Re: BUG in i2c_detach_client

Andrew Morton
2005-06-08T21:28:53Z

Andrew James Wade <ajwade@cpe00095b3131a0-cm0011ae8cd564.cpe.net.cable.rogers.com> wrote:
>
> 2.6.12-rc5-mm1 didn't crash.
>
> kernel BUG at include/linux/list.h:166!
> invalid operand: 0000 [#1]
> PREEMPT
> CPU: 0
> EIP: 0060:[<c0319cd4>] Not tainted VLI
> EFLAGS: 00010a83 (2.6.12-rc6-mm1)
> EIP is at i2c_detach_client+0xb4/0x110
> eax: dfc0bcc0 ebx: c15fc26c ecx: c15fc264 edx: c04378d0
> esi: c15fc14c edi: c0437720 ebp: 00000000 esp: dff81f10
> ds: 007b es: 007b ss: 0068
> Process swapper (pid: 1, threadinfo=dff80000 task=c14dca00)
> Stack: dfff6110 dfc0bdb4 00000286 00000286 c15fc26c c15fc14c c15fc160 ffffffed
> c031d512 c15fc160 c03edac1 c15fc26c 00000000 0000002d 00000001 0000002d
> c0437720 00000000 c0437c5c 00000001 00000000 c031b100 00000000 00000000
> Call Trace:
> [<c031d512>] asb100_detect+0x442/0x520

Were there no interesting printks before this BUG hit?

It's due to the kernel running list_del() on a list_head which isn't on a list.

Seems there is an error-path bug in that driver, but I don' thtink the fix
will fix it. Please test?

From: Andrew Morton <akpm@osdl.org>

Fix error backing-out code in asb100.c

Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

drivers/i2c/chips/asb100.c | 6 ++++--
1 files changed, 4 insertions(+), 2 deletions(-)

diff -puN drivers/i2c/chips/asb100.c~asb100-fix drivers/i2c/chips/asb100.c
--- 25/drivers/i2c/chips/asb100.c~asb100-fix 2005-06-08 14:23:52.000000000 -0700
+++ 25-akpm/drivers/i2c/chips/asb100.c 2005-06-08 14:24:13.000000000 -0700
@@ -690,18 +690,20 @@ static int asb100_detect_subclients(stru
if ((err = i2c_attach_client(data->lm75[0]))) {
dev_err(&new_client->dev, "subclient %d registration "
"at address 0x%x failed.\n", i, data->lm75[0]->addr);
- goto ERROR_SC_2;
+ goto ERROR_SC_3;
}

if ((err = i2c_attach_client(data->lm75[1]))) {
dev_err(&new_client->dev, "subclient %d registration "
"at address 0x%x failed.\n", i, data->lm75[1]->addr);
- goto ERROR_SC_3;
+ goto ERROR_SC_4;
}

return 0;

/* Undo inits in case of errors */
+ERROR_SC_4:
+ i2c_detach_client(data->lm75[1]);
ERROR_SC_3:
i2c_detach_client(data->lm75[0]);
ERROR_SC_2:
_