usbcore deregistering driver stir4200 cause Oops

[Alexander Sashnov]

Binary package hint: linux-source-2.6.22

DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=7.10
DISTRIB_CODENAME=gutsy
DISTRIB_DESCRIPTION="Ubuntu 7.10"

kernel 2.6.22-14-generic (package linux-image-2.6.22-14-generic)

Steps to reproduce:

1. plug SigmaTel 4200 to USB

2. # irattach irda0
     # modprobe ircomm_tty

3. $ pilot-xfer --list -p /dev/ircomm0

4. unplug SigmaTel4200 dongle (just remove USB device)

dmesg:
[18355.608000] usb 2-2: new full speed USB device using ohci_hcd and address 3
[18355.820000] usb 2-2: configuration #1 chosen from 1 choice
[18355.828000] SigmaTel STIr4200 IRDA/USB found at address 3, Vendor: 66f, Product: 4200
[18355.828000] /build/buildd/linux-source-2.6.22-2.6.22/drivers/net/irda/stir4200.c: IrDA: Registered SigmaTel device irda0
[18355.952000] irlap_change_speed(), setting speed to 9600
[18387.780000] ircomm_tty_attach_cable()
[18387.780000] ircomm_tty_ias_register()
[18388.524000] irlap_change_speed(), setting speed to 38400
[18390.612000] irlap_change_speed(), setting speed to 9600
[18393.112000] irlap_change_speed(), setting speed to 38400
[18393.744000] irlmp_state_dtr(), Unknown event LM_LAP_CONNECT_CONFIRM on LSAP 0x0
[18393.744000] ircomm_param_service_type(), services in common=04
[18393.744000] ircomm_param_service_type(), resulting service type=0x04
[18393.784000] ircomm_param_xon_xoff(), XON/XOFF = 0x11,0x13
[18393.784000] ircomm_param_enq_ack(), ENQ/ACK = 0x13,0x11
[18393.784000] ircomm_tty_check_modem_status()
[18394.192000] ircomm_param_xon_xoff(), XON/XOFF = 0x11,0x13
[18394.192000] ircomm_param_enq_ack(), ENQ/ACK = 0x13,0x11
[18394.192000] ircomm_tty_check_modem_status()
[18394.548000] ircomm_param_xon_xoff(), XON/XOFF = 0x11,0x13
[18394.548000] ircomm_param_enq_ack(), ENQ/ACK = 0x13,0x11
[18394.548000] ircomm_tty_check_modem_status()
[18400.288000] ircomm_tty_close()
[18400.288000] ircomm_tty_shutdown()
[18400.288000] ircomm_tty_detach_cable()
[18400.288000] ircomm_close()
[18400.336000] irlap_change_speed(), setting speed to 9600
[18462.676000] usb 2-2: USB disconnect, address 3
[18462.724000] usbcore: deregistering interface driver stir4200
[18462.728000] BUG: unable to handle kernel paging request at virtual address f8c66d4e
[18462.728000] printing eip:
[18462.728000] f8c66d4e
[18462.728000] *pde = 351fd067
[18462.728000] *pte = 00000000
[18462.728000] Oops: 0000 [#1]
[18462.728000] SMP
