[Bug 714065] New: Unplugging hybrid DVB-T/analog TV USB device (0ccd:005e, TerraTec Cinergy XS) causes Kernel Oops
https://bugzilla.novell.com/show_bug.cgi?id=714065 https://bugzilla.novell.com/show_bug.cgi?id=714065#c0 Summary: Unplugging hybrid DVB-T/analog TV USB device (0ccd:005e, TerraTec Cinergy XS) causes Kernel Oops Classification: openSUSE Product: openSUSE 11.4 Version: Final Platform: PC OS/Version: openSUSE 11.4 Status: NEW Severity: Normal Priority: P5 - None Component: Kernel AssignedTo: kernel-maintainers@forge.provo.novell.com ReportedBy: doerges@pre-sense.de QAContact: qa@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:5.0) Gecko/20100101 Firefox/5.0 The following device reproducibly crashes my system, when it is unplugged. While plugged it works just fine: # lsusb | grep -i terra Bus 001 Device 007: ID 0ccd:005e TerraTec Electronic GmbH System information: $ cat /etc/SuSE-release openSUSE 11.4 (x86_64) VERSION = 11.4 CODENAME = Celadon $ uname -a Linux box.none 2.6.37.6-0.7-desktop #1 SMP PREEMPT 2011-07-21 02:17:24 +0200 x86_64 x86_64 x86_64 GNU/Linux The same also occurs on a i686 system: $ cat /etc/SuSE-release openSUSE 11.4 (i586) VERSION = 11.4 CODENAME = Celadon $ uname -a Linux box2 2.6.37.6-0.7-default #1 SMP 2011-07-21 02:17:24 +0200 i686 i686 i386 GNU/Linux Reproducible: Always Steps to Reproduce: 1. Plug device into USB port 2. Unplug device Actual Results: Kernel Oops. Expected Results: No Kernel Oops. I believe the bug has been described here already: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=613275 Kernel Oops from x86_64 system: --- snip --- [34669.206770] usb 1-5.2: USB disconnect, address 8 [34669.206943] em28xx #0: disconnecting em28xx #0 video [34669.210284] BUG: unable to handle kernel NULL pointer dereference at 0000000000000298 [34669.210322] IP: [<ffffffffa07f50e0>] ir_close+0x10/0x30 [ir_core] [34669.210357] PGD 0 [34669.210378] Oops: 0000 [#1] PREEMPT SMP [34669.210402] last sysfs file: /sys/devices/system/cpu/cpu1/cache/index2/shared_cpu_map [34669.210428] CPU 0 [34669.210433] Modules linked in: zl10353 em28xx_dvb dvb_core em28xx_alsa rc_terratec_cinergy_xs tuner_xc2028 tuner tvp5150 ir_lirc_codec lirc_dev ir_sony_decoder ir_jvc_decoder ir_rc6_decoder ir_rc5_decoder em28xx ir_nec_decoder v4l2_common videodev v4l1_compat v4l2_compat_ioctl32 ir_core videobuf_vmalloc videobuf_core tveeprom xt_physdev autofs4 ipt_MASQUERADE iptable_nat nf_nat bridge stp llc md5 nls_utf8 cifs tun fuse ip6t_LOG xt_tcpudp xt_pkttype ipt_LOG xt_limit af_packet rfcomm sco bnep l2cap microcode edd ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_raw xt_NOTRACK ipt_REJECT iptable_raw iptable_filter ip6table_mangle nf_conntrack_netbios_ns nf_conntrack_ipv4 nf_defrag_ipv4 ip_tables xt_conntrack nf_conntrack ip6table_filter ip6_tables x_tables cpufreq_conservative snd_pcm_oss cpufreq_userspace snd_mixer_oss cpufreq_powersave acpi_cpufreq snd_seq mperf loop arc4 ecb hdj_mod iwlagn iwlcore snd_rawmidi mac80211 snd_hda_codec_conexant btusb sdhci_pci snd_seq_device kvm _intel firewire_ohci zaurus sdhci cdc_ether snd_hda_intel kvm cdc_acm cdc_wdm pcmcia snd_hda_codec cfg80211 bluetooth usbnet thinkpad_acpi r852 sg sr_mod firewire_core mmc_core e1000e sm_common yenta_socket nand iTCO_wdt snd_hwdep pcmcia_rsrc rfkill nand_ids nand_ecc iTCO_vendor_support i2c_i801 snd_pcm cdrom