public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* 2.6.18.5 usb/sysfs bug.
@ 2006-12-15 17:50 Dave Jones
  2006-12-15 17:53 ` Greg KH
  0 siblings, 1 reply; 9+ messages in thread
From: Dave Jones @ 2006-12-15 17:50 UTC (permalink / raw)
  To: Linux Kernel; +Cc: greg

Happens during every boot, though bootup continues afterwards.
I'll give .20rc1 a shot real soon.

		Dave

BUG: unable to handle kernel NULL pointer dereference at virtual address 0000000b
 printing eip:
c04a4dea
*pde = 31b81001
Oops: 0000 [#1]
SMP 
last sysfs file: /devices/pci0000:00/0000:00:00.0/irq
Modules linked in: hidp l2cap sunrpc ip_conntrack_netbios_ns ipt_REJECT xt_state ip_conntrack nfnetlink iptable_filter ip_tables ip6t_REJECT xt_tcpudp ip6table_filter ip6_tables x_tables ipv6 cpufreq_ondemand dm_multipath video sbs i2c_ec dock button battery asus_acpi ac parport_pc lp parport snd_hda_intel snd_hda_codec snd_seq_dummy snd_seq_oss snd_seq_midi_event sg snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss joydev ide_cd i2c_i801 tg3 pcspkr snd_pcm i2c_core snd_timer snd ohci1394 soundcore hci_usb ieee1394 serio_raw cdrom snd_page_alloc bluetooth dm_snapshot dm_zero dm_mirror dm_mod ata_piix libata sd_mod scsi_mod ext3 jbd ehci_hcd ohci_hcd uhci_hcd
CPU:    1
EIP:    0060:[<c04a4dea>]    Not tainted VLI
EFLAGS: 00010286   (2.6.18-1.2849.fc6PAE #1) 
EIP is at sysfs_hash_and_remove+0x18/0xfd
eax: fffffff3   ebx: c0699d8c   ecx: c068099c   edx: fffffff3
esi: fffffff3   edi: fffffff3   ebp: c1df9c14   esp: f151be64
ds: 007b   es: 007b   ss: 0068
Process pcscd (pid: 2674, ti=f151b000 task=f1af17b0 task.ti=f151b000)
Stack: c0632028 fffffff3 c1df9c14 c0699d8c fffffff3 fffffff3 c1df9c14 c04a6e11 
       c0699d80 f7e38cb0 c04a6e60 f7e38c08 f6fc2980 f7e38c08 c0554ab3 f7e38cb0 
       c055071f f7e38c08 f74ca5c0 00000001 f7273e08 c055074e f151bed0 c0585cf0 
Call Trace:
 [<c04a6e11>] remove_files+0x15/0x1e
 [<c04a6e60>] sysfs_remove_group+0x46/0x5c
 [<c0554ab3>] device_pm_remove+0x2b/0x62
 [<c055071f>] device_del+0x11a/0x141
 [<c055074e>] device_unregister+0x8/0x10
 [<c0585cf0>] usb_remove_ep_files+0x5b/0x7b
 [<c0585866>] usb_remove_sysfs_intf_files+0x1d/0x54
 [<c05839fd>] usb_set_interface+0xef/0x178
 [<c0583ee7>] usb_unbind_interface+0x4a/0x6a
 [<c0551d58>] __device_release_driver+0x60/0x78
 [<c0551fa5>] device_release_driver+0x2b/0x3a
 [<c057d7e6>] usb_driver_release_interface+0x3b/0x63
 [<c0585fe9>] releaseintf+0x4b/0x5b
 [<c058880e>] usbdev_release+0x67/0x9e
 [<c046f18a>] __fput+0xba/0x188
 [<c046c9e9>] filp_close+0x52/0x59
 [<c0403fa9>] sysenter_past_esp+0x56/0x79
DWARF2 unwinder stuck at sysenter_past_esp+0x56/0x79
Leftover inexact backtrace:
 =======================
Code: 8b 40 20 8b 40 30 c3 8b 40 14 8b 00 c3 8b 40 14 8b 00 c3 55 57 56 53 83 ec 0c 85 c0 89 44 24 04 89 14 24 0f 84 df 00 00 00 89 c2 <8b> 40 18 85 c0 0f 84 d2 00 00 00 8b 52 60 83 e8 80 89 54 24 08 
EIP: [<c04a4dea>] sysfs_hash_and_remove+0x18/0xfd SS:ESP 0068:f151be64


-- 
http://www.codemonkey.org.uk

^ permalink raw reply	[flat|nested] 9+ messages in thread
* Re: 2.6.18.5 usb/sysfs bug.
@ 2006-12-16  5:47 Chuck Ebbert
  2006-12-16 14:18 ` Dave Jones
  0 siblings, 1 reply; 9+ messages in thread
From: Chuck Ebbert @ 2006-12-16  5:47 UTC (permalink / raw)
  To: Dave Jones; +Cc: Greg KH, linux-kernel

In-Reply-To: <20061215213715.GB15792@redhat.com>

On Fri, 15 Dec 2006 16:37:15 -0500, Dave Jones wrote:

> > Can you enable CONFIG_USB_DEBUG and send the log info that happens right
> > before this oops?
>
> Gah, and here it is, actually attached this time.