[18462.728000] Modules linked in: ircomm_tty ircomm nls_iso8859_1 vfat fat usb_storage libusual snd_rtctimer vmnet(P) vmmon(P) binfmt_misc rfcomm l2cap bluetooth vboxdrv af_packet cifs irda crc_ccitt iptable_filter ip_tables x_tables ppdev cpufreq_stats cpufreq_ondemand cpufreq_powersave freq_table cpufreq_userspace cpufreq_conservative container video ac button dock sbs battery nls_cp437 isofs loop lp snd_hda_intel snd_pcm_oss snd_mixer_oss snd_pcm snd_page_alloc snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device serio_raw snd parport_pc parport agpgart psmouse pcspkr k8temp i2c_nforce2 shpchp pci_hotplug soundcore i2c_core ipv6 nfs lockd sunrpc evdev ext3 jbd mbcache sg sd_mod ata_generic forcedeth ohci_hcd sata_nv libata scsi_mod ehci_hcd amd74xx ide_core usbcore thermal processor fan fuse apparmor commoncap
[18462.728000] CPU: 1
[18462.728000] EIP: 0060:[<f8c66d4e>] Tainted: P VLI
[18462.728000] EFLAGS: 00010282 (2.6.22-14-generic #1)
[18462.728000] EIP is at 0xf8c66d4e
[18462.728000] eax: c03c5ff4 ebx: d7e06500 ecx: dfa4dea0 edx: 00000000
[18462.728000] esi: f412a800 edi: f8c68f20 ebp: 00000000 esp: dfa4debc
[18462.728000] ds: 007b es: 007b fs: 00d8 gs: 0000 ss: 0068
[18462.728000] Process khubd (pid: 2212, ti=dfa4c000 task=f7c9d9f0 task.ti=dfa4c000)
[18462.728000] Stack: f412a800 f412a818 f8889000 f3f93400 f412a818 f8c68f50 f412a890 f3f93458
[18462.728000] c0260fd8 f412a818 f412a818 c0261443 f412a890 c02608ac f412a818 f412a818
[18462.728000] c025ea10 f412a818 f3f93400 00000001 f3f93544 f888629e f3f9370c 0000001f
[18462.728000] Call Trace:
[18462.728000] [<f8889000>] usb_unbind_interface+0x50/0xa0 [usbcore]
[18462.728000] [<c0260fd8>] __device_release_driver+0x68/0xa0
[18462.728000] [<c0261443>] device_release_driver+0x23/0x40
[18462.728000] [<c02608ac>] bus_remove_device+0x5c/0x90
[18462.728000] [<c025ea10>] device_del+0x160/0x260
[18462.728000] [<f888629e>] usb_disable_device+0x7e/0xe0 [usbcore]
[18462.728000] [<f88823a7>] usb_disconnect+0x97/0x130 [usbcore]
[18462.728000] [<f8882a4f>] hub_thread+0x26f/0xc30 [usbcore]
[18462.728000] [<c02f20ea>] schedule+0x2ca/0x890
[18462.728000] [<c013bdd0>] autoremove_wake_function+0x0/0x50
[18462.728000] [<f88827e0>] hub_thread+0x0/0xc30 [usbcore]
[18462.728000] [<c013bb12>] kthread+0x42/0x70
[18462.728000] [<c013bad0>] kthread+0x0/0x70
[18462.728000] [<c0105487>] kernel_thread_helper+0x7/0x10
[18462.728000] =======================
[18462.728000] Code: Bad EIP value.
[18462.728000] EIP: [<f8c66d4e>] 0xf8c66d4e SS:ESP 0068:dfa4debc
[18462.760000] __ircomm_tty_cleanup()
[18462.760000] ircomm_tty_shutdown()

