Hello there,
For some time now I've been getting a kernel panic when I kill the
Speed Touch user-space daemon, modem_run, and I finally found the time
to investigate. The information below is from the linux-2.6.0-test6
kernel but the problem has been going on for a while.
The version of modem_run I'm running is from speedtouch-1.2b2 and is
running with the -k option to use the kernel driver. This means that
when I kill it it's doing an "ioctl(fd,USBDEVFS_REAPURB,&purb);". The
Speed Touch modem is the only USB device connected.
Attached are two separate panic dumps (copied by hand, so don't take
it too literally). Note that the kernel options are different between
the two and in the second I've added some extra printks to try to
track things. The differences between the two might be moderately
interesting. In both cases, the kernel has 'debug memory allocations'
enabled, which 'poisons' freed memory.
The output of the printks seems pretty revealing. A '>' is printed at
the beginning of a function, and a '<' is printed just before it
exits. The interesting bit to me is that usbdev_release finishes just
before a call to async_completed with the same ps. I'm guessing that
async_completed is hitting a freed/poisoned chunk of memory...
I'm happy to provide additional information and/or run various tests
if anyone can think of some.
Thanks for your time,
-Ted
--- printks ---
> usbdev_open: spin_lock_init: ps=cc70f3b4
< usbdev_open: spin_lock_init: ps=cc70f3b4
> async_completed: ps=cc70f3b4
< async_completed: ps=cc70f3b4
> destroy_async: ps=cc70f3b4
< destroy_async: ps=cc70f3b4
> destroy_async: ps=cc70f3b4
< destroy_async: ps=cc70f3b4
kill [modem_run pid]
> usbdev_release: ps=cc70f3b4
> destroy_async: ps=cc70f3b4
< destroy_async: ps=cc70f3b4
< usbdev_release: ps=cc70f3b4
> async_completed: ps=cc70f3b4
--- panic #1: pre-emptable kernel ---
drivers/usb/core/devio.c:261: spin_is_locked on uninitialized spinlock cd1df580.
Unable to handle kernel paging request at virtual address 6b6b6b6b
*pde=00000000
Oops: 0000 [#1]
CPU: 0
EIP: 0060:[<c022c1fa>] Not tainted
EFLAGS: 00010097
EIP is at vsnprintf+0x31a/0x450
eax: 6b6b6b6b ebx: 0000000a ecx: 6b6b6b6b edx: fffffffe
esi: c04e3788 edi: 00000000 ebp: c048ddb8 esp: c048dd80
ds: 007b es: 007b ss: 0068
Process swapper (pid: 0, threadinfo: c048c000 task: c04399a0)
stack: c04e3779 c04e3b5f 00000105 00000000 0000000a ffffffff 00000002 00000002
00000246 c03f4306 c048de08 c012179b c04e3760 00000400 c03ef212 c048de20
c048ddf0 c02ee41a c04570e0 0000001c
Call Trace:
[<c012179b>] printk+0x16b/0x3e0
[<c02ee41a>] serio_interrupt+0x5a/0x60
[<c0118dc8>] recalc_task_prio+0xa8/0x1d0
[<c02e2fef>] async_completed+0x1bf/0x1d0
[<d08e19f9>] uhci_finish_urb+0x89/0x190 [uhci_hcd]
[<c02de274>] usb_hcd_giveback_urb+0x24/0x40
[<d08e1c4a>] uhci_finish_completion+0x14a/0x380 [uhci_hcd]
[<c0138c45>] rcu_process_callbacks+0x195/0x250
[<c02de2c5>] usb_hcd_irq+0x35/0x60
[<c010c0eb>] handle_IRQ_event+0x3b/0x70
[<c010c700>] do_IRQ+0x140/0x3a0
[<c0105000>] _stext+0x0/0xf0
[<c010a648>] common_interrupt+0x18/0x20
[<c0105000>] _stext+0x0/0xf0
[<c0107406>] default_idle+0x26/0x40
[<c0107494>] cpu_idle+0x34/0x40
[<c048e833>] start_kernel+0x1c3/0x230
[<c048e520>] unknown_bootoption+0x0/0x110
Code: 80 38 00 74 07 40 4a 83 fa ff 75 f4 29 c8 83 e7 10 89 c3 75
--- panic #2: non-pre-emptable kernel, includes debugging symbols ---
drivers/usb/core/devio.c:262: spin_is_locked on uninitialized spinlock cc70f3e8.
