Bug 63961

Summary: [XHCI][hub_quiesce]kernel NULL pointer dereference at (null) - inside hub_disconnect
Product: Drivers Reporter: Luke-Jr (luke-jr+linuxbugs)
Component: USBAssignee: Greg Kroah-Hartman (greg)
Status: RESOLVED CODE_FIX    
Severity: high CC: alan
Priority: P1    
Hardware: x86-64   
OS: Linux   
Kernel Version: 3.10.15 Subsystem:
Regression: No Bisected commit-id:

Description Luke-Jr 2013-10-28 19:13:01 UTC 
[1774469.764676] usb 2-1: new SuperSpeed USB device number 73 using xhci_hcd
[1774469.777435] usb 2-1: Parent hub missing LPM exit latency info.  Power management will be impacted.
[1774469.779805] usb 2-1: New USB device found, idVendor=2109, idProduct=0812
[1774469.779816] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[1774469.779820] usb 2-1: Product: USB3.0 Hub        
[1774469.779823] usb 2-1: Manufacturer: VIA Labs, Inc. 
[1774469.780433] hub 2-1:1.0: USB hub found
[1774469.780924] hub 2-1:1.0: 4 ports detected
[1774470.093124] usb 1-1: new high-speed USB device number 116 using xhci_hcd
[1774470.106475] usb 1-1: New USB device found, idVendor=2109, idProduct=2812
[1774470.106484] usb 1-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0
[1774470.106487] usb 1-1: Product: USB2.0 Hub        
[1774470.107117] hub 1-1:1.0: USB hub found
[1774470.107584] hub 1-1:1.0: 4 ports detected
[1774470.285729] usb 2-1.3: new SuperSpeed USB device number 74 using xhci_hcd
[1774470.297775] usb 2-1.3: Parent hub missing LPM exit latency info.  Power management will be impacted.
[1774470.300021] usb 2-1.3: New USB device found, idVendor=2109, idProduct=0812
[1774470.300025] usb 2-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[1774470.300029] usb 2-1.3: Product: USB3.0 Hub        
[1774470.300032] usb 2-1.3: Manufacturer: VIA Labs, Inc. 
[1774470.300676] hub 2-1.3:1.0: USB hub found
[1774470.301017] hub 2-1.3:1.0: 4 ports detected
[1774470.472998] usb 2-1.4: new SuperSpeed USB device number 75 using xhci_hcd
[1774470.485465] usb 2-1.4: Parent hub missing LPM exit latency info.  Power management will be impacted.
[1774470.487729] usb 2-1.4: New USB device found, idVendor=2109, idProduct=0812
[1774470.487735] usb 2-1.4: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[1774470.487739] usb 2-1.4: Product: USB3.0 Hub        
[1774470.487742] usb 2-1.4: Manufacturer: VIA Labs, Inc. 
[1774470.488401] hub 2-1.4:1.0: USB hub found
[1774470.488712] hub 2-1.4:1.0: 4 ports detected
[1774470.502838] hub 2-1.3:1.0: hub_port_status failed (err = -71)
[1774470.503095] hub 2-1.3:1.0: hub_port_status failed (err = -71)
[1774470.503308] hub 2-1.3:1.0: hub_port_status failed (err = -71)
[1774470.503558] hub 2-1.3:1.0: hub_port_status failed (err = -71)
[1774475.483021] hub 2-1.4:1.0: config failed, can't get hub status (err -110)
[1774475.483042] BUG: unable to handle kernel NULL pointer dereference at           (null)
[1774475.483075] IP: [<ffffffffa019b30e>] hub_quiesce+0x4e/0xb0 [usbcore]
[1774475.483102] PGD 0 
[1774475.483111] Oops: 0000 [#1] PREEMPT SMP 
[1774475.483131] Modules linked in: ip6t_REJECT ip6table_filter ip6_tables x_tables nfnetlink_log nfnetlink nls_utf8 isofs usb_storage fuse netconsole configfs cfq_iosched bridge stp llc ipv6 ftdi_sio cdc_acm hid_generic cp210x usbhid hid usbserial coretemp snd_hda_codec_hdmi evdev snd_hda_codec_realtek hwmon mperf intel_powerclamp kvm_intel kvm psmouse snd_hda_intel xhci_hcd ehci_pci i915 snd_hda_codec ehci_hcd video drm_kms_helper i2c_i801 8250_pci usbcore snd_hwdep drm usb_common snd_pcm e1000e firewire_ohci 8250 8139too tpm_tis ptp tpm mii firewire_core serial_core snd_page_alloc pps_core crc_itu_t snd_timer rtc_cmos button tpm_bios i2c_algo_bit snd ata_generic pata_acpi
[1774475.483572] CPU: 1 PID: 1278 Comm: khubd Tainted: G        W    3.10.15-gentoo #1
[1774475.483592] Hardware name:                  /DQ67SW, BIOS SWQ6710H.86A.0062.2012.0418.1112 04/18/2012
[1774475.483616] task: ffff880429092fe0 ti: ffff880426a12000 task.ti: ffff880426a12000
[1774475.483636] RIP: 0010:[<ffffffffa019b30e>]  [<ffffffffa019b30e>] hub_quiesce+0x4e/0xb0 [usbcore]
[1774475.483666] RSP: 0018:ffff880426a13828  EFLAGS: 00010246
[1774475.483680] RAX: ffff880423900ee0 RBX: ffff8803eb68e000 RCX: ffff88043e28d958
