[alsa-devel] usb audio race at disconnect time
Hi,
while doing some monkey tests on a product we found races in usb audio code when the device in unplugged from usb (on linus master tree).
This can be reproduced with usb_audio_show_race.diff and CONFIG_DEBUG_SLAB. With this patch, start a stream : # arecord -D hw:0 -r 44100 -c 2 -f S16_LE > /dev/null you will see the kernel log : "in snd_usb_hw_params sleeping" Unplug the device before "in snd_usb_hw_params sleeping exit", and you will see an oops in snd_pcm_hw_params
Instead of using CONFIG_DEBUG_SLAB, usb_audio_show_use_after_free.diff can show use after free by setting usb_device pointer to NULL in snd_usb_audio_disconnect. [1]
In order to protect from all the races, before using any usb_device we need to check if it is not freed.
What's the best way to do that ?
A trival fix would be to take a mutex in all snd_pcm_ops callback that access usb :
{ mutex_lock(&chip->shutdown_mutex); if (!chip->dev) { mutex_unlock(&chip->shutdown_mutex); return -ENODEV; } [...] mutex_unlock(&chip->shutdown_mutex); }
But that will serialize all snd_pcm_ops callbacks.
Another solution could be to use refcounting or rwlock patern : - snd_pcm_ops callbacks call rdlock_trylock/rdlock_unlock - usb_driver disconnect callback take rwlock_lock and never release it
This will make "usb_driver disconnect" wait that all "snd_pcm_ops callback" are finished and abort all future call to "snd_pcm_ops callback".
I believe similar problems exist in other drivers, (we saw another one in hidraw [2]), so it could be nice to find a generic pattern to help driver to manage correctly disconnection.
Are there any recommended pattern ?
Do you have any comment ?
Thanks,
Matthieu
[1]
[ 1366.315307] usb 1-2.1.3: new full-speed USB device number 4 using ehci-omap [ 1366.556579] input: USB Audio as /devices/platform/usbhs_omap/ehci-omap.0/usb1 /1-2/1-2.1/1-2.1.3/1-2.1.3:1.3/input/input1 [ 1366.604553] hid-generic 0003:06F8:C000.0001: input,hidraw0: USB HID v1.00 Dev ice [USB Audio] on usb-ehci-omap.0-2.1.3/input3
# # # arecord -D hw:0 -r 44100 -c 2 -f S16_LE > /dev/null Recording WAVE '[ 1368.937774] in snd_usb_hw_params sleeping stdin' : Signed 16 bit Little Endian, Rate 44100 Hz, Stereo Warning: rate is not accurate (requested = 44100Hz, got = 48000Hz) please, try the plug plugin [ 1372.385375] hid-generic 0003:06F8:C000.0001: can't reset device, ehci-omap.0- 2.1.3/input3, status -71 [ 1372.439514] usb 1-2.1.3: USB disconnect, device number 4 [ 1372.449005] hid-generic 0003:06F8:C000.0001: can't reset device, ehci-omap.0- 2.1.3/input3, status -71 [ 1378.947235] in snd_usb_hw_params sleeping exit [ 1378.952301] Unable to handle kernel NULL pointer dereference at virtual addre ss 0000029c [ 1378.961029] pgd = c31e8000 [ 1378.964019] [0000029c] *pgd=8e885831, *pte=00000000, *ppte=00000000 [ 1378.970825] Internal error: Oops: 17 [#1] SMP ARM [ 1378.975799] Modules linked in: [ 1378.979064] CPU: 0 Not tainted (3.6.0-03889-ge8dc7a6-dirty #5) [ 1378.985595] PC is at usb_ifnum_to_if+0xc/0xd4 [ 1378.990234] LR is at snd_usb_hw_params+0x1bc/0x764 [ 1378.995300] pc : [<c0275338>] lr : [<c030816c>] psr: 00000013 [ 1378.995300] sp : cf3fddf0 ip : cf3fde08 fp : cf3fde04 [ 1379.007415] r10: 0000bb80 r9 : 00000001 r8 : 00000000 [ 1379.012908] r7 : cf972f40 r6 : cf3e1f14 r5 : ce8ad000 r4 : cf3e1eb0 [ 1379.019805] r3 : 00000004 r2 : 00000005 r1 : 00000002 