On Friday 21 February 2003 17:21, Greg KH wrote: > On Fri, Feb 21, 2003 at 12:34:13PM +0100, Duncan Sands wrote: > > I get an oops on shutdown with 2.4.20 (speedtouch driver). Here is what > > happens: > > > > probe method called: I take a reference to the usb device with > > usb_inc_dev_use > > > > (machine shutting down - shutdown of usb subsystem) > > > > disconnect called > > > > (still have the reference) > > > > ...time passes... > > > > final driver shutdown: I drop the reference using usb_dec_dev_use, which > > oopses. > > What's the backtrace from the oops? > > Personally I wouldn't trust the reference counting logic in 2.4, it just > doesn't seem right, but I haven't spent the time in looking too deeply > at it, unlike 2.5.
Hi Greg, I went and got a new one for your debugging pleasure! It is the dev->bus->op->deallocate(dev) that kills things. What happens seems to be this: disconnect is called on the speedtch driver, then uhci is unloaded, then speedtch drops its reference to the usb device, which causes havoc. Duncan. 00000fcc <usb_free_dev>: void usb_free_dev(struct usb_device *dev) { fcc: 53 push %ebx fcd: 8b 5c 24 08 mov 0x8(%esp,1),%ebx static __inline__ int atomic_dec_and_test(atomic_t *v) { unsigned char c; __asm__ __volatile__( fd1: ff 4b 20 decl 0x20(%ebx) fd4: 0f 94 c0 sete %al if (atomic_dec_and_test(&dev->refcnt)) { fd7: 84 c0 test %al,%al fd9: 74 29 je 1004 <usb_free_dev+0x38> dev->bus->op->deallocate(dev); fdb: 8b 83 cc 00 00 00 mov 0xcc(%ebx),%eax fe1: 8b 40 1c mov 0x1c(%eax),%eax fe4: 53 push %ebx fe5: 8b 40 04 mov 0x4(%eax),%eax <=== Here fe8: ff d0 call *%eax usb_destroy_configuration(dev); fea: 53 push %ebx feb: e8 fc ff ff ff call fec <usb_free_dev+0x20> usb_bus_put(dev->bus); ff0: ff b3 cc 00 00 00 pushl 0xcc(%ebx) ff6: e8 01 f7 ff ff call 6fc <usb_bus_put> kfree(dev); ffb: 53 push %ebx ffc: e8 fc ff ff ff call ffd <usb_free_dev+0x31> } 1001: 83 c4 10 add $0x10,%esp 1004: 5b pop %ebx 1005: c3 ret } Unable to handle kernel paging request at virtual address cc87aa30 c01a3705 *pde = 013e5067 Oops: 0000 CPU: 0 EIP: 0010:[usb_free_dev+25/60] Not tainted EIP: 0010:[<c01a3705>] Not tainted Using defaults from ksymoops -t elf32-i386 -a i386 EFLAGS: 00010202 eax: cc87aa2c ebx: cb1e2a00 ecx: caeaa000 edx: 00000001 esi: c97bd400 edi: c97bd4c0 ebp: c9594040 esp: c49f5eb4 ds: 0018 es: 0018 ss: 0018 Process pppd (pid: 689, stackpage=c49f5000) Stack: cb1e2a00 cae56000 cc88ce38 cb1e2a00 cc88ec00 cae56104 cc88ebc0 cc88eb80 00000000 c12f8a60 c01e9d7c c12f8a60 00000000 c01e9ed0 c12f8a60 c01e9f05 c97bd400 00000000 c97bd400 c97bd4c0 c01e7d48 c97bd400 00000000 c4fdb3a0 Call Trace: [speedtch:__insmod_speedtch_S.text_L8308+3544/6656] [speedtch:__insmod_speedtch_S.rodata_L5224+2848/5600] [speedtch:__insmod_speedtch_S.rodata_L5224+2784/5600] [speedtch:__insmod_speedtch_S.rodata_L5224+2720/5600] [shutdown_atm_dev+32/48] Call Trace: [<cc88ce38>] [<cc88ec00>] [<cc88ebc0>] [<cc88eb80>] [<c01e9d7c>] [<c01e9ed0>] [<c01e9f05>] [<c01e7d48>] [<c01e7d73>] [<c01ad7ee>] [<c01adcbd>] [<c012e574>] [<c012d625>] [<c0115ef8>] [<c0116487>] [<c0116632>] [<c0106bd3>] Code: 8b 40 04 ff d0 53 e8 b4 0a 00 00 ff b3 cc 00 00 00 e8 01 f7 >>EIP; c01a3705 <usb_free_dev+19/3c> <===== >>eax; cc87aa2c <[nls_cp437].data.end+7931/8f65> >>ebx; cb1e2a00 <_end+af49ac8/c5bb128> >>ecx; caeaa000 <_end+ac110c8/c5bb128> >>esi; c97bd400 <_end+95244c8/c5bb128> >>edi; c97bd4c0 <_end+9524588/c5bb128> >>ebp; c9594040 <_end+92fb108/c5bb128> >>esp; c49f5eb4 <_end+475cf7c/c5bb128> Trace; cc88ce38 <[speedtch]udsl_atm_dev_close+58/64> Trace; cc88ec00 <[speedtch]__module_license+a83/13ca> Trace; cc88ebc0 <[speedtch]__module_license+a43/13ca> Trace; cc88eb80 <[speedtch]__module_license+a03/13ca> Trace; c01e9d7c <shutdown_atm_dev+20/30> Trace; c01e9ed0 <unlink_vcc+88/8c> Trace; c01e9f05 <bind_vcc+11/79> Trace; c01e7d48 <atm_release_vcc_sk+100/118> Trace; c01e7d73 <atm_release+13/1c> Trace; c01ad7ee <sock_release+12/50> Trace; c01adcbd <sock_close+31/38> Trace; c012e574 <fput+4c/e0> Trace; c012d625 <filp_close+59/64> Trace; c0115ef8 <put_files_struct+54/b8> Trace; c0116487 <do_exit+af/234> Trace; c0116632 <sys_exit+e/10> Trace; c0106bd3 <system_call+33/40> Code; c01a3705 <usb_free_dev+19/3c> 00000000 <_EIP>: Code; c01a3705 <usb_free_dev+19/3c> <===== 0: 8b 40 04 mov 0x4(%eax),%eax <===== Code; c01a3708 <usb_free_dev+1c/3c> 3: ff d0 call *%eax Code; c01a370a <usb_free_dev+1e/3c> 5: 53 push %ebx Code; c01a370b <usb_free_dev+1f/3c> 6: e8 b4 0a 00 00 call abf <_EIP+0xabf> Code; c01a3710 <usb_free_dev+24/3c> b: ff b3 cc 00 00 00 pushl 0xcc(%ebx) Code; c01a3716 <usb_free_dev+2a/3c> 11: e8 01 f7 00 00 call f717 <_EIP+0xf717> ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ [EMAIL PROTECTED] To unsubscribe, use the last form field at: https://lists.sourceforge.net/lists/listinfo/linux-usb-devel