rmmod uhci_hcd -> BUG: atomic counter underflow

rmmod uhci_hcd -> BUG: atomic counter underflow

[Jiri Slaby]

Hi.

After rmmoding of uhci_hcd on fresh booted 2.6.21-rc3-mm2 I got this:

BUG: atomic counter underflow at:
  [<c0104f0b>] show_trace_log_lvl+0x1a/0x30
  [<c01055f3>] show_trace+0x12/0x14
  [<c010567a>] dump_stack+0x16/0x18
  [<c01dc41b>] kref_put+0x4d/0xb2
  [<c01db754>] kobject_put+0x14/0x16
  [<c01db8a3>] kobject_unregister+0x22/0x25
  [<c024c987>] bus_remove_driver+0x75/0x82
  [<c024d3b8>] driver_unregister+0xb/0x18
  [<c01e7020>] pci_unregister_driver+0x13/0x73
  [<f88dbbd9>] uhci_hcd_cleanup+0xd/0x2d [uhci_hcd]
  [<c013fb69>] sys_delete_module+0x133/0x195
  [<c0103fe0>] syscall_call+0x7/0xb
  =======================

Note, that this is connected:
Bus 004 Device 001: ID 0000:0000
Bus 003 Device 001: ID 0000:0000
Bus 002 Device 004: ID 0458:004c KYE Systems Corp. (Mouse Systems) Slimstar 
Pro Keyboard
Bus 002 Device 003: ID 04b4:2050 Cypress Semiconductor Corp.
Bus 002 Device 002: ID 045e:00f0 Microsoft Corp.
Bus 002 Device 001: ID 0000:0000
Bus 001 Device 001: ID 0000:0000
Bus 005 Device 001: ID 0000:0000

What other info do you want me to post?

regards,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E

Re: rmmod uhci_hcd -> BUG: atomic counter underflow

[Alan Stern]

On Mon, 12 Mar 2007, Jiri Slaby wrote:

> Hi.
> 
> After rmmoding of uhci_hcd on fresh booted 2.6.21-rc3-mm2 I got this:
> 
> BUG: atomic counter underflow at:
>   [<c0104f0b>] show_trace_log_lvl+0x1a/0x30
>   [<c01055f3>] show_trace+0x12/0x14
>   [<c010567a>] dump_stack+0x16/0x18
>   [<c01dc41b>] kref_put+0x4d/0xb2
>   [<c01db754>] kobject_put+0x14/0x16
>   [<c01db8a3>] kobject_unregister+0x22/0x25
>   [<c024c987>] bus_remove_driver+0x75/0x82
>   [<c024d3b8>] driver_unregister+0xb/0x18
>   [<c01e7020>] pci_unregister_driver+0x13/0x73
>   [<f88dbbd9>] uhci_hcd_cleanup+0xd/0x2d [uhci_hcd]
>   [<c013fb69>] sys_delete_module+0x133/0x195
>   [<c0103fe0>] syscall_call+0x7/0xb
>   =======================
> 
> Note, that this is connected:
> Bus 004 Device 001: ID 0000:0000
> Bus 003 Device 001: ID 0000:0000
> Bus 002 Device 004: ID 0458:004c KYE Systems Corp. (Mouse Systems) Slimstar 
> Pro Keyboard
> Bus 002 Device 003: ID 04b4:2050 Cypress Semiconductor Corp.
> Bus 002 Device 002: ID 045e:00f0 Microsoft Corp.
> Bus 002 Device 001: ID 0000:0000
> Bus 001 Device 001: ID 0000:0000
> Bus 005 Device 001: ID 0000:0000
> 
> What other info do you want me to post?

My guess is that this was caused by changes to the driver core, not by 
anything connected to USB.

Would it be possible for you to add the atomic counter underflow check to 
2.6.21-rc3 and see if the problem still occurs?  If it doesn't, that's a 
good indication the USB stack isn't guilty -- the bus registration code 
hasn't changed for several kernel releases.

