Bug 9196

Of course, after this happens, no USB devices works anymore.

Reply-To: akpm@linux-foundation.org

On Sat, 20 Oct 2007 02:10:30 -0700 (PDT) bugme-daemon@bugzilla.kernel.org wrote:

> http://bugzilla.kernel.org/show_bug.cgi?id=9196
> 
>            Summary: BUG on USB disconnect
>            Product: Drivers
>            Version: 2.5
>      KernelVersion: 2.6.23
>           Platform: All
>         OS/Version: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: normal
>           Priority: P1
>          Component: USB
>         AssignedTo: greg@kroah.com
>         ReportedBy: vladimir.kondratiev@intel.com
> 
> 
> Most recent kernel where this bug did not occur:
> Distribution: FC7
> Hardware Environment:
> IBM TP42p. Connected (through dock) are USB mouse and Plantronics 400 headset
> Software Environment:
> This report saying "tainted" kernel; this is due to vmware module; but same
> happens without this module as well; but it occurs rarely, and I have no
> report
> with no vmware modules loaded on hands.
> Problem Description:
> Rarely, when I take laptop out of docking station, I see the following in
> syslog:
> Oct 20 10:27:57 vkondra-mobl kernel: usb 4-1: USB disconnect, address 9
> Oct 20 10:27:57 vkondra-mobl kernel: usb 4-1.1: USB disconnect, address 10
> Oct 20 10:27:57 vkondra-mobl kernel: usb 4-1.3: USB disconnect, address 11
> Oct 20 10:27:57 vkondra-mobl kernel: BUG: unable to handle kernel paging
> request at virtual address 00100100
> Oct 20 10:27:57 vkondra-mobl kernel:  printing eip:
> Oct 20 10:27:57 vkondra-mobl kernel: f89a108a
> Oct 20 10:27:57 vkondra-mobl kernel: *pde = 00000000
> Oct 20 10:27:57 vkondra-mobl kernel: Oops: 0000 [#1]
> Oct 20 10:27:57 vkondra-mobl kernel: PREEMPT
> Oct 20 10:27:57 vkondra-mobl kernel: Modules linked in: snd_usb_audio
> snd_usb_lib snd_rawmidi snd_hwdep aes crypto_algapi ieee80211_crypt_ccmp
> radeon
> drm uinput cpufr
> eq_stats cpufreq_conservative cpufreq_powersave cpufreq_ondemand acpi_cpufreq
> freq_table microcode autofs4 hidp rfcomm l2cap bluetooth vmnet(P) vmblock(P)
> vmmon(P) su
> nrpc ipv6 binfmt_misc dm_mod fan container bay dock pcmcia crc32
> snd_intel8x0m
> snd_intel8x0 snd_seq_dummy snd_ac97_codec ac97_bus snd_seq_oss
> snd_seq_midi_event snd_s
> eq floppy snd_seq_device joydev snd_pcm_oss snd_mixer_oss parport_pc snd_pcm
> parport thinkpad_acpi hwmon ipw2200 backlight snd_timer usbhid nvram snd
> yenta_socket iee
> e80211 e1000 battery rsrc_nonstatic ac ieee80211_crypt hid pcmcia_core
> firmware_class evdev ide_cd soundcore cdrom thermal i2c_i801 button
> snd_page_alloc psmouse i2c_
> core rng_core intel_agp agpgart rtc ata_piix libata piix generic ide_disk
> ide_core ehci_hcd ohci_hcd uhci_hcd usbcore
> Oct 20 10:27:57 vkondra-mobl kernel: CPU:    0
> Oct 20 10:27:58 vkondra-mobl kernel: EIP:    0060:[<f89a108a>]    Tainted: P  
>     VLI
> Oct 20 10:27:58 vkondra-mobl kernel: EFLAGS: 00010246   (2.6.23 #5)
> Oct 20 10:27:58 vkondra-mobl kernel: EIP is at
> snd_ctl_dev_disconnect+0x4b/0x7c
> [snd]
> Oct 20 10:27:58 vkondra-mobl kernel: eax: de799fa0   ebx: 00100100   ecx:
> 00020004   edx: 0000001d
> Oct 20 10:27:58 vkondra-mobl kernel: esi: d34b0600   edi: d34b074c   ebp:
> eb40b000   esp: c1a93e14
> Oct 20 10:27:58 vkondra-mobl kernel: ds: 007b   es: 007b   fs: 0000  gs: 0000 
> ss: 0068
> Oct 20 10:27:58 vkondra-mobl kernel: Process khubd (pid: 857, ti=c1a92000
> task=f7d8cf90 task.ti=c1a92000)
> Oct 20 10:27:58 vkondra-mobl kernel: Stack: 00000000 d6452000 d34b0600
> 00000000
> f89a2be0 d739fe5c d6452000 d34b0600
> Oct 20 10:27:58 vkondra-mobl kernel:        f89a2e0f 00000000 d34b0600
> f8df9340
> f899fc93 c02873a7 f884b963 d739fe00
> Oct 20 10:27:58 vkondra-mobl kernel:        de5eeec0 f8dea626 d34b0600
> d739fe00
> d739fe1c f8df9340 eb40b000 f884c60a
> Oct 20 10:27:58 vkondra-mobl kernel: Call Trace:
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f89a2be0>]
> snd_device_disconnect+0x28/0x60 [snd]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f89a2e0f>]
> snd_device_disconnect_all+0x19/0x3e [snd]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f899fc93>]
> snd_card_disconnect+0x170/0x194 [snd]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c02873a7>] klist_release+0x0/0x30
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f884b963>]
> usb_autopm_do_device+0xc7/0xd1 [usbcore]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f8dea626>]
> usb_audio_disconnect+0x44/0xea [snd_usb_audio]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f884c60a>]
> usb_unbind_interface+0x44/0x94 [usbcore]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c0213497>]
> __device_release_driver+0x6e/0x8b
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c0213801>]
> device_release_driver+0x1d/0x32
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c0212eaa>]
> bus_remove_device+0x5b/0x69
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c0211a09>] device_del+0x194/0x205
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f8849bf8>]
> usb_disable_device+0xdd/0x144 [usbcore]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f884540b>] usb_disconnect+0xbe/0x160
> [usbcore]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f88453d5>] usb_disconnect+0x88/0x160
> [usbcore]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f8846517>] hub_thread+0x5ea/0xe8e
> [usbcore]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c0124e3b>]
> autoremove_wake_function+0x0/0x35
> Oct 20 10:27:58 vkondra-mobl kernel:  [<f8845f2d>] hub_thread+0x0/0xe8e
> [usbcore]
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c0124d82>] kthread+0x36/0x5c
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c0124d4c>] kthread+0x0/0x5c
> Oct 20 10:27:58 vkondra-mobl kernel:  [<c01040f3>]
> kernel_thread_helper+0x7/0x10
> Oct 20 10:27:58 vkondra-mobl kernel:  =======================
> Oct 20 10:27:58 vkondra-mobl kernel: Code: 18 b9 01 00 00 00 ba 03 00 00 00
> c7
> 04 24 00 00 00 00 e8 5a 16 77 c7 8d 43 20 b9 04 00 02 00 ba 1d 00 00 00 e8 33
> 04 7c c7
> 8b 1b <8b> 03 0f 18 00 90 8d 86 68 01 00 00 39 c3 75 c3 89 f8 e8 25 6f
> Oct 20 10:27:58 vkondra-mobl kernel: EIP: [<f89a108a>]
> snd_ctl_dev_disconnect+0x4b/0x7c [snd] SS:ESP 0068:c1a93e14
> 
> 

