I seem to have a similar problem when unplugging a Nokia 6234 from my Thinkpad
T42 (kernel 2.6.18 Debian stock), see also:
http://article.gmane.org/gmane.linux.usb.devel/46605/match=nokia+6280

My dmesg:

rndis_host 2-1:1.9: RNDIS init failed, -110
usb%d: unregister 'rndis_host' usb-0000:00:1d.1-1, RNDIS device
unregister_netdevice: device usb%d/f6fa8800 never was registered
------------[ cut here ]------------
kernel BUG at mm/slab.c:595!
invalid opcode: 0000 [#1]
SMP
Modules linked in: rndis_host cdc_ether usbnet nls_cp437 vfat fat isofs nls_utf8
 udf sd_mod usb_storage scsi_mod radeon drm binfmt_misc ipv6 video sbs ibm_acpi
i2c_ec dock button battery container ac asus_acpi pcmcia firmware_class wlan_wep
 fuse nvram hdaps speedstep_centrino freq_table cpufreq_ondemand ide_generic wla
n_scan_sta ath_pci ath_rate_sample wlan ath_hal yenta_socket rsrc_nonstatic pcmc
ia_core intel_rng irtty_sir sir_dev joydev nsc_ircc irda psmouse serio_raw crc_c
citt snd_intel8x0m snd_pcm_oss snd_mixer_oss shpchp pci_hotplug snd_intel8x0 snd
_ac97_codec snd_ac97_bus parport_pc parport intel_agp agpgart i2c_i801 tsdev i2c
_core pcspkr evdev floppy rtc snd_pcm snd_timer snd soundcore snd_page_alloc ext
3 jbd mbcache dm_mirror dm_snapshot dm_mod ide_cd cdrom ide_disk usbhid piix e10
00 generic ide_core ehci_hcd uhci_hcd usbcore thermal processor fan
CPU:    0
EIP:    0060:[<c015521b>]    Tainted: P      VLI
EFLAGS: 00010046   (2.6.18-1-686 #1)
EIP is at kfree+0x2e/0x65
eax: 80000000   ebx: f6fa8ac0   ecx: dffff7c0   edx: c16df440
esi: 00000282   edi: f6fa2392   ebp: f6fa8800   esp: f6fd1e18
ds: 007b   es: 007b   ss: 0068
Process modprobe (pid: 4089, ti=f6fd0000 task=f6f58030 task.ti=f6fd0000)
Stack: f6fa8ac0 f8e1960e f6fa8806 f8e1901a f6f3b400 f8e5d6a0 f6efd2c8 f6f56c00
       ffffff92 c18d6000 00000000 00000000 00000001 00000001 00000001 00000001
       f8e5d660 f6f3b400 f8e5e520 f8e5e550 c020eae8 f886bba9 f6f3b414 f6f3b414
Call Trace:
 [<f8e1901a>] usbnet_probe+0x4ee/0x503 [usbnet]
 [<c020eae8>] __driver_attach+0x0/0x5d
 [<f886bba9>] usb_probe_interface+0x58/0x87 [usbcore]
 [<c020ea49>] driver_probe_device+0x42/0x8b
 [<c020eb20>] __driver_attach+0x38/0x5d
 [<c020e56a>] bus_for_each_dev+0x33/0x55
 [<c020e9b3>] driver_attach+0x11/0x13
 [<c020eae8>] __driver_attach+0x0/0x5d
 [<c020e283>] bus_add_driver+0x64/0xfd
 [<f886b9de>] usb_register_driver+0x60/0xbb [usbcore]
 [<c0135814>] sys_init_module+0x169e/0x1821
 [<c0102c11>] sysenter_past_esp+0x56/0x79
Code: 56 89 c7 53 74 58 9c 5e fa 8d 90 00 00 00 40 c1 ea 0c c1 e2 05 03 15 70 b3
 36 c0 8b 02 f6 c4 40 74 03 8b 52 0c 8b 02 84 c0 78 08 <0f> 0b 53 02 e5 8d 29 c0
 89 e0 8b 4a 18 25 00 e0 ff ff 8b 40 10
EIP: [<c015521b>] kfree+0x2e/0x65 SS:ESP 0068:f6fd1e18
 <6>agpgart: Found an AGP 2.0 compliant device at 0000:00:00.0.