> BUG: unable to handle kernel NULL pointer dereference at virtual address 0000000b

> EIP is at sysfs_hash_and_remove+0x18/0xfd

That's strange.  Remove_files called sysfs_hash_and_remove()
with dir==0xfffffff3 (-13 decimal.)

static void remove_files(struct dentry * dir,
                         const struct attribute_group * grp)
{
        struct attribute *const* attr;

        for (attr = grp->attrs; *attr; attr++)
                sysfs_hash_and_remove(dir,(*attr)->name); <========
}

> Process pcscd (pid: 2678, ti=f6d28000 task=f7dbe1f0 task.ti=f6d28000)
> Stack: c0634109 fffffff3 f7063414 c069cf0c fffffff3 fffffff3 f7063414 c04a7f69 
>        c069cf00 f70632b0 c04a7fb8 f7063208 f70473a0 f7063208 c055572f f70632b0 
>        c05513ff f7063208 f7000640 00000001 f703f788 c055142e f6d28ed4 c058800c 
> Call Trace:
>  [<c04a7f69>] remove_files+0x15/0x1e
>  [<c04a7fb8>] sysfs_remove_group+0x46/0x5c
>  [<c055572f>] device_pm_remove+0x2b/0x62
>  [<c05513ff>] device_del+0x11a/0x141
>  [<c055142e>] device_unregister+0x8/0x10
>  [<c058800c>] usb_remove_ep_files+0x5b/0x7b
>  [<c0587b82>] usb_remove_sysfs_intf_files+0x1d/0x54
>  [<c0585b5c>] usb_set_interface+0x135/0x1bf
>  [<c0586047>] usb_unbind_interface+0x4a/0x6a
>  [<c0552a38>] __device_release_driver+0x60/0x78
>  [<c0552c85>] device_release_driver+0x2b/0x3a
>  [<c057e4f5>] usb_driver_release_interface+0x3b/0x63
>  [<c058833d>] releaseintf+0x4b/0x5b
>  [<c058ab8d>] usbdev_release+0x67/0x9e
>  [<c0470402>] __fput+0xba/0x188
>  [<c046dc61>] filp_close+0x52/0x59
>  [<c0404013>] syscall_call+0x7/0xb

What is pcscd?

Earlier in bootup you got this:

hub 1-0:1.0: state 7 ports 2 chg 0000 evt 0004
uhci_hcd 0000:00:1d.0: port 2 portsc 008a,00
hub 1-0:1.0: port 2, status 0100, change 0003, 12 Mb/s
usb 1-2: USB disconnect, address 2
usb 1-2: usb_disable_device nuking all URBs
uhci_hcd 0000:00:1d.0: shutdown urb f7ed7540 pipe 40408280 ep1in-intr
usb 1-2: unregistering interface 1-2:1.0
 usbdev1.2_ep81: ep_device_release called for usbdev1.2_ep81
usb 1-2:1.0: uevent
usb 1-2: unregistering device
 usbdev1.2_ep00: ep_device_release called for usbdev1.2_ep00

usb_remove_ep_files() is in the call trace, so this may be related?

-- 
MBTI: IXTP

^ permalink raw reply	[flat|nested] 9+ messages in thread
* Re: 2.6.18.5 usb/sysfs bug.
@ 2006-12-17  7:43 Chuck Ebbert
  0 siblings, 0 replies; 9+ messages in thread
From: Chuck Ebbert @ 2006-12-17  7:43 UTC (permalink / raw)
  To: Dave Jones; +Cc: linux-kernel, Greg KH

In-Reply-To: <20061216141828.GA23368@redhat.com>

On Sat, 16 Dec 2006 09:18:28 -0500, Dave Jones wrote:

>  > That's strange.  Remove_files called sysfs_hash_and_remove()
>  > with dir==0xfffffff3 (-13 decimal.)
> 
> Hmm, That's -EACCESS.  Something not checking a return code at a lower
> level maybe ?

In fs/sysfs/group.c:

void sysfs_remove_group(struct kobject * kobj,
                        const struct attribute_group * grp)
{
        struct dentry * dir;

        if (grp->name)
                dir = lookup_one_len(grp->name, kobj->dentry,
                                strlen(grp->name));
        else
                dir = dget(kobj->dentry);

        remove_files(dir,grp);
        if (grp->name)
                sysfs_remove_subdir(dir);
        /* release the ref. taken in this routine */
        dput(dir);
}

'dir' is being used without checking whether lookup_one_len()
succeeded.

> It's odd that something disconnects during boot, as nothing gets plugged.

Sometimes notebooks have USB devices built-in and they get treated
as if they were hotplugged.

-- 
MBTI: IXTP


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2006-12-17  7:48 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-12-15 17:50 2.6.18.5 usb/sysfs bug Dave Jones
2006-12-15 17:53 ` Greg KH
2006-12-15 21:36   ` Dave Jones
2006-12-15 21:37   ` Dave Jones
2006-12-16  1:47     ` Pete Zaitcev
2006-12-16  3:05       ` Dave Jones
  -- strict thread matches above, loose matches on Subject: below --
2006-12-16  5:47 Chuck Ebbert
2006-12-16 14:18 ` Dave Jones
2006-12-17  7:43 Chuck Ebbert

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox