This could be an upstream issue, had similar problems when testing the above 
mentioned 3.4 kernel.
Method of reproducing:

* plug USB bluetooth stick
* pair wiimote
* unplug USB bluetooth stick
* replug USB bluetooth stick

The actual problem (getting wiimote to work) is fixed though.

Sep 11 13:44:44 hp4530s kernel: [  819.512448] wiimote 0005:057E:0306.0007: 
hidraw3: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
Sep 11 13:44:44 hp4530s kernel: [  819.512650] input: Nintendo Wii Remote 
Accelerometer as 
/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0007/input/input18
Sep 11 13:44:44 hp4530s kernel: [  819.512945] input: Nintendo Wii Remote IR as 
/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0007/input/input19
Sep 11 13:44:44 hp4530s kernel: [  819.513236] input: Nintendo Wii Remote as 
/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0007/input/input20
Sep 11 13:44:45 hp4530s kernel: [  820.512501] power_supply wiimote_battery: 
driver failed to report `capacity' property
Sep 11 13:44:45 hp4530s kernel: [  820.512665] Registered led device: 
0005:057E:0306.0007:blue:p0
Sep 11 13:44:45 hp4530s kernel: [  820.512716] Registered led device: 
0005:057E:0306.0007:blue:p1
Sep 11 13:44:45 hp4530s kernel: [  820.512759] Registered led device: 
0005:057E:0306.0007:blue:p2
Sep 11 13:44:45 hp4530s kernel: [  820.512802] Registered led device: 
0005:057E:0306.0007:blue:p3
Sep 11 13:44:45 hp4530s kernel: [  820.512808] wiimote 0005:057E:0306.0007: New 
device registered
Sep 11 13:44:53 hp4530s kernel: [  828.245140] show_signal_msg: 48 callbacks 
suppressed
Sep 11 13:44:53 hp4530s kernel: [  828.249114] pool[4964]: segfault at 
100000007 ip 00007faca46a8882 sp 00007fac977decc0 error 4 in 
libc-2.15.so[7faca462a000+1b3000]
Sep 11 13:45:11 hp4530s bluetoothd[1168]: HCI dev 1 down
Sep 11 13:45:11 hp4530s bluetoothd[1168]: Adapter /org/bluez/1168/hci1 has been 
disabled
Sep 11 13:45:11 hp4530s kernel: [  846.298284] usb 2-1.1: USB disconnect, 
device number 12
Sep 11 13:45:11 hp4530s kernel: [  846.301945] Bluetooth: hci1 urb 
ffff8803e1b9cf00 submission failed
Sep 11 13:45:11 hp4530s kernel: [  846.301967] wiimote 0005:057E:0306.0007: 
Device removed
Sep 11 13:45:11 hp4530s bluetoothd[1168]: HCI dev 1 unregistered
Sep 11 13:45:11 hp4530s bluetoothd[1168]: Stopping hci1 event socket
Sep 11 13:45:11 hp4530s bluetoothd[1168]: Unregister path: /org/bluez/1168/hci1
Sep 11 13:45:12 hp4530s kernel: [  847.300846] power_supply wiimote_battery: 
driver failed to report `capacity' property
Sep 11 13:45:20 hp4530s kernel: [  855.700520] usb 2-1.1: new full-speed USB 
device number 13 using ehci_hcd
Sep 11 13:45:21 hp4530s bluetoothd[1168]: HCI dev 1 registered
Sep 11 13:45:21 hp4530s bluetoothd[1168]: Listening for HCI events on hci1
Sep 11 13:45:21 hp4530s bluetoothd[1168]: HCI dev 1 up
Sep 11 13:45:21 hp4530s bluetoothd[1168]: sap-dummy interface 
org.bluez.SimAccessTest init failed on path /org/bluez/test
Sep 11 13:45:21 hp4530s bluetoothd[1168]: Sap driver initialization failed.
Sep 11 13:45:21 hp4530s bluetoothd[1168]: sap-server: Operation not permitted 
(1)
Sep 11 13:45:21 hp4530s bluetoothd[1168]: input-headset driver probe failed for 
device FC:A1:3E:21:F4:43
Sep 11 13:45:21 hp4530s bluetoothd[1168]: Adapter /org/bluez/1168/hci1 has been 
enabled
Sep 11 13:45:21 hp4530s kernel: [  856.287987] ------------[ cut here 
]------------
Sep 11 13:45:21 hp4530s kernel: [  856.291707] WARNING: at 
/home/henrix/src/precise/ubuntu-precise/kernel/workqueue.c:997 
__queue_work+0x306/0x320()
Sep 11 13:45:21 hp4530s kernel: [  856.295554] Hardware name: HP ProBook 4530s
Sep 11 13:45:21 hp4530s kernel: [  856.299347] Modules linked in: hid_wiimote 
ff_memless hidp pci_stub vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) 
kvm_intel kvm dm_crypt snd_hda_codec_hdmi snd_hda_codec_idt deflate 
zlib_deflate ctr twofish_generic twofish_x86_64_3way twofish_x86_64 
twofish_common camellia serpent blowfish_generic blowfish_x86_64 
blowfish_common cast5 des_generic xcbc rmd160 sha512_generic crypto_null af_key 
bnep rfcomm nfsd parport_pc ppdev nfs lockd fscache auth_rpcgss binfmt_misc 
nfs_acl sunrpc joydev hp_wmi sparse_keymap uvcvideo snd_hda_intel videodev 
v4l2_compat_ioctl32 ath3k snd_hda_codec btusb snd_hwdep bluetooth 
hid_logitech_dj snd_pcm snd_seq_midi arc4 snd_rawmidi snd_seq_midi_event 
snd_seq snd_timer snd_seq_device ath9k mac80211 snd ath9k_common ath9k_hw ath 
psmouse serio_raw cfg80211 soundcore jmb38x_ms snd_page_alloc memstick mei(C) 
hp_accel lis3lv02d input_polldev mac_hid coretemp lp parport usb_storage uas 
usbhid hid radeon sdhci_pci sdhci r8169 i915 wmi ttm drm_kms_helper drm
Sep 11 13:45:21 hp4530s kernel: i2c_algo_bit video [last unloaded: 
ipmi_msghandler]
Sep 11 13:45:21 hp4530s kernel: [  856.321470] Pid: 5032, comm: khidpd_057e0306 
Tainted: G         C O 3.2.0-31-generic #50~lp1048605v1
Sep 11 13:45:21 hp4530s kernel: [  856.324625] Call Trace:
Sep 11 13:45:21 hp4530s kernel: [  856.329298]  [<ffffffff81066d7f>] 
warn_slowpath_common+0x7f/0xc0
Sep 11 13:45:21 hp4530s kernel: [  856.333983]  [<ffffffff81066dda>] 
warn_slowpath_null+0x1a/0x20
Sep 11 13:45:21 hp4530s kernel: [  856.338642]  [<ffffffff81082c56>] 
__queue_work+0x306/0x320
Sep 11 13:45:21 hp4530s kernel: [  856.340919]  [<ffffffff811974c0>] ? 
mntput_no_expire+0x30/0xf0
Sep 11 13:45:21 hp4530s kernel: [  856.342714]  [<ffffffff81082cd5>] 
queue_work_on+0x25/0x30
Sep 11 13:45:21 hp4530s kernel: [  856.344470]  [<ffffffff81082d1f>] 
queue_work+0x1f/0x30
Sep 11 13:45:21 hp4530s kernel: [  856.346483]  [<ffffffffa046dc53>] 
hci_conn_del_sysfs+0x23/0x30 [bluetooth]
Sep 11 13:45:21 hp4530s kernel: [  856.348252]  [<ffffffffa04603c5>] 
hci_conn_put_device+0x25/0x30 [bluetooth]
Sep 11 13:45:21 hp4530s kernel: [  856.350044]  [<ffffffffa078f15e>] 
hidp_session+0x3fe/0x510 [hidp]
Sep 11 13:45:21 hp4530s kernel: [  856.352002]  [<ffffffff8105f5d0>] ? 
try_to_wake_up+0x200/0x200
Sep 11 13:45:21 hp4530s kernel: [  856.354508]  [<ffffffff8105f5d0>] ? 
try_to_wake_up+0x200/0x200
Sep 11 13:45:21 hp4530s kernel: [  856.356271]  [<ffffffffa078ed60>] ? 
hidp_recv_ctrl_frame+0xf0/0xf0 [hidp]
Sep 11 13:45:21 hp4530s kernel: [  856.358080]  [<ffffffff8108a03c>] 
kthread+0x8c/0xa0
Sep 11 13:45:21 hp4530s kernel: [  856.359851]  [<ffffffff81664c74>] 
kernel_thread_helper+0x4/0x10
Sep 11 13:45:21 hp4530s kernel: [  856.361667]  [<ffffffff81089fb0>] ? 
flush_kthread_worker+0xa0/0xa0
Sep 11 13:45:21 hp4530s kernel: [  856.363452]  [<ffffffff81664c70>] ? 
gs_change+0x13/0x13
Sep 11 13:45:21 hp4530s kernel: [  856.365263] ---[ end trace 3d57b41153419411 
]---
Sep 11 13:45:22 hp4530s kernel: [  857.788059] wiimote 0005:057E:0306.0008: 
hidraw3: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
Sep 11 13:45:22 hp4530s kernel: [  857.791862] input: Nintendo Wii Remote 
Accelerometer as 
/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:38/0005:057E:0306.0008/input/input21
Sep 11 13:45:22 hp4530s kernel: [  857.795150] input: Nintendo Wii Remote IR as 
/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:38/0005:057E:0306.0008/input/input22
Sep 11 13:45:22 hp4530s kernel: [  857.798286] input: Nintendo Wii Remote as 
/devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:38/0005:057E:0306.0008/input/input23
Sep 11 13:45:23 hp4530s kernel: [  858.799808] power_supply wiimote_battery: 
driver failed to report `capacity' property
Sep 11 13:45:23 hp4530s kernel: [  858.805046] Registered led device: 
0005:057E:0306.0008:blue:p0
Sep 11 13:45:23 hp4530s kernel: [  858.805118] Registered led device: 
0005:057E:0306.0008:blue:p1
Sep 11 13:45:23 hp4530s kernel: [  858.805184] Registered led device: 
0005:057E:0306.0008:blue:p2
Sep 11 13:45:23 hp4530s kernel: [  858.805252] Registered led device: 
0005:057E:0306.0008:blue:p3
Sep 11 13:45:23 hp4530s kernel: [  858.805260] wiimote 0005:057E:0306.0008: New 
device registered

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1048605

Title:
  Pairing wiimote leads to kernel null pointer derefence in hid_wiimote

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1048605/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to