I can provide any info needed.

Kind regards,

Alex

BTW, disabling cdc_ether, cdc-acm seems to solve the issue, see:

http://lkml.org/lkml/2006/9/26/72

Answering #2 above,

It works in USB-storage mode, OK. The problem, as stated, is when I select "PC
Suite".

We are not trying to get rid of the bug, we are trying to get at some
functionality that is supposed to wrok.

I can confirm this bug exists also with Nokia E61.

I have a similar problem with Nokia 6280 and the supplied data cable, using
cdc-acm with ppp.

The interesting thing though is that it works fine on another PC. This other PC
is an older laptop witrh USB 1 (not 2), and also running an older kernel:
$ uname -a
Linux piglet 2.6.16-gentoo-r7 #17 PREEMPT Fri Aug 25 16:13:13 WAT 2006 i686
Mobile Intel(R) Celeron(TM) CPU         1333MHz GNU/Linux

On my new PC it works fine most of the time, but when its downloading a large
file and getting good bandwidth, it locks up the kernel, and I have to push the
reset button.

The "new PC" is:
Linux trotter 2.6.17-gentoo-r8 #13 SMP Thu Oct 26 13:38:19 SAST 2006 i686
Intel(R) Pentium(R) D CPU 3.40GHz GNU/Linux

I suspect it has something to do with USB 2.0 and also with faster processors.
This PC is a dual core Pentium. Motherboard is MSI, chipset is Intel.

Feel free to email me, and please tell me about workarounds
epailty@googlemail.com

Confirming with Nokia N91, in both 2.6.18 and 2.6.18.1.  The errors always
appear on all xterms and consoles, but despite this, sometimes the ttyACM0
device gets created and then it's functional.  Only once, I got a hard crash.

The problem doesn't seem to exist with 2.6.17.13 on the same machine (using it
right now).

(distro is Debian/unstable, but all kernels I checked are built by me from
official kernel.org sources).

I can confirm the bug on 2.6.18-1 (FC), 2.6.17.14 (vanilla), and unfortunately
also 2.6.17.13 (vanilla). On 2.6.17.13 and 2.6.17.14 it doesn't occur
immediately upon connecting the Nokia phone in its "modem" mode, but only after
the phone is disconnected from USB.

Last perfectly working version of cdc_acm on exactly the same hw, I've seen, was
on an aging 2.4.27 vanilla kernel. It's really a pain debugging and/or testing
this bug, since it almost always provides a hard freeze of the machine. I will
try older 2.6 builds further on, once time permits.

Hi, I can confirm that bug with Nokia E60 and Kernel 2.6.18.3

I'd like to confirm this bug with Debian Etch ("testing") and Debian kernel
2.6.17  and Nokia 6280.

I connect the Nokia as a storage device and manage to manipulate the files in
memory and the internal MiniSD card. Then I can also "stop" the device and even
tell the Nokia to get out of "storage mode". The problems occur when I
disconnect the phone from the USB cable - then I get OOPS's and many times a
complete freeze. I'll try to get a sample output of the OOPS here.

I can now confirm exactly same behavior (cdc-acm module freezes the whole
machine) on:
2.6.16.1
2.6.17.13
2.6.17.14
2.6.18
2.6.18.2

Only partial luck w 2.6.11. Device using cdc-acm module can be connected and
disconnected w/out kernel freezing the whole machine, however "Oopses" still DO
OCCUR upon disconnect.

Last fully working kernel, I've seen w cdc-acm module, was:
2.4.27

Please let me know, if I could help with w more testing. Pity that the bug is
still unassigned. Perhaps the original maintainer of cdc-acm could help us here?

I can confirm this is happening on ubuntu edgy, 2.6.17-10 and 2.6.17-13. The
hardware is a Nokia 9300 phone.