r0 : 00000000 [ 1379.026702] Flags: nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user [ 1379.034240] Control: 10c5387d Table: 831e8019 DAC: 00000015 [ 1379.040313] Process arecord (pid: 636, stack limit = 0xcf3fc2f8) [ 1379.046661] Stack: (0xcf3fddf0 to 0xcf3fe000) [ 1379.051269] dde0: cf3e1eb0 ce8ad000 cf3fd e5c cf3fde08 [ 1379.059906] de00: c030816c c0275338 cf3fde3c cf3fde18 c02f5d68 c02f59e4 c05b4 c60 ce8ad000 [ 1379.068542] de20: cf3e1800 00000001 00000004 00000001 cf3fde5c cf3e1800 ce8ad 800 c05b8310 [ 1379.077178] de40: ce8ad000 c0014728 cf3fc000 00000000 cf3fde7c cf3fde60 c02f0 b8c c0307fbc [ 1379.085815] de60: cf3e1800 be91b890 be91b890 ce8ad000 cf3fdec4 cf3fde80 c02f1 778 c02f0ad4 [ 1379.094451] de80: cf3fc000 60000013 cf97b540 00000002 c0126484 00000000 cf3fd ed4 cf3e1800 [ 1379.103088] dea0: be91b890 cf3e5078 c0045877 c0014728 cf3fc000 00000000 cf3fd efc cf3fdec8 [ 1379.111755] dec0: c02f2150 c02f1228 cf3fdf3c cf3fded8 c0126634 c0068ef0 00000 001 00000000 [ 1379.120391] dee0: cf87f280 be91b890 cf3e5078 c0045877 cf3fdf0c cf3fdf00 c02f2 5dc c02f2124 [ 1379.129028] df00: cf3fdf7c cf3fdf10 c00fd6b4 c02f25ac c03d7328 cf8b49c8 00000 026 00000000 [ 1379.137664] df20: cd673738 00000002 cf3fc000 00000000 cf3fdf6c cf3fdf40 c00ec 138 c0126420 [ 1379.146301] df40: 00000000 00000000 00000006 cf8b49c0 be919140 00000000 cf87f 280 be91b890 [ 1379.154907] df60: c25c4111 00000004 c0014728 cf3fc000 cf3fdfa4 cf3fdf80 c00fd c6c c00fd638 [ 1379.163543] df80: c00183f0 00000000 00028288 b6fc68a0 00028238 00000036 00000 000 cf3fdfa8 [ 1379.172180] dfa0: c00145a0 c00fdc38 00028288 b6fc68a0 00000004 c25c4111 be91b 890 00020001 [ 1379.180816] dfc0: 00028288 b6fc68a0 00028238 00000036 be91b890 0000bb80 0000a c44 be91bb74 [ 1379.189453] dfe0: 00028288 be91b760 b6fa41c8 b6e05aec 20000010 00000004 007ff f00 00ffdf00 [ 1379.198089] Backtrace: [ 1379.200683] [<c027532c>] (usb_ifnum_to_if+0x0/0xd4) from [<c030816c>] (snd_us b_hw_params+0x1bc/0x764) [ 1379.210418] r5:ce8ad000 r4:cf3e1eb0 [ 1379.214263] [<c0307fb0>] (snd_usb_hw_params+0x0/0x764) from [<c02f0b8c>] (snd _pcm_hw_params+0xc4/0x368) [ 1379.224182] [<c02f0ac8>] (snd_pcm_hw_params+0x0/0x368) from [<c02f1778>] (snd _pcm_common_ioctl1+0x55c/0xefc) [ 1379.234558] r7:ce8ad000 r6:be91b890 r5:be91b890 r4:cf3e1800 [ 1379.240600] [<c02f121c>] (snd_pcm_common_ioctl1+0x0/0xefc) from [<c02f2150>] (snd_pcm_capture_ioctl1+0x38/0x488) [ 1379.251342] [<c02f2118>] (snd_pcm_capture_ioctl1+0x0/0x488) from [<c02f25dc>] (snd_pcm_capture_ioctl+0x3c/0x40) [ 1379.261962] r7:c0045877 r6:cf3e5078 r5:be91b890 r4:cf87f280 [ 1379.268005] [<c02f25a0>] (snd_pcm_capture_ioctl+0x0/0x40) from [<c00fd6b4>] ( do_vfs_ioctl+0x88/0x600) [ 1379.277770] [<c00fd62c>] (do_vfs_ioctl+0x0/0x600) from [<c00fdc6c>] (sys_ioct l+0x40/0x68) [ 1379.286376] r9:cf3fc000 r8:c0014728 r7:00000004 r6:c25c4111 r5:be91b890 r4:cf87f280 [ 1379.294738] [<c00fdc2c>] (sys_ioctl+0x0/0x68) from [<c00145a0>] (ret_fast_sys call+0x0/0x30) [ 1379.303558] r7:00000036 r6:00028238 r5:b6fc68a0 r4:00028288 [ 1379.309600] Code: e89da818 e1a0c00d e92dd830 e24cb004 (e590329c) [ 1379.316223] ---[ end trace 48c30133f24e0b57 ]--- [ 1379.321105] Kernel panic - not syncing: Fatal exception
[2] [ 349.573974] ------------[ cut here ]------------ [ 349.578796] WARNING: at /opt/mcastet/CIA/fidji-beta28/raptor/kernel/omap/lib/list_debug.c:48 list_del+0x30/0x8c() [ 349.589477] list_del