Re: 2.6.16-rc5 pppd oops on disconnects

[Paul Fulghum <paulkf@microgate.com>]

Bob Copeland wrote:

 > dmesg follows...
 >
 > usb 1-2: USB disconnect, address 6
 > acm_disconnect intf=ce99f720 acm=ce24eca0 usb_dev=ce24f4b8
 > acm_disconnect acm->used=1 acm->dev=ce24f4b8 acm->tty=cd254af8
 > acm_disconnect intf=cefb6760 acm=00000000 usb_dev=ce24f4b8
 > acm_tty_close tty=cd254af8 filp=ce96511c acm=ce24eca0
 > acm_tty_close acm->used=1 acm->dev=00000000
 > Unable to handle kernel paging request at virtual address 6b6b6bfb

 > ...

 >  [<c017585e>] sysfs_hash_and_remove+0x34/0x10a


OK, the cdc-acm driver disconnect/close seems to behave correctly
as I first thought. tty_unregister_device is only called once. The reference
counting is correct. acm->tty still needs to be set to NULL on the final
close, but that is not the problem you are seeing.

I'm looking again at the sysfs stuff as both acm_disconnect
and tty_unregister_device (called from acm_tty_close) remove sysfs entries.
There may be some interaction of entries (name space
collision?) such that acm_disconnect releases a sysfs entry
that tty_unregister_device tries to release again (hence the slab poisoning
flagging a reference to already released memory). I'm not
familiar with this so it may take me a while.

Feel free to bug others about this, I don't mean to interfere
if someone else has a better idea.

Thanks for your persistence,
Paul