Bug 9111 (evdev)

Summary: kernel oops when unplugging usb mouse, sometimes hardlock when moving mouse
Product: Drivers Reporter: o. meijer (meijer.o)
Component: Input DevicesAssignee: drivers_input-devices
Status: CLOSED CODE_FIX    
Severity: normal CC: andrey+kernel, caster, rjwysocki
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 2.6.23.rc4 - rc9 (vanilla) Subsystem:
Regression: Yes Bisected commit-id:
Bug Depends on:    
Bug Blocks: 9056    

Description o. meijer 2007-10-02 05:34:34 UTC
Most recent kernel where this bug did not occur: 2.6.22.6
Distribution:ubuntu 7.04, custom vanilla kernel
Hardware Environment: Laptop NX5000 
Software Environment:Linux, X
Problem Description:
When using the evdev driver in xorg, see snippet of xorg.conf,a kernel oops occurs when unplugging the mouse.

Steps to reproduce: Low latency dektop, always when unplugging the mouse(both, Logitech+microsoft wireless), hard locks randomly but not very often when moving the mouse. (the problem only occurs when using the xorg-evdev-driver)

snippet of xorg.conf:
Section "InputDevice"
         Identifier "Logitech"
        Driver "evdev"
        Option "evBits"  "+1-2"
        Option "keyBits" "~272-287"
        Option "relBits" "~0-2 ~6 ~8"
         Option "Pass"    "3"
      EndSection

Output of Oops:
usb 1-2.2: USB disconnect, address 5
BUG: unable to handle kernel paging request at virtual address 00100100
 printing eip:
c028a241
*pde = 26959067
*pte = 00000000
Oops: 0000 [#1]
PREEMPT 
Modules linked in: snd_intel8x0m xt_tcpudp i915 drm nf_conntrack_ipv4 xt_state nf_conntrack iptable_filter ip_tables x_tables ipv6 ppdev speedstep_centrino cpufreq_conservative cpufreq_performance cpufreq_ondemand freq_table cpufreq_powersave sbp2 scsi_mod lp fuse usblp af_packet snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss pcmcia snd_seq_midi snd_rawmidi snd_seq_midi_event ohci1394 snd_seq ide_cd snd_timer ieee1394 b44 mii ipw2200 joydev cdrom snd_seq_device yenta_socket rsrc_nonstatic ieee80211 ieee80211_crypt pcmcia_core snd 8250_pci soundcore snd_page_alloc button ehci_hcd serio_raw parport_pc parport uhci_hcd 8250_pnp 8250 serial_core intel_agp pcspkr unix vfat fat
CPU:    0
EIP:    0060:[<c028a241>]    Not tainted VLI
EFLAGS: 00010206   (2.6.23-rc9-om-v3.14 #1)
EIP is at evdev_disconnect+0x91/0xd0
eax: 00000000   ebx: 000ffcf0   ecx: ef7b4000   edx: 00000033
esi: eed2724c   edi: eed27200   ebp: eed27254   esp: ef7b5e84
ds: 007b   es: 007b   fs: 0000  gs: 0000  ss: 0068
Process khubd (pid: 185, ti=ef7b4000 task=ef791ab0 task.ti=ef7b4000)
Stack: eed73a00 ecaa8f58 ecaa8800 ecaa8f6c ec36b458 c0287f76 00000000 c039bea0 
       ec36b458 c0273dfe ec3e6c58 ec71ab40 ec3e6c58 c02959d1 ec7b1000 ec3e6000 
       c039bea0 c0299319 eece2e00 eece2e1c c0277368 eece2e1c c039bed0 eece2e84 
Call Trace:
 [<c0287f76>] input_unregister_device+0x86/0x120
 [<c0273dfe>] usb_kill_urb+0x4e/0x100
 [<c02959d1>] hidinput_disconnect+0x41/0x60
 [<c0299319>] hid_disconnect+0xb9/0xd0
 [<c0277368>] usb_unbind_interface+0x38/0x90
 [<c025a0a4>] __device_release_driver+0x64/0xa0
 [<c025a4dd>] device_release_driver+0x1d/0x40
 [<c025999d>] bus_remove_device+0x4d/0x80
 [<c0257e1a>] device_del+0x12a/0x240
 [<c0274838>] usb_disable_device+0x78/0xe0
 [<c02705e4>] usb_disconnect+0x94/0x100
 [<c0270a29>] hub_thread+0x239/0xc40
 [<c012d8a0>] autoremove_wake_function+0x0/0x50
 [<c02707f0>] hub_thread+0x0/0xc40
 [<c012d582>] kthread+0x42/0x70
 [<c012d540>] kthread+0x0/0x70
 [<c01044ff>] kernel_thread_helper+0x7/0x18
 =======================
Code: 00 00 00 8d bc 27 00 00 00 00 8d 83 08 04 00 00 b9 06 00 02 00 ba 1d 00 00 00 e8 ab 5e ee ff 8b 9b 10 04 00 00 81 eb 10 04 00 00 <8b> 83 10 04 00 00 0f 18 00 90 8d 83 10 04 00 00 39 f0 75 cb 8d 
EIP: [<c028a241>] evdev_disconnect+0x91/0xd0 SS:ESP 0068:ef7b5e84
meijero@meijero-laptop:~$ 