[1774475.483699] RDX: 0000000000000000 RSI: 000000007fffffff RDI: 0000000000000000
[1774475.483718] RBP: ffff880426a13848 R08: 0000000000000000 R09: 0000000000000000
[1774475.483736] R10: 00000000000023c3 R11: 0000000000000000 R12: ffff8800370c4800
[1774475.483754] R13: 0000000000000000 R14: ffff880342989830 R15: 0000000000000096
[1774475.483773] FS:  0000000000000000(0000) GS:ffff88043e280000(0000) knlGS:0000000000000000
[1774475.483794] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[1774475.483808] CR2: 0000000000000000 CR3: 000000000180c000 CR4: 00000000000407e0
[1774475.483826] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[1774475.483844] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[1774475.483863] Stack:
[1774475.483867]  ffff880426a13848 ffff8803eb68e000 ffff8800370c4888 ffff880342989800
[1774475.483898]  ffff880426a13878 ffffffffa019b629 ffff8803eb68e000 ffff880342989800
[1774475.483928]  ffff8800370c4800 00000000ffffff92 ffff880426a13918 ffffffffa019dfd1
[1774475.483959] Call Trace:
[1774475.483969]  [<ffffffffa019b629>] hub_disconnect+0x79/0x140 [usbcore]
[1774475.483989]  [<ffffffffa019dfd1>] hub_probe+0x301/0x820 [usbcore]
[1774475.484008]  [<ffffffffa01a6391>] usb_probe_interface+0x1a1/0x290 [usbcore]
[1774475.484029]  [<ffffffff812fa646>] driver_probe_device+0x76/0x240
[1774475.484045]  [<ffffffff812fa8fb>] __device_attach+0x4b/0x60
[1774475.484061]  [<ffffffff812fa8b0>] ? __driver_attach+0xa0/0xa0
[1774475.484077]  [<ffffffff812f8a54>] bus_for_each_drv+0x54/0x90
[1774475.484093]  [<ffffffff812fa598>] device_attach+0x98/0xb0
[1774475.484109]  [<ffffffff812f9a98>] bus_probe_device+0x98/0xc0
[1774475.484125]  [<ffffffff812f7ea4>] device_add+0x5b4/0x670
[1774475.484141]  [<ffffffffa019904b>] ? usb_set_device_state+0xab/0x180 [usbcore]
[1774475.484162]  [<ffffffffa01a4685>] usb_set_configuration+0x5f5/0x810 [usbcore]
[1774475.484184]  [<ffffffffa01ae202>] generic_probe+0x32/0x90 [usbcore]
[1774475.484203]  [<ffffffffa01a64ad>] usb_probe_device+0x2d/0x60 [usbcore]
[1774475.484221]  [<ffffffff812fa646>] driver_probe_device+0x76/0x240
[1774475.484237]  [<ffffffff812fa8fb>] __device_attach+0x4b/0x60
[1774475.484252]  [<ffffffff812fa8b0>] ? __driver_attach+0xa0/0xa0
[1774475.484268]  [<ffffffff812f8a54>] bus_for_each_drv+0x54/0x90
[1774475.484284]  [<ffffffff812fa598>] device_attach+0x98/0xb0
[1774475.484299]  [<ffffffff812f9a98>] bus_probe_device+0x98/0xc0
[1774475.484314]  [<ffffffff812f7ea4>] device_add+0x5b4/0x670
[1774475.484330]  [<ffffffffa019b8c7>] usb_new_device+0x1d7/0x370 [usbcore]
[1774475.484349]  [<ffffffffa019ccdc>] hub_thread+0x69c/0x1420 [usbcore]
[1774475.484368]  [<ffffffff81059f30>] ? abort_exclusive_wait+0xb0/0xb0
[1774475.484386]  [<ffffffffa019c640>] ? hub_port_debounce+0xe0/0xe0 [usbcore]
[1774475.484404]  [<ffffffff810595bb>] kthread+0xbb/0xc0
[1774475.484419]  [<ffffffff81430000>] ? pcpu_dump_alloc_info+0x241/0x261
[1774475.484436]  [<ffffffff81059500>] ? kthread_freezable_should_stop+0x70/0x70
[1774475.484455]  [<ffffffff814361ec>] ret_from_fork+0x7c/0xb0
[1774475.484471]  [<ffffffff81059500>] ? kthread_freezable_should_stop+0x70/0x70
[1774475.484489] Code: 80 8b f0 00 00 00 02 41 83 fd 02 74 37 45 8b ac 24 78 04 00 00 45 85 ed 7e 2a 45 31 ed 48 8b 83 10 02 00 00 49 63 d5 48 8b 3c d0 <48> 83 3f 00 74 05 e8 07 fe ff ff 41 83 c5 01 45 39 ac 24 78 04 
[1774475.484731] RIP  [<ffffffffa019b30e>] hub_quiesce+0x4e/0xb0 [usbcore]
[1774475.484754]  RSP <ffff880426a13828>
[1774475.484763] CR2: 0000000000000000
[1774475.491483] ---[ end trace 2519ebb0249ddfdd ]---
Comment 1 Greg Kroah-Hartman 2013-10-28 19:22:43 UTC 
On Mon, Oct 28, 2013 at 07:13:01PM +0000, bugzilla-daemon@bugzilla.kernel.org wrote:
> https://bugzilla.kernel.org/show_bug.cgi?id=63961
> 
>             Bug ID: 63961
>            Summary: kernel NULL pointer dereference at (null) - inside
>                     hub_disconnect

Please send this to the linux-usb@vger.kernel.org mailing list.
Comment 2 Alan 2013-11-12 16:07:30 UTC 
Humm we have several of these traces in bugzilla  all looking related
Comment 3 Luke-Jr 2013-11-12 18:39:52 UTC 
I can confirm this at least no longer causes a kernel panic in 3.12.0
Comment 4 Luke-Jr 2014-06-14 02:26:20 UTC 
*** Bug 62711 has been marked as a duplicate of this bug. ***