corruption. prev->next should be d95efc44, but was 6b6b6b6b [ 349.597167] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso atmel_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap2_mcspi omap_hsmmc [ 349.611572] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f7b4>] (warn_slowpath_common+0x4c/0x64) [ 349.621368] [<c016f7b4>] (warn_slowpath_common+0x4c/0x64) from [<c016f84c>] (warn_slowpath_fmt+0x2c/0x3c) [ 349.631347] [<c016f84c>] (warn_slowpath_fmt+0x2c/0x3c) from [<c0298200>] (list_del+0x30/0x8c) [ 349.640228] [<c0298200>] (list_del+0x30/0x8c) from [<c0185d50>] (remove_wait_queue+0x2c/0x6c) [ 349.649108] [<c0185d50>] (remove_wait_queue+0x2c/0x6c) from [<c01f4e64>] (free_poll_entry+0x14/0x20) [ 349.658630] [<c01f4e64>] (free_poll_entry+0x14/0x20) from [<c01f4e88>] (poll_freewait+0x18/0x6c) [ 349.667785] [<c01f4e88>] (poll_freewait+0x18/0x6c) from [<c01f5448>] (do_sys_poll+0x314/0x3a4) [ 349.676757] [<c01f5448>] (do_sys_poll+0x314/0x3a4) from [<c01f56fc>] (sys_poll+0x5c/0xbc) [ 349.685272] [<c01f56fc>] (sys_poll+0x5c/0xbc) from [<c0138f40>] (ret_fast_syscall+0x0/0x30) [ 349.693969] ---[ end trace 1b75b31a2719ed1e ]--- [ 349.698791] ------------[ cut here ]------------ [ 349.703582] WARNING: at /opt/mcastet/CIA/fidji-beta28/raptor/kernel/omap/lib/list_debug.c:51 list_del+0x58/0x8c() [ 349.714263] list_del corruption. next->prev should be d95efc44, but was 6b6b6b6b [ 349.721954] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso atmel_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap2_mcspi omap_hsmmc [ 349.736328] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f7b4>] (warn_slowpath_common+0x4c/0x64) [ 349.746124] [<c016f7b4>] (warn_slowpath_common+0x4c/0x64) from [<c016f84c>] (warn_slowpath_fmt+0x2c/0x3c) [ 349.756103] [<c016f84c>] (warn_slowpath_fmt+0x2c/0x3c) from [<c0298228>] (list_del+0x58/0x8c) [ 349.764984] [<c0298228>] (list_del+0x58/0x8c) from [<c0185d50>] (remove_wait_queue+0x2c/0x6c) [ 349.773864] [<c0185d50>] (remove_wait_queue+0x2c/0x6c) from [<c01f4e64>] (free_poll_entry+0x14/0x20) [ 349.783386] [<c01f4e64>] (free_poll_entry+0x14/0x20) from [<c01f4e88>] (poll_freewait+0x18/0x6c) [ 349.792541] [<c01f4e88>] (poll_freewait+0x18/0x6c) from [<c01f5448>] (do_sys_poll+0x314/0x3a4) [ 349.801513] [<c01f5448>] (do_sys_poll+0x314/0x3a4) from [<c01f56fc>] (sys_poll+0x5c/0xbc) [ 349.810028] [<c01f56fc>] (sys_poll+0x5c/0xbc) from [<c0138f40>] (ret_fast_syscall+0x0/0x30) [ 349.818725] ---[ end trace 1b75b31a2719ed1f ]--- [ 349.830444] hub 1-1:1.0: unable to enumerate USB device on port 2 [ 350.412475] Slab corruption: size-64 start=d7189ac0, len=64 [ 350.420166] 000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b cc 9a 18 d7 [ 350.426544] 010: cc 9a 18 d7 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b [ 350.435699] Prev obj: start=d7189a80, len=64 [ 350.441284] 000: 02 26 00 00 c5 91 18 d7 84 93 18 d7 c4 9d 18 d7 [ 350.447601] 010: 50 91 ad d3 50 9f 18 d7 50 95 ad d3 00 00 00 00 [ 350.454650] Next obj: start=d7189b00, len=64 [ 350.460083] 000: 5d 25 00 00 05 78 e5 d8 c4 9e 18 d7 44 13 6a d9 [ 350.466613] 010: 91 13 6a d9 00 00 00 00 00 00 00 00 00 00 00 00
[Added Daniel and Clemens in the loop]
At Thu, 11 Oct 2012 17:17:59 +0200, Matthieu CASTET wrote:
Hi,
while doing some monkey tests on a product we found races in usb audio code when the device in unplugged from usb (on linus master tree).