crc_itu_t pcmcia_core mtd snd_timer snd_page_alloc ppdev video tpm_tis wmi tpm snd parport_pc pcspkr button parport joydev battery ac tpm_bios soundcore ext4 jbd2 crc16 sha256_generic cbc dm_crypt linear radeon ttm drm_kms_helper drm i2c_algo_bit dm_snapshot dm_mod fan processor thermal thermal_sys [last unloaded: preloadtrace] [34669.210907] [34669.210927] Pid: 24, comm: khubd Not tainted 2.6.37.6-0.7-desktop #1 LENOVO 4061AK3/4061AK3 [34669.210959] RIP: 0010:[<ffffffffa07f50e0>] [<ffffffffa07f50e0>] ir_close+0x10/0x30 [ir_core] [34669.210992] RSP: 0018:ffff88023b157b20 EFLAGS: 00010282 [34669.211015] RAX: 0000000000000000 RBX: ffff88016e1d5808 RCX: 0000000000000000 [34669.211034] RDX: ffff880227a1f780 RSI: 0000000000000000 RDI: ffff8801b35bfa58 [34669.211034] RBP: ffff8801b35bf800 R08: 0000000000000000 R09: 0000000000000000 [34669.211034] R10: 0000000000012640 R11: 00000000037f2000 R12: ffff8801b35bfa30 [34669.211034] R13: ffffffffa083d420 R14: ffffffffa083d488 R15: 0000000000000000 [34669.211034] FS: 0000000000000000(0000) GS:ffff8800bf600000(0000) knlGS:0000000000000000 [34669.211034] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b [34669.211034] CR2: 0000000000000298 CR3: 0000000001a03000 CR4: 00000000000026e0 [34669.211034] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [34669.211034] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [34669.211034] Process khubd (pid: 24, threadinfo ffff88023b156000, task ffff88023b154640) [34669.211034] Stack: [34669.211034] ffff8801b35bf800 ffffffff813becf4 ffff88016e1d58a8 ffff88016e1d5808 [34669.211034] ffff88016e1d5800 ffffffff813c4840 ffff8801b35bf800 ffff8801b35bfc88 [34669.211034] ffff8801b35bfcb0 ffffffff813c039d ffff8801b35bf800 ffff8801b35bfa58 [34669.211372] Call Trace: [34669.211372] [<ffffffff813becf4>] input_close_device+0x54/0x80 [34669.211372] [<ffffffff813c4840>] evdev_disconnect+0x30/0x60 [34669.211372] [<ffffffff813c039d>] input_unregister_device+0xad/0x160 [34669.211372] [<ffffffffa07f6779>] ir_unregister_class+0x49/0x70 [ir_core] [34669.211372] [<ffffffffa07f5071>] ir_input_unregister+0x71/0xd0 [ir_core] [34669.211372] [<ffffffffa0831cee>] em28xx_ir_fini+0x2e/0x60 [em28xx] [34669.211372] [<ffffffffa082e385>] em28xx_release_resources+0x25/0x70 [em28xx] [34669.211372] [<ffffffffa082e46f>] em28xx_usb_disconnect+0x9f/0x150 [em28xx] [34669.211372] [<ffffffff8138d616>] usb_unbind_interface+0x66/0x1b0 [34669.211372] [<ffffffff8132ce1f>] __device_release_driver+0x6f/0xf0 [34669.211372] [<ffffffff8132cec5>] device_release_driver+0x25/0x40 [34669.211372] [<ffffffff8132c894>] bus_remove_device+0x74/0xe0 [34669.211372] [<ffffffff81329410>] device_del+0x120/0x1a0 [34669.211372] [<ffffffff8138afcd>] usb_disable_device+0x6d/0x1a0 [34669.211372] [<ffffffff8138355c>] usb_disconnect+0x9c/0x180 [34669.211372] [<ffffffff813844dc>] hub_port_connect_change+0xac/0xa00 [34669.211372] [<ffffffff81385124>] hub_events+0x2f4/0x660 [34669.211372] [<ffffffff813854c5>] hub_thread+0x35/0x1a0 [34669.211372] [<ffffffff8107ab06>] kthread+0x96/0xa0 [34669.211372] [<ffffffff81003d74>] kernel_thread_helper+0x4/0x10 [34669.211372] Code: 31 c0 e8 74 d7 d2 e0 e9 6a ff ff ff 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 08 48 81 c7 58 02 00 00 e8 10 7c b3 e0 <48> 8b 80 98 02 00 00 48 8b 78 28 48 8b 40 40 48 83 c4 08 ff e0 [34669.211372] RIP [<ffffffffa07f50e0>] ir_close+0x10/0x30 [ir_core] [34669.211372] RSP <ffff88023b157b20> [34669.211372] CR2: 0000000000000298 [34670.042268] ---[ end trace cb81836b8a224fbc ]--- --- snap --- Kernel Oops from i686 system: --- snip --- [ 121.235107] usb 4-1: USB disconnect, address 2 [ 121.235310] em28xx #0: disconnecting em28xx #0 video [ 121.235608] BUG: unable to handle kernel NULL pointer dereference at 00000178 [ 121.235658] IP: [<f9ad50ba>] ir_close+0xa/0x20 [ir_core] [ 121.235703] *pde = 00000000 [ 121.235730] Oops: 0000 [#1] SMP [ 121.235755] last sysfs file: /sys/devices/LNXSYSTM:00/device:00/PNP0A03:00/device:01/PNP0C09:00/PNP0C0A:00/power_supply/BAT0/voltage_now [ 121.235787] Modules linked in: fuse ip6t_LOG xt_tcpudp xt_pkttype ipt_LOG xt_limit microcode cpufreq_conservative cpufreq_userspace cpufreq_powersave acpi_cpufreq mperf snd_pcm_oss snd_mixer_oss snd_seq snd_seq_device edd ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_raw xt_NOTRACK ipt_REJECT iptable_raw iptable_filter ip6table_mangle nf_conntrack_netbios_ns nf_conntrack_ipv4 nf_defrag_ipv4 ip_tables xt_conntrack nf_conntrack ip6table_filter ip6_tables x_tables usb_storage uas zl10353 em28xx_dvb dvb_core em28xx_alsa rc_terratec_cinergy_xs dm_crypt loop dm_mod tuner_xc2028 tuner tvp5150 ir_lirc_codec lirc_dev ir_sony_decoder ir_jvc_decoder em28xx ir_rc6_decoder v4l2_common ir_rc5_decoder ir_nec_decoder videodev v4l1_compat ir_core videobuf_vmalloc videobuf_core tveeprom sha256_generic ansi_cprng aes_i586 ohci_hcd snd_intel8x0 snd_intel8x0m pcmcia snd_ac97_codec ac97_bus snd_pcm yenta_socket snd_timer pcmcia_rsrc hostap_pci thinkpad_acpi hostap rfkill firewire_ohci irda snd video pcmcia_core ppdev firewire_core snd_page_alloc lib80211 i2c_i801 e100 parport_pc iTCO_wdt sr_mod floppy cdrom soundcore output crc_itu_t parport shpchp iTCO_vendor_support battery crc_ccitt button ac sg pcspkr pci_hotplug preloadtrace ext4 jbd2 crc16 uhci_hcd ehci_hcd radeon ttm drm_kms_helper rtc_cmos drm i2c_algo_bit rtc_core rtc_lib i2c_core usbcore fan processor ata_generic pata_cmd64x ata_piix ahci libahci libata thermal thermal_sys hwmon [ 121.236026] [ 121.236026] Pid: 104, comm: khubd Not tainted 2.6.37.6-0.7-default #1 IBM 2653R6G/2653R6G [ 121.236026] EIP: 0060:[<f9ad50ba>] EFLAGS: 00010282 CPU: 0 [ 121.236026] EIP is at ir_close+0xa/0x20 [ir_core] [ 121.236026] EAX: 00000000 EBX: f3b0be08 ECX: 00000000 EDX: 00000000 [ 121.236026] ESI: f3877400 EDI: f387759c EBP: 00000000 ESP: f6d37d94 [ 121.236026] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068 [ 121.236026] Process khubd (pid: 104, ti=f6d36000 task=f6d34eb0 task.ti=f6d36000) [ 121.236026] Stack: [ 121.236026] c04dd518 f3b0be5c f3b0be08 f3b0be00 c04e0603 f3877400 f38776f4 f3877708 [ 121.236026] c04dd69a 00000286 f3bd8400 f3877400 f38775b8 f9ad64fd f3bd8400 f3877400 [ 121.236026] f9b88900 f9ad5061 c025cb2d f6ded980 f6ded980 f6cdd000 f9b7f195 f6cdd000 [ 121.236026] Call Trace: [ 121.236026] [<c04dd518>] input_close_device+0x48/0x70 [ 121.236026] [<c04e0603>] evdev_disconnect+0x23/0x40 [ 121.236026] [<c04dd69a>] input_unregister_device+0x9a/0x130 [ 121.236026] [<f9ad64fd>] ir_unregister_class+0x3d/0x60 [ir_core] [ 121.236026] [<f9ad5061>] ir_input_unregister+0x61/0xb0 [ir_core] [ 121.236026] [<f9b7f195>] em28xx_ir_fini+0x25/0x50 [em28xx] [ 121.236026] [<f9b7bc85>] em28xx_release_resources+0x25/0x60 [em28xx] [ 