Alan Stern

Re: rmmod uhci_hcd -> BUG: atomic counter underflow

[Jiri Slaby]

Alan Stern napsal(a):
> On Mon, 12 Mar 2007, Jiri Slaby wrote:
>> After rmmoding of uhci_hcd on fresh booted 2.6.21-rc3-mm2 I got this:
>>
>> BUG: atomic counter underflow at:
[...]
>>   [<c01db754>] kobject_put+0x14/0x16
>>   [<c01db8a3>] kobject_unregister+0x22/0x25
>>   [<c024c987>] bus_remove_driver+0x75/0x82
>>   [<c024d3b8>] driver_unregister+0xb/0x18
>>   [<c01e7020>] pci_unregister_driver+0x13/0x73
>>   [<f88dbbd9>] uhci_hcd_cleanup+0xd/0x2d [uhci_hcd]
[...]
> Would it be possible for you to add the atomic counter underflow check to 
> 2.6.21-rc3 and see if the problem still occurs?  If it doesn't, that's a 
> good indication the USB stack isn't guilty -- the bus registration code 
> hasn't changed for several kernel releases.

Yes.

regards,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E

Hnus <hnus@fi.muni.cz> is an alias for /dev/null

Re: rmmod uhci_hcd -> BUG: atomic counter underflow

[Jiri Slaby]

Jiri Slaby napsal(a):
> Alan Stern napsal(a):
>> On Mon, 12 Mar 2007, Jiri Slaby wrote:
>>> After rmmoding of uhci_hcd on fresh booted 2.6.21-rc3-mm2 I got this:
>>>
>>> BUG: atomic counter underflow at:
> [...]
>>>   [<c01db754>] kobject_put+0x14/0x16
>>>   [<c01db8a3>] kobject_unregister+0x22/0x25
>>>   [<c024c987>] bus_remove_driver+0x75/0x82
>>>   [<c024d3b8>] driver_unregister+0xb/0x18
>>>   [<c01e7020>] pci_unregister_driver+0x13/0x73
>>>   [<f88dbbd9>] uhci_hcd_cleanup+0xd/0x2d [uhci_hcd]
> [...]
>> Would it be possible for you to add the atomic counter underflow check 
>> to 2.6.21-rc3 and see if the problem still occurs?  If it doesn't, 
>> that's a good indication the USB stack isn't guilty -- the bus 
>> registration code hasn't changed for several kernel releases.
> 
> Yes.

I can confirm, that this issue went upstream and is currently present there.

regards,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E

Hnus <hnus@fi.muni.cz> is an alias for /dev/null

Re: rmmod uhci_hcd -> BUG: atomic counter underflow

[Alan Stern]

On Mon, 12 Mar 2007, Jiri Slaby wrote:

> Jiri Slaby napsal(a):
> > Alan Stern napsal(a):
> >> On Mon, 12 Mar 2007, Jiri Slaby wrote:
> >>> After rmmoding of uhci_hcd on fresh booted 2.6.21-rc3-mm2 I got this:
> >>>
> >>> BUG: atomic counter underflow at:
> > [...]
> >>>   [<c01db754>] kobject_put+0x14/0x16
> >>>   [<c01db8a3>] kobject_unregister+0x22/0x25
> >>>   [<c024c987>] bus_remove_driver+0x75/0x82
> >>>   [<c024d3b8>] driver_unregister+0xb/0x18
> >>>   [<c01e7020>] pci_unregister_driver+0x13/0x73
> >>>   [<f88dbbd9>] uhci_hcd_cleanup+0xd/0x2d [uhci_hcd]
> > [...]
> >> Would it be possible for you to add the atomic counter underflow check 
> >> to 2.6.21-rc3 and see if the problem still occurs?  If it doesn't, 
> >> that's a good indication the USB stack isn't guilty -- the bus 
> >> registration code hasn't changed for several kernel releases.
> > 
> > Yes.
> 
> I can confirm, that this issue went upstream and is currently present there.

I found the problem, but I don't know how to fix it.  Hopefully Greg or 
Rusty will know.