Seems that khubd oopsed inside ALSA code.

I have something similar with a Logitech mouse dongle.

usb 2-1: USB disconnect, address 2
BUG: unable to handle kernel paging request at virtual address 00100100
 printing eip:
f9010640
*pde = 00000000
Oops: 0000 [#1]
PREEMPT 
Modules linked in: i915 michael_mic arc4 ecb ieee80211_crypt_tkip ipv6 af_packet snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss sco rfcomm l2cap bcm203x hci_usb bluetooth ipw2200 ieee80211 ieee80211_crypt cpufreq_powersave cpufreq_performance cpufreq_ondemand cpufreq_conservative acpi_cpufreq freq_table fuse yenta_socket rsrc_nonstatic pcmcia_core button snd_hda_intel rng_core i2c_i801 snd_pcm snd_timer snd_page_alloc psmouse rtc evdev unix tg3 xfs nfs nfs_acl lockd sunrpc reiserfs ext2 raid10 raid456 async_memcpy async_xor xor async_tx raid1 raid0 md_mod dm_bbr dm_snapshot dm_mirror dm_mod scsi_wait_scan sbp2 ohci1394 usbhid uhci_hcd usb_storage scsi_mod hid ff_memless ehci_hcd
CPU:    0
EIP:    0060:[<f9010640>]    Not tainted VLI
EFLAGS: 00010206   (2.6.23-tuxonice-r9 #1)
EIP is at evdev_disconnect+0x5b/0x96 [evdev]
eax: 00000000   ebx: 000ffcf0   ecx: f301c6b4   edx: 00000033
esi: f7ca2800   edi: f7ca2854   ebp: dfdad400   esp: c2133e90
ds: 007b   es: 007b   fs: 0000  gs: 0000  ss: 0068
Process khubd (pid: 166, ti=c2132000 task=f7f82ab0 task.ti=c2132000)
Stack: dfde2e00 dff34800 dff34f58 dfd3f000 c02732d3 00000000 dfdad400 c0262602 
       00000286 dfde43e0 dfd3fc58 f8845298 dfd37000 dfd3f000 f88d4d80 f88cd2c5 
       dfd30800 dfd3081c c0265541 00000000 dfd3081c f88d4db0 00000000 dfdad458 
Call Trace:
 [<c02732d3>] input_unregister_device+0x67/0xfc
 [<c0262602>] usb_kill_urb+0x4e/0xc9
 [<f8845298>] hidinput_disconnect+0x2e/0x47 [hid]
 [<f88cd2c5>] hid_disconnect+0x7e/0xcf [usbhid]
 [<c0265541>] usb_unbind_interface+0x44/0x93
 [<c02394c3>] __device_release_driver+0x6e/0x8b
 [<c023982d>] device_release_driver+0x1d/0x32
 [<c0238ee0>] bus_remove_device+0x6a/0x7a
 [<c0237731>] device_del+0x1bd/0x22e
 [<c0262e79>] usb_disable_device+0x5c/0xbb
 [<c025f3c4>] usb_disconnect+0x82/0x11f
 [<c025f945>] hub_thread+0x37c/0xa86
 [<c0128333>] autoremove_wake_function+0x0/0x35
 [<c025f5c9>] hub_thread+0x0/0xa86
 [<c012827a>] kthread+0x36/0x5c
 [<c0128244>] kthread+0x0/0x5c
 [<c0104897>] kernel_thread_helper+0x7/0x10
 =======================
Code: e8 3d 1b 26 c7 8b 5e 4c eb 1b 8d 83 08 04 00 00 b9 06 00 02 00 ba 1d 00 00 00 e8 8c d7 15 c7 8b 9b 10 04 00 00 81 eb 10 04 00 00 <8b> 83 10 04 00 00 0f 18 00 90 8d 93 10 04 00 00 8d 46 4c 39 c2 
EIP: [<f9010640>] evdev_disconnect+0x5b/0x96 [evdev] SS:ESP 0068:c2133e90

And again with a HID (Wacom Bamboo). The driver is from the kerneltree.
From dmesg:

usb 2-1: USB disconnect, address 2
BUG: unable to handle kernel paging request at virtual address 00100100
 printing eip:
f9010640
*pde = 36e13067
*pte = 00000000
Oops: 0000 [#1]
PREEMPT 
Modules linked in: i915 usbmouse wacom michael_mic arc4 ecb ieee80211_crypt_tkip
 ipv6 af_packet snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss sco rfcomm l2ca
p bcm203x hci_usb bluetooth ipw2200 ieee80211 ieee80211_crypt cpufreq_powersave 
cpufreq_performance cpufreq_ondemand cpufreq_conservative acpi_cpufreq freq_tabl
e fuse yenta_socket rsrc_nonstatic pcmcia_core button i2c_i801 psmouse rng_core 
snd_hda_intel snd_pcm snd_timer snd_page_alloc rtc evdev unix tg3 xfs nfs nfs_ac
l lockd sunrpc reiserfs ext2 raid10 raid456 async_memcpy async_xor xor async_tx 
raid1 raid0 md_mod dm_bbr dm_snapshot dm_mirror dm_mod scsi_wait_scan sbp2 ohci1
394 usbhid uhci_hcd usb_storage scsi_mod hid ff_memless ehci_hcd
CPU:    0
EIP:    0060:[<f9010640>]    Not tainted VLI
EFLAGS: 00010206   (2.6.23-tuxonice-r9 #1)
EIP is at evdev_disconnect+0x5b/0x96 [evdev]
eax: 00000000   ebx: 000ffcf0   ecx: f7fae760   edx: 00000033
esi: c23e0e00   edi: c23e0e54   ebp: f6f9e800   esp: c212de9c
ds: 007b   es: 007b   fs: 0000  gs: 0000  ss: 0068
Process khubd (pid: 166, ti=c212c000 task=f7fae570 task.ti=c212c000)
Stack: c23e0c00 f5914000 f5914758 f923d6e0 c02732d3 00000000 c026497b c02d081e 
       c23e0854 f6661e00 c23e0800 f923b453 c23e081c c23e0800 c23e081c c0265541 
       00000000 c23e081c f923d710 00000000 f6f9e858 c02394c3 c23e081c c23e081c 
Call Trace:
 [<c02732d3>] input_unregister_device+0x67/0xfc
 [<c026497b>] usb_autopm_do_device+0xc7/0xd1
 [<c02d081e>] klist_release+0x27/0x30
 [<f923b453>] wacom_disconnect+0x2b/0x66 [wacom]
 [<c0265541>] usb_unbind_interface+0x44/0x93
 [<c02394c3>] __device_release_driver+0x6e/0x8b
 [<c023982d>] device_release_driver+0x1d/0x32
 [<c0238ee0>] bus_remove_device+0x6a/0x7a
 [<c0237731>] device_del+0x1bd/0x22e
 [<c0262e79>] usb_disable_device+0x5c/0xbb
 [<c025f3c4>] usb_disconnect+0x82/0x11f
 [<c025f945>] hub_thread+0x37c/0xa86
 [<c0128333>] autoremove_wake_function+0x0/0x35
 [<c025f5c9>] hub_thread+0x0/0xa86
 [<c012827a>] kthread+0x36/0x5c
 [<c0128244>] kthread+0x0/0x5c
 [<c0104897>] kernel_thread_helper+0x7/0x10
 =======================
Code: e8 3d 1b 26 c7 8b 5e 4c eb 1b 8d 83 08 04 00 00 b9 06 00 02 00 ba 1d 00 00
 00 e8 8c d7 15 c7 8b 9b 10 04 00 00 81 eb 10 04 00 00 <8b> 83 10 04 00 00 0f 18
 00 90 8d 93 10 04 00 00 8d 46 4c 39 c2 
EIP: [<f9010640>] evdev_disconnect+0x5b/0x96 [evdev] SS:ESP 0068:c212de9c

R. Bosch: your bug is unrelated, please take it elsewhere

Gentoo have an identical bug report here:
https://bugs.gentoo.org/show_bug.cgi?id=210748

Direct link to oops:
https://bugs.gentoo.org/attachment.cgi?id=144010&action=view
It has the same trace and even the same EBX reg value

Google found 2 more identical ones:
http://www.mail-archive.com/linux-usb-devel@lists.sourceforge.net/msg48577.html
http://lkml.org/lkml/2007/10/29/57

Reassigning to ALSA maintainers

Hi,

I followed the instructions of the bug on the gentoo bugzilla to find out the affected line of code. This is the result:

arcadis linux # gdb sound/core/control.o
GNU gdb 6.6
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) list *snd_ctl_dev_disconnect+0x17
0x1bec is in snd_ctl_dev_disconnect (include/asm/processor_32.h:746).
741        because they are microcoded there and very slow.
742        However we don't do prefetches for pre XP Athlons currently
743        That should be fixed. */
744     #define ARCH_HAS_PREFETCH
745     static inline void prefetch(const void *x)
746     {
747             alternative_input(ASM_NOP4,
748                               "prefetchnta (%1)",
749                               X86_FEATURE_XMM,
750                               "r" (x));
(gdb)

(In reply to comment #5)
> R. Bosch: your bug is unrelated, please take it elsewhere

Sorry. I thought that it was USB related instead of alsa.

I can confirm that with v2.6.26 (kernel.org / linus' git) when enabling PREEMPT I got the same oops with either of these:

- putting laptop (a ThinkPad T61) to sleep (it wakes up, but subsequently won't go to sleep anymore and needs to be rebooted)
- stopping alsa and(/or) rmmod'ing some modules (I wrote a script to stop most services from /etc/rc2.d/ and rmmod's all modules which then have a zero use count, in the hope that sleep wouldn't oops anymore, but my success was such that the oops then happened already when running this script; also it left alsamixer which was open on that usb device hanging in D state). In that latter case I got dozens/hundreds of lines saying "cannot submit datapipe for urb 0, error -19: no device" before the oops ("BUG: unable to handle kernel paging request at 0000000000100100", "IP: .. :snd:snd_ctl_dev_disconnect+0x5b/0xa0")

I haven't seen the oops with kernels (before and also including 2.6.26 so far) compiled with PREEMPT_VOLUNTARY instead of PREEMPT. (Although I've seen random hangs when going to or waking up from sleep, but those don't seem to be related to usb audio as they also happened in cases when the usb audio device was not connected.)