After this USB is unusable: nothing about new USB devices in dmesg.

$ lsmod | grep usb
usb_storage 73024 0
libusual 18448 1 usb_storage
scsi_mod 147084 4 usb_storage,sg,sd_mod,libata
ide_core 116804 2 usb_storage,amd74xx
usbcore 138632 6 stir4200,usb_storage,libusual,ohci_hcd,ehci_hcd

$ lsmod | grep ir
stir4200 13976 1
ircomm 23812 0
irda 202300 4 stir4200,ircomm
crc_ccitt 3072 1 irda
usbcore 138632 6 stir4200,usb_storage,libusual,ohci_hcd,ehci_hcd

$ sudo rmmod ircomm_tty # ok
$ sudo rmmod irda
ERROR: Module irda is in use by stir4200
$ sudo rmmod stir4200 # seems marked as used but really not.
ERROR: Module stir4200 is in use

lsusb hangs:

$ pidof lsusb
31750

$ ps -p 31750 -o pid,stat,wchan
  PID STAT WCHAN
31750 D+ -

$ lsof -p 31750
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
lsusb 31750 alex cwd DIR 8,8 12288 1064993 /home/alex
lsusb 31750 alex rtd DIR 8,5 4096 2 /
lsusb 31750 alex txt REG 8,5 84316 229364 /usr/sbin/lsusb
lsusb 31750 alex mem REG 8,5 1339816 374028 /lib/tls/i686/cmov/libc-2.6.1.so
lsusb 31750 alex mem REG 8,5 28376 340841 /lib/libusb-0.1.so.4.4.4
lsusb 31750 alex mem REG 8,5 80504 229234 /usr/lib/libz.so.1.2.3.3
lsusb 31750 alex mem REG 8,5 109148 340717 /lib/ld-2.6.1.so
lsusb 31750 alex 0u CHR 136,6 8 /dev/pts/6
lsusb 31750 alex 1u CHR 136,6 8 /dev/pts/6
lsusb 31750 alex 2u CHR 136,6 8 /dev/pts/6
lsusb 31750 alex 3r DIR 0,14 80 8198 /dev/bus/usb/002
lsusb 31750 alex 4r CHR 189,130 80186 /dev/bus/usb/002/003

[Alexander Sashnov (sashnov)]

I found workaround:

I change (my) scritp /etc/udev/rules.d/55-irda-stir4200.rules to:

#!/bin/sh

killall irattach # kill irattach first and wait
sleep 1
rmmod stir4200
sleep 1
rmmod ircomm_tty

now plug/unplug IRDA dongle don't crash USB subsystem.

[Launchpad Janitor (janitor)]

Beginning with the Hardy Heron 8.04 development cycle, all open Ubuntu kernel bugs need to be reported against the "linux" kernel package. We are automatically migrating this bug to the new "linux" package. However, development has already began for the upcoming Intrepid Ibex 8.10 release. It would be helpful if you could test the upcoming release and verify if this is still an issue - http://www.ubuntu.com/testing . If the issue still exists, please update this report by changing the Status of the "linux" task from "Incomplete" to "New". We appreciate your patience and understanding as we make this transition. Thanks!

[Alexander Sashnov (sashnov)]

not reproduced on Hardy updates (on 2.6.24-16-generic kernel)

[Alexander Sashnov (sashnov)]

not reproduced on Intrepid alpha3 (2.6.26-4-generic)

[Leann Ogasawara (leannogasawara)]

The Ubuntu Kernel Team is planning to move to the 2.6.27 kernel for the upcoming Intrepid Ibex 8.10 release. As a result, the kernel team would appreciate it if you could please test this newer 2.6.27 Ubuntu kernel. There are one of two ways you should be able to test:

1) If you are comfortable installing packages on your own, the linux-image-2.6.27-* package is currently available for you to install and test.

--or--

2) The upcoming Alpha5 for Intrepid Ibex 8.10 will contain this newer 2.6.27 Ubuntu kernel. Alpha5 is set to be released Thursday Sept 4. Please watch http://www.ubuntu.com/testing for Alpha5 to be announced. You should then be able to test via a LiveCD.

Please let us know immediately if this newer 2.6.27 kernel resolves the bug reported here or if the issue remains. More importantly, please open a new bug report for each new bug/regression introduced by the 2.6.27 kernel and tag the bug report with 'linux-2.6.27'. Also, please specifically note if the issue does or does not appear in the 2.6.26 kernel. Thanks again, we really appreicate your help and feedback.

[Michele Mangili (mangilimic)]

This bug report is being closed due to your last comment regarding this being fixed with an update. For future reference you can manage the status of your own bugs by clicking on the current status in the yellow line and then choosing a new status in the revealed drop down box. You can learn more about bug statuses at https://wiki.ubuntu.com/Bugs/Status . Thank you again for taking the time to report this bug and helping to make Ubuntu better. Feel free to submit any future bugs you may find.