);
+	if (!pcm->card->shutdown)
+		snd_pcm_oss_sync(pcm_oss_file);
 	mutex_lock(&pcm->open_mutex);
 	snd_pcm_oss_release_file(pcm_oss_file);
 	mutex_unlock(&pcm->open_mutex);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 37b4b10..66e24b5 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1310,7 +1310,8 @@ static int snd_pcm_pre_prepare(struct sn
 			       int f_flags)
 {
 	struct snd_pcm_runtime *runtime = substream->runtime;
-	if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
+	if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+	    runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
 		return -EBADFD;
 	if (snd_pcm_running(substream))
 		return -EBUSY;
@@ -1568,7 +1569,8 @@ static int snd_pcm_drop(struct snd_pcm_s
 	runtime = substream->runtime;
 	card = substream->pcm->card;
 
-	if (runtime->status->state == SNDRV_PCM_STATE_OPEN)
+	if (runtime->status->state == SNDRV_PCM_STATE_OPEN ||
+	    runtime->status->state == SNDRV_PCM_STATE_DISCONNECTED)
 		return -EBADFD;
 
 	snd_power_lock(card);
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index c82b01c..67202b9 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -1469,7 +1469,8 @@ static int snd_usb_hw_free(struct snd_pc
 	subs->cur_audiofmt = NULL;
 	subs->cur_rate = 0;
 	subs->period_bytes = 0;
-	release_substream_urbs(subs, 0);
+	if (!subs->stream->chip->shutdown)
+		release_substream_urbs(subs, 0);
 	return snd_pcm_free_vmalloc_buffer(substream);
 }