Unable to handle kernel paging request at virtual address 6b6b6b6b
*pde = 00000000
Oops: 0000 [#1]
CPU: 0
EIP: 0060:[<c02175da>] Not tainted
EFLAGS: 00010097
EIP is at vsnprintf+0x31a/0x450
eax: 6b6b6b6b ebx: 0000000a ecx: 6b6b6b6b edx: fffffffe
esi: c04ba788 edi: 00000000 ebp: cffa9cf0 esp: cffa9cb8
ds: 007b es: 007b ss: 0068
Process init (pid: 1, threadinfo=cffa8000 task=c12af540)
Stack: c04ba779 c04bab5f 00000106 00000000 0000000a ffffffff 00000002 00000002
ffffffff ffffffff c04bab5f c04ba760 00000246 c03ccd66 cffa9d40 c011fbd1
c04ba760 00000400 c03c80d2 cffa9d58 00000000 00000000 ce6c998c ce9ff300
Call Trace:
[<c011fbd1>] printk+0x161/0x3a0
[<c01ba5b4>] __ext3_journal_stop+0x24/0x50
[<c02c8fd7>] async_completed+0x1b7/0x1c0
[<c0143e8c>] generic_file_aio_write_nolock+0x47c/0xad0
[<d090416f>] uhci_finish_urb+0x7f/0x170 [uhci_hcd]
[<c02c4604>] usb_hcd_giveback_urb+0x24/0x40
[<d0904376>] uhci_finish_completion+0x116/0x320 [uhci_hcd]
[<c011902d>] schedule+0x34d/0x710
[<c02c4655>] usb_hcd_irq+0x35/0x60
[<c010bbeb>] handle_IRQ_event+0x3b/0x70
[<c010c192>] do_IRQ+0x122/0x350
[<c010a1dc>] common_interrupt+0x18/0x20
[<c014cc01>] kfree+0x1a1/0x3c0
[<c011b867>] free_task+0x17/0x30
[<c011b867>] free_task+0x17/0x30
[<c0122f63>] wait_task_zombie+0x133/0x190
[<c012334d>] sys_wait4+0x21d/0x270
[<c01193f0>] default_wake_function+0x0/0x30
[<c01193f0>] default_wake_function+0x0/0x30
[<c010a067>] syscall_call+0x7/0xb
Code: 80 38 00 74 07 40 4a 83 fa ff 75 f4 29 c8 83 e7 10 89 c3 75
(0) Kernel panic: Fatal exception in interrupt
In interrupt handler - not syncing
--- /proc/bus/usb/devices ---
T: Bus=01 Lev=00 Prnt=00 Port=00 Cnt=00 Dev#= 1 Spd=12 MxCh= 2
B: Alloc= 0/900 us ( 0%), #Int= 0, #Iso= 0
D: Ver= 1.10 Cls=09(hub ) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=0000 ProdID=0000 Rev= 2.06
S: Manufacturer=Linux 2.6.0-test6 uhci-hcd
S: Product=UHCI Host Controller
S: SerialNumber=0000:00:07.2
C:* #Ifs= 1 Cfg#= 1 Atr=40 MxPwr= 0mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=09(hub ) Sub=00 Prot=00 Driver=hub
E: Ad=81(I) Atr=03(Int.) MxPS= 2 Ivl=255ms
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=12 MxCh= 0
D: Ver= 1.10 Cls=ff(vend.) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1
P: Vendor=06b9 ProdID=4061 Rev= 0.00
S: Manufacturer=ALCATEL
S: Product=Speed Touch USB
S: SerialNumber=0090D0490273
C:* #Ifs= 3 Cfg#= 1 Atr=80 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=00 Prot=00 Driver=usbfs
E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=50ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=ff(vend.) Sub=00 Prot=00 Driver=speedtch
I: If#= 1 Alt= 1 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=speedtch
E: Ad=06(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=07(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 1 Alt= 2 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=speedtch
E: Ad=06(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
E: Ad=07(O) Atr=02(Bulk) MxPS= 32 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 1 Alt= 3 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=speedtch
E: Ad=06(O) Atr=02(Bulk) MxPS= 16 Ivl=0ms
E: Ad=07(O) Atr=02(Bulk) MxPS= 16 Ivl=0ms
E: Ad=87(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none)
E: Ad=05(O) Atr=02(Bulk) MxPS= 8 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 8 Ivl=0ms
--- /proc/cpuinfo ---
processor : 0
vendor_id : GenuineIntel
cpu family : 6
model : 5
model name : Pentium II (Deschutes)
stepping : 2
cpu MHz : 350.825
cache size : 512 KB
fdiv_bug : no
hlt_bug : no
f00f_bug : no
coma_bug : no
fpu : yes
fpu_exception : yes
cpuid level : 2
wp : yes
flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge
mca cmov pat pse36 mmx fxsr
bogomips : 692.22
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
[EMAIL PROTECTED]
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-users