lspci:
meijero@meijero-laptop:/proc$ lspci
00:00.0 Host bridge: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02)
00:00.1 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02)
00:00.3 System peripheral: Intel Corporation 82852/82855 GM/GME/PM/GMV Processor to I/O Controller (rev 02)
00:02.0 VGA compatible controller: Intel Corporation 82852/855GM Integrated Graphics Device (rev 02)
00:02.1 Display controller: Intel Corporation 82852/855GM Integrated Graphics Device (rev 02)
00:1d.0 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #1 (rev 01)
00:1d.1 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #2 (rev 01)
00:1d.2 USB Controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) USB UHCI Controller #3 (rev 01)
00:1d.7 USB Controller: Intel Corporation 82801DB/DBM (ICH4/ICH4-M) USB2 EHCI Controller (rev 01)
00:1e.0 PCI bridge: Intel Corporation 82801 Mobile PCI Bridge (rev 81)
00:1f.0 ISA bridge: Intel Corporation 82801DBM (ICH4-M) LPC Interface Bridge (rev 01)
00:1f.1 IDE interface: Intel Corporation 82801DBM (ICH4-M) IDE Controller (rev 01)
00:1f.5 Multimedia audio controller: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Audio Controller (rev 01)
00:1f.6 Modem: Intel Corporation 82801DB/DBL/DBM (ICH4/ICH4-L/ICH4-M) AC'97 Modem Controller (rev 01)
01:04.0 Network controller: Intel Corporation PRO/Wireless 2200BG Network Connection (rev 05)
01:06.0 CardBus bridge: Texas Instruments PCI7420 CardBus Controller
01:06.1 CardBus bridge: Texas Instruments PCI7420 CardBus Controller
01:0d.0 FireWire (IEEE 1394): Texas Instruments TSB43AB22/A IEEE-1394a-2000 Controller (PHY/Link)
01:0e.0 Ethernet controller: Broadcom Corporation BCM4401-B0 100Base-TX (rev 02)
meijero@meijero-laptop:/proc$
Comment 1 Dmitry Torokhov 2007-10-02 06:33:32 UTC
Any chance you could try -mm? The input core lockign patches are there and are scheduled to be merged in mainline when 2.6.24 opens up.
Comment 2 Andrey Melentyev 2007-11-08 11:41:27 UTC
The bug is also reproducable on my system:

usb 2-1: USB disconnect, address 2
BUG: unable to handle kernel paging request at virtual address 00100100
 printing eip:
f88158a1
*pde = 35eeb067
*pte = 00000000
Oops: 0000 [#1]
PREEMPT 
Modules linked in: via drm wlan_tkip wlan_ccmp snd_pcm_oss snd_mixer_oss snd_seq_oss snd_seq_midi_event snd_seq fuse loop configs rfkill_input rfkill cpufreq_ondemand speedstep_centrino freq_table wlan_scan_sta ath_rate_sample ath_pci wlan ath_hal(P) usbhid hid snd_via82xx_modem snd_via82xx snd_ac97_codec snd_mpu401_uart ac97_bus snd_rawmidi snd_seq_device snd_pcm snd_timer snd fan ac yenta_socket thermal ehci_hcd rsrc_nonstatic uhci_hcd via_agp soundcore battery button agpgart pcmcia_core processor usbcore via_rhine mii evdev snd_page_alloc
CPU:    0
EIP:    0060:[<f88158a1>]    Tainted: P        VLI
EFLAGS: 00010206   (2.6.23-gentoo-r1 #4)
EIP is at evdev_disconnect+0x91/0xd0 [evdev]
eax: 00000000   ebx: 000ffcf0   ecx: 10000000   edx: 00000000
esi: f7908a4c   edi: f7908a00   ebp: f7908a54   esp: f7979e74
ds: 007b   es: 007b   fs: 0000  gs: 0000  ss: 0068
Process khubd (pid: 1263, ti=f7979000 task=f79ce000 task.ti=f7979000)
Stack: f7ac7200 f745a770 f745a000 f745a784 00000000 c0272636 00000000 c01282ab 
       f7979000 f7479c48 f7addc58 f7a571d0 f7addc58 f8907631 f7479000 f7add000 
       f7a8b01c f894339a f7a8b000 f7a8b01c f8947340 f88595e0 f792f800 f7a8b01c 
Call Trace:
 [<c0272636>] input_unregister_device+0x86/0x120
 [<c01282ab>] lock_timer_base+0x3b/0x80
 [<f8907631>] hidinput_disconnect+0x41/0x60 [hid]
 [<f894339a>] hid_disconnect+0xca/0xe0 [usbhid]
 [<f88595e0>] usb_unbind_interface+0x50/0xb0 [usbcore]
 [<c023fa24>] __device_release_driver+0x64/0xa0
 [<c023fe5d>] device_release_driver+0x1d/0x40
 [<c023f31d>] bus_remove_device+0x4d/0x80
 [<c023d7c0>] device_del+0x130/0x240
 [<f88565da>] usb_disable_device+0x7a/0xe0 [usbcore]
 [<f88520b6>] usb_disconnect+0x96/0x140 [usbcore]
 [<f8852585>] hub_thread+0x315/0xc90 [usbcore]
 [<c02e2360>] schedule+0x2a0/0x470
 [<c0133290>] autoremove_wake_function+0x0/0x40
 [<f8852270>] hub_thread+0x0/0xc90 [usbcore]
 [<c0132f82>] kthread+0x42/0x70
 [<c0132f40>] kthread+0x0/0x70
 [<c0104d73>] kernel_thread_helper+0x7/0x14
 =======================
Code: 00 00 00 8d bc 27 00 00 00 00 8d 83 08 04 00 00 b9 06 00 02 00 ba 1d 00 00 00 e8 3b 0f 96 c7 8b 9b 10 04 00 00 81 eb 10 04 00 00 <8b> 83 10 04 00 00 0f 18 00 90 8d 83 10 04 00 00 39 f0 75 cb 8d 
EIP: [<f88158a1>] evdev_disconnect+0x91/0xd0 [evdev] SS:ESP 0068:f7979e74

----


Dmitry, you say that patches should be merged in 2.6.24, are they already in 2.6.24-rc2? I could try it then.
Comment 3 Dmitry Torokhov 2007-11-08 11:59:32 UTC
They are in both 2.6.24-rc1 and 2.6.24-rc2
Comment 4 Vlastimil Babka 2007-12-12 01:59:53 UTC
Hi,

got exactly the same problem with 2.6.23, and seems that it's fine in 2.6.24-rc4.
Comment 5 o. meijer 2008-01-27 14:20:14 UTC
solved with 2.6.24 for me