121.236026] [<f9b7bd54>] em28xx_usb_disconnect+0x94/0x150 [em28xx] [ 121.236026] [<f81b0ff8>] usb_unbind_interface+0x38/0x130 [usbcore] [ 121.236026] [<c04acabd>] __device_release_driver+0x4d/0xb0 [ 121.236026] [<c04acb3d>] device_release_driver+0x1d/0x30 [ 121.236026] [<c04ac5be>] bus_remove_device+0x5e/0xc0 [ 121.236026] [<c04a9ab7>] device_del+0xe7/0x150 [ 121.236026] [<f81aed72>] usb_disable_device+0x62/0x190 [usbcore] [ 121.236026] [<f81a8195>] usb_disconnect+0x85/0x140 [usbcore] [ 121.236026] [<f81a8fcf>] hub_port_connect_change+0x9f/0x960 [usbcore] [ 121.236026] [<f81a9b26>] hub_events+0x296/0x610 [usbcore] [ 121.236026] [<f81a9ecd>] hub_thread+0x2d/0x180 [usbcore] [ 121.236026] [<c025fff4>] kthread+0x74/0x80 [ 121.236026] [<c0203526>] kernel_thread_helper+0x6/0x10 [ 121.236026] Code: 44 24 04 c0 70 ad f9 c7 04 24 08 72 ad f9 e8 42 52 b2 c6 e9 7a ff ff ff 89 f6 8d bc 27 00 00 00 00 05 b8 01 00 00 e8 26 79 9d c6 <8b> 90 78 01 00 00 8b 42 20 ff 52 2c f3 c3 90 8d b4 26 00 00 00 [ 121.236026] EIP: [<f9ad50ba>] ir_close+0xa/0x20 [ir_core] SS:ESP 0068:f6d37d94 [ 121.236026] CR2: 0000000000000178 [ 121.471777] ---[ end trace 9a102f7b10e6ce20 ]--- --- snap --- -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c1
Jiri Slaby
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c2
--- Comment #2 from Till Dörges
Is this still reproducible with 3.x kernels? Like from kernel:stable, kernel:head or tumbleweed?
I tried 3.1 (http://download.opensuse.org/repositories/Kernel:/stable/standard/x86_64/ker...). Unplugging the device does not crash the computer anymore. However, it still doesn't seem to be quite right. - After having unplugged the device once, it won't work if plugged back in. - The module em28xx_dvb can't be removed manually. The rmmod command just hangs: --- snip --- # lsmod | grep dvb em28xx_dvb 18417 0 cxd2820r 33424 1 em28xx_dvb dvb_core 114318 2 em28xx_dvb,cxd2820r em28xx 113165 2 em28xx_dvb,em28xx_alsa # rmmod em28xx_dvb ^C^C^C^C --- snap --- It seems to be hanging in I/O somehwere: --- snip --- $ ps aux | egrep 'rmmod|USER' | grep -v grep USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 11364 0.0 0.0 3952 536 pts/9 D+ 10:35 0:00 rmmod em28xx_dvb --- snap --- I'm not sure how to proceed. I guess the original problem (Kernel Oops) has been solved. Should I open a new ticket? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c
Till Dörges
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c3
Jiri Slaby
$ ps aux | egrep 'rmmod|USER' | grep -v grep USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 11364 0.0 0.0 3952 536 pts/9 D+ 10:35 0:00 rmmod em28xx_dvb
I think it still crashes. Could you attach dmesg output when it is in this state? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c4
Till Dörges
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c6
--- Comment #6 from Jiri Slaby
INFO: task khubd:28 blocked for more than 480 seconds. ... Call Trace: [<ffffffff815a7a1c>] __mutex_lock_slowpath+0xfc/0x1b0 [<ffffffff815a75fa>] mutex_lock+0x1a/0x40 [<ffffffffa0803c01>] dvb_init+0x61/0xce0 [em28xx_dvb]
Hmm, it's a deadlock. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c7
Jeff Mahoney
https://bugzilla.novell.com/show_bug.cgi?id=714065
https://bugzilla.novell.com/show_bug.cgi?id=714065#c8
--- Comment #8 from Jeff Mahoney
participants (1)
-
bugzilla_noreply＠novell.com