There are two bugs in kernel/module.c:module_remove_driver(), right at the 
end of the routine:

	/*
	 * Undo the additional reference we added in module_add_driver()
	 * via kset_find_obj()
	 */
	if (drv->mod_name)
		kobject_put(&drv->kobj);

It's supposed to undo this code in module_add_driver():

	if (mod)
		mk = &mod->mkobj;
	else if (drv->mod_name) {
		struct kobject *mkobj;

		/* Lookup built-in module entry in /sys/modules */
		mkobj = kset_find_obj(&module_subsys.kset, drv->mod_name);
		if (mkobj)
			mk = container_of(mkobj, struct module_kobject, kobj);
	}

The first bug is in the condition of the "if (drv->mod_name)" statement.  
If "mod" isn't NULL then kset_find_obj() doesn't get called, but the "if" 
can succeed anyway.  (Maybe this isn't a real bug -- it would depend on 
all the callers; I don't know.)

The second bug is the argument to kobject_put().  drv->kobj is _not_ the 
kobject whose refcount gets incremented by the kset_find_obj() call.  
That's why the BUG occurred; the kobject's refcount was getting 
decremented without being incremented first.

Alan Stern

Re: rmmod uhci_hcd -> BUG: atomic counter underflow

[Greg KH]

On Mon, Mar 12, 2007 at 05:25:09PM -0400, Alan Stern wrote:
> On Mon, 12 Mar 2007, Jiri Slaby wrote:
> 
> > Jiri Slaby napsal(a):
> > > Alan Stern napsal(a):
> > >> On Mon, 12 Mar 2007, Jiri Slaby wrote:
> > >>> After rmmoding of uhci_hcd on fresh booted 2.6.21-rc3-mm2 I got this:
> > >>>
> > >>> BUG: atomic counter underflow at:
> > > [...]
> > >>>   [<c01db754>] kobject_put+0x14/0x16
> > >>>   [<c01db8a3>] kobject_unregister+0x22/0x25
> > >>>   [<c024c987>] bus_remove_driver+0x75/0x82
> > >>>   [<c024d3b8>] driver_unregister+0xb/0x18
> > >>>   [<c01e7020>] pci_unregister_driver+0x13/0x73
> > >>>   [<f88dbbd9>] uhci_hcd_cleanup+0xd/0x2d [uhci_hcd]
> > > [...]
> > >> Would it be possible for you to add the atomic counter underflow check 
> > >> to 2.6.21-rc3 and see if the problem still occurs?  If it doesn't, 
> > >> that's a good indication the USB stack isn't guilty -- the bus 
> > >> registration code hasn't changed for several kernel releases.
> > > 
> > > Yes.
> > 
> > I can confirm, that this issue went upstream and is currently present there.
> 
> I found the problem, but I don't know how to fix it.  Hopefully Greg or 
> Rusty will know.
> 
> There are two bugs in kernel/module.c:module_remove_driver(), right at the 
> end of the routine:
> 
> 	/*
> 	 * Undo the additional reference we added in module_add_driver()
> 	 * via kset_find_obj()
> 	 */
> 	if (drv->mod_name)
> 		kobject_put(&drv->kobj);
> 

This code is reverted in 2.6.21-rc3-git7 as it was incorrect as you have
properly determined.

So, can people please test with a kernel newer than that?

thanks,

greg k-h

Re: rmmod uhci_hcd -> BUG: atomic counter underflow

[Jiri Slaby]

Greg KH napsal(a):
> On Mon, Mar 12, 2007 at 05:25:09PM -0400, Alan Stern wrote:
>> On Mon, 12 Mar 2007, Jiri Slaby wrote:
>>
>>> Jiri Slaby napsal(a):
>>>> Alan Stern napsal(a):
>>>>> On Mon, 12 Mar 2007, Jiri Slaby wrote:
>>>>>> After rmmoding of uhci_hcd on fresh booted 2.6.21-rc3-mm2 I got this:
>>>>>>
>>>>>> BUG: atomic counter underflow at:
[...]
> This code is reverted in 2.6.21-rc3-git7 as it was incorrect as you have
> properly determined.
> 
> So, can people please test with a kernel newer than that?

Yes, this one works fine.

regards,
-- 
http://www.fi.muni.cz/~xslaby/            Jiri Slaby
faculty of informatics, masaryk university, brno, cz
e-mail: jirislaby gmail com, gpg pubkey fingerprint:
B674 9967 0407 CE62 ACC8  22A0 32CC 55C3 39D4 7A7E