Re: 2.6.16-rc5 pppd oops on disconnects

[Paul Fulghum <paulkf@microgate.com>]

Bob Copeland wrote:
> On 3/12/06, Paul Fulghum <paulkf@microgate.com> wrote:
> 
>>--- linux-2.6.16-rc5/drivers/usb/class/cdc-acm.c        2006-02-27 09:24:29.000000000 -0600
>>+++ b/drivers/usb/class/cdc-acm.c       2006-03-12 10:22:21.000000000 -0600
>>@@ -980,7 +980,7 @@ skip_normal_probe:
>>        usb_driver_claim_interface(&acm_driver, data_interface, acm);
>>
>>        usb_get_intf(control_interface);
>>-       tty_register_device(acm_tty_driver, minor, &control_interface->dev);
>>+       tty_register_device(acm_tty_driver, minor, NULL);
>>
>>        acm_table[minor] = acm;
>>        usb_set_intfdata (intf, acm);
>>
> 
> 
> Paul,
> 
> No oops with the above patch.
> 
> thanks!
> -Bob

I think what is happening is that control_interface->dev is used
to back 2 sysfs entries (one usb, and one tty). When the usb
device is disconnected, the usb sysfs entries are removed and
the backing device is released. But the tty sysfs entry is
not removed until later after the tty is closed. This removal oops
because the backing device (or some sysfs entity associated with
the backing device) has already been freed. The slab poisoning
is needed to catch this. That's my theory, but I'm no expert
on USB or sysfs.

The above change does not associate the device
with the tty object, and no tty sysfs entry is made that
references the device. No function is lost, but some info
is not exported to userland.

I guess a more thorough approach would be to somehow not release
the usb device until the tty close completes. But that sounds
kind of messy, as the usb code would need to know about any
other class sysfs entries besides usb. (tty, maybe storage, etc)

Greg or the USB folks are more qualified to decide the details.

Thanks for your help Bob.

--
Paul