This can be reproduced with usb_audio_show_race.diff and CONFIG_DEBUG_SLAB. With this patch, start a stream : # arecord -D hw:0 -r 44100 -c 2 -f S16_LE > /dev/null you will see the kernel log : "in snd_usb_hw_params sleeping" Unplug the device before "in snd_usb_hw_params sleeping exit", and you will see an oops in snd_pcm_hw_params
Instead of using CONFIG_DEBUG_SLAB, usb_audio_show_use_after_free.diff can show use after free by setting usb_device pointer to NULL in snd_usb_audio_disconnect. [1]
In order to protect from all the races, before using any usb_device we need to check if it is not freed.
What's the best way to do that ?
A trival fix would be to take a mutex in all snd_pcm_ops callback that access usb :
{ mutex_lock(&chip->shutdown_mutex); if (!chip->dev) { mutex_unlock(&chip->shutdown_mutex); return -ENODEV; } [...] mutex_unlock(&chip->shutdown_mutex); }
But that will serialize all snd_pcm_ops callbacks.
We had already some protections but they don't cover the recent code rewrites at all, so this bad result for now.
Yes, the easiest and maybe sane way would be to put the mutex in each ops except for trigger. open, close, hw_params, hw_free and prepare are ops that don't need much parallelism, so this can be protected well. Or, we may introduce a new mutex per stream if we really want parallel operations, but I don't think it's worth.
The trigger callback is an atomic ops, so it won't need the check. Maybe the spinlock is needed to avoid the race in snd_usb_stream_disconnect().
Another solution could be to use refcounting or rwlock patern :
- snd_pcm_ops callbacks call rdlock_trylock/rdlock_unlock
- usb_driver disconnect callback take rwlock_lock and never release it
I don't think this is needed.
So... the below is a quick hack I did without testing at all. Hopefully this can give some advance.
Takashi
--- diff --git a/sound/usb/card.c b/sound/usb/card.c index 561bb74..115484e 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -131,9 +131,13 @@ static void snd_usb_stream_disconnect(struct list_head *head) subs = &as->substream[idx]; if (!subs->num_formats) continue; + if (subs->pcm_substream) + snd_pcm_stream_lock_irq(subs->pcm_substream); subs->interface = -1; subs->data_endpoint = NULL; subs->sync_endpoint = NULL; + if (subs->pcm_substream) + snd_pcm_stream_unlock_irq(subs->pcm_substream); } }
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 55e19e1..01e82ac 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -444,7 +444,6 @@ static int configure_endpoint(struct snd_usb_substream *subs) { int ret;
- mutex_lock(&subs->stream->chip->shutdown_mutex); /* format changed */ stop_endpoints(subs, 0, 0, 0); ret = snd_usb_endpoint_set_params(subs->data_endpoint, @@ -455,7 +454,7 @@ static int configure_endpoint(struct snd_usb_substream *subs) subs->cur_audiofmt, subs->sync_endpoint); if (ret < 0) - goto unlock; + return ret;
if (subs->sync_endpoint) ret = snd_usb_endpoint_set_params(subs->data_endpoint, @@ -466,8 +465,6 @@ static int configure_endpoint(struct snd_usb_substream *subs) subs->cur_audiofmt, NULL);
-unlock: - mutex_unlock(&subs->stream->chip->shutdown_mutex); return ret; }
@@ -488,10 +485,15 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream, struct audioformat *fmt; int ret;
+ mutex_lock(&subs->stream->chip->shutdown_mutex); + if (subs->stream->chip->shutdown) { + ret = -ENODEV; + goto unlock; + } ret = snd_pcm_lib_alloc_vmalloc_buffer(substream, params_buffer_bytes(hw_params)); if (ret < 0) - return ret; + goto unlock;
subs->pcm_format = params_format(hw_params); subs->period_bytes = params_period_bytes(hw_params); @@ -502,17 +504,20 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream, if (!fmt) { snd_printd(KERN_DEBUG "cannot set format: format = %#x, rate = %d, channels = %d\n", subs->pcm_format, subs->cur_rate, subs->channels); - return -EINVAL; + ret = -EINVAL; + goto unlock; }
if ((ret = set_format(subs, fmt)) < 0) - return ret; + goto unlock;
subs->interface = fmt->iface; subs->altset_idx = fmt->altset_idx; subs->need_setup_ep = true;
- return 0; + unlock: + mutex_unlock(&subs->stream->chip->shutdown_mutex); + return ret; }
/* @@ -547,17 +552,26 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) struct usb_interface *iface; int ret;
+ mutex_lock(&subs->stream->chip->shutdown_mutex); + if (subs->stream->chip->shutdown) { + ret = -ENODEV; + goto unlock; + } + if (! subs->cur_audiofmt) { snd_printk(KERN_ERR "usbaudio: no format is specified!\n"); - return -ENXIO; + ret = -ENXIO; + goto unlock; }
- if (snd_BUG_ON(!subs->data_endpoint)) - return -EIO; + if (snd_BUG_ON(!subs->data_endpoint)) { + ret = -EIO; + goto unlock; + }
ret = set_format(subs, subs->cur_audiofmt); if (ret < 0) - return ret; + goto unlock;
iface = usb_ifnum_to_if(subs->dev, subs->cur_audiofmt->iface); alts = &iface->altsetting[subs->cur_audiofmt->altset_idx]; @@ -567,12 +581,12 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) subs->cur_audiofmt, subs->cur_rate); if (ret < 0) - return ret; + goto unlock;
if (subs->need_setup_ep) { ret = configure_endpoint(subs); if (ret < 0) - return ret; + goto unlock; subs->need_setup_ep = false; }
@@ -592,8 +606,10 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) /* for playback, submit the URBs now; otherwise, the first hwptr_done * updates for all URBs would happen at the same time when starting */ if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK) - return start_endpoints(subs, 1); + ret = start_endpoints(subs, 1);
+ unlock: + mutex_unlock(&subs->stream->chip->shutdown_mutex); return 0; }
@@ -980,14 +996,18 @@ static int snd_usb_pcm_open(struct snd_pcm_substream *substream, int direction) struct snd_usb_stream *as = snd_pcm_substream_chip(substream); struct snd_pcm_runtime *runtime = substream->runtime; struct snd_usb_substream *subs = &as->substream[direction]; + int ret;
+ mutex_lock(&as->chip->shutdown_mutex); subs->interface = -1; subs->altset_idx = 0; runtime->hw = snd_usb_hardware; runtime->private_data = subs; subs->pcm_substream = substream; /* runtime PM is also done there */ - return setup_hw_info(runtime, subs); + ret = setup_hw_info(runtime, subs); + mutex_unlock(&as->chip->shutdown_mutex); + return ret; }
static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction) @@ -995,6 +1015,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction) struct snd_usb_stream *as = snd_pcm_substream_chip(substream); struct snd_usb_substream *subs = &as->substream[direction];
+ mutex_lock(&as->chip->shutdown_mutex); stop_endpoints(subs, 0, 0, 0);
if (!as->chip->shutdown && subs->interface >= 0) { @@ -1004,6 +1025,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
subs->pcm_substream = NULL; snd_usb_autosuspend(subs->stream->chip); + mutex_unlock(&as->chip->shutdown_mutex);
return 0; } @@ -1222,6 +1244,9 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea { struct snd_usb_substream *subs = substream->runtime->private_data;
+ if (subs->stream->chip->shutdown) + return -ENODEV; + switch (cmd) { case SNDRV_PCM_TRIGGER_START: case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
At Thu, 11 Oct 2012 18:41:52 +0200, Takashi Iwai wrote:
[Added Daniel and Clemens in the loop]
At Thu, 11 Oct 2012 17:17:59 +0200, Matthieu CASTET wrote:
Hi,
while doing some monkey tests on a product we found races in usb audio code when the device in unplugged from usb (on linus master tree).
This can be reproduced with usb_audio_show_race.diff and CONFIG_DEBUG_SLAB. With this patch, start a stream : # arecord -D hw:0 -r 44100 -c 2 -f S16_LE > /dev/null you will see the kernel log : "in snd_usb_hw_params sleeping" Unplug the device before "in snd_usb_hw_params sleeping exit", and you will see an oops in snd_pcm_