My laptop basically freezes up at this point.. note i have some extra logging I
put into the module..

Dec 12 02:31:09 localhost kernel: [17179649.972000] usb 1-1: new full speed USB
device using uhci_hcd and address 2
Dec 12 02:31:09 localhost kernel: [17179650.132000] usb 1-1: Product: Nokia 9300
(RNDIS)
Dec 12 02:31:09 localhost kernel: [17179650.132000] usb 1-1: Manufacturer: Nokia
Dec 12 02:31:09 localhost kernel: [17179650.132000] usb 1-1: choose_config: 0,
class: 2, iface: 2, proto: 255, maxPower: 50, bus_ma: 500
Dec 12 02:31:09 localhost kernel: [17179650.132000] usb 1-1: ndis device found!
: 0, class: 2
Dec 12 02:31:09 localhost kernel: [17179650.132000] usb 1-1: configuration #1
chosen from 1 choice
Dec 12 02:31:10 localhost kernel: [17179650.304000] usbcore: registered new
driver cdc_ether
Dec 12 02:31:12 localhost kernel: [17179653.260000] usb 1-1: USB disconnect,
address 2
Dec 12 02:31:13 localhost kernel: [17179653.308000] usb%%d: unregister
'rndis_host' usb-0000:00:1d.0-1, RNDIS device
Dec 12 02:31:13 localhost kernel: [17179653.308000] rndis_host: probe of 1-1:1.0
failed with error -110

drivers/usb/core/hub.c:
1234 #ifndef CONFIG_USB_NET_RNDIS
1235                         continue;
1236 #else
1237                         best = c;
1238 #endif

I dont see any defines of that sort in ubuntu, I had to make that a #if 1 to
force usb to setup my nokia phone's rndis configuration (and subsequently hang).
Did anyone else have to do this?

FWIW, it seems my comment #12 has been fixed in 2.6.19.1. Anyone have luck
reproducing this bug with this kernel?

I have the same issue with my Nokia 6280 cellphone. My machine is an Intel
Centrino Laptop running Ubuntu 6.10

Created attachment 10017 [details]
2.6.19.1 kernel bugtrace

Does not hang the machine as with older kernels, just renders the USB detection
system non-working for any newly connected device.

Kernel 2.6.19.1 did indeed fix something. Nokia 6280 now works with the cdc-acm
module and the crashes are _almost_ gone. The toll is a non-working USB
subsystem however.

Upon connecting the phone once, it causes serveral things:
*kernel bug is encountered, see trace in
http://bugzilla.kernel.org/attachment.cgi?id=10017&action=view
*USB auto-detection stops working for any newly connected device
*only devices with modules already in the kernel do work ok
*Nokia phone must not be disconnected, otherwise the functionality is lost and a
machine reboot needed for the kernel to have functional /dev/ttyACM0 device again
*occasional system hangs still occur, however now after days of ppp connection
running through the phone, rather than hours or minutes as before
*the phone must not be connected upon machine boot, otherwise the system hangs
immediately after startup of udev subsystem

As for #13 from Ram. I can neither confirm, nor deny your observation, since I'm
not familiar with the RNDIS interaction and the cdc-acm module. However no
change in the source code of vanilla 2.6.19.1 was needed, only a plain recompile
using the old config brought me this slight improvement.

Sorry to spoil the optimistic mood, but my computer seizes up with 2.6.20-rc4,
just as described in the original bug.

I guess this is related:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=217488

Created attachment 10093 [details]
bug fix for rdnis_host module

I prepared a bug fix for driver rndis_host which fixes rndis_host probing certain 
Nokia S60 (Series 60) mobiles. While the rndis_host get probed by usbnet
and tries to bind the Nokia mobile the bind is going to fail. The
rndis_host module tries to release the device, in a wrong way, which
cause the oops.

Feel free to give it a try.

This patch fixes the problem for me.

Looks like the patch is in mainline already, right Daniel?
I guess this bug can be closed then.
--Natalie

Yes - the patch is already in mainline.
Since 2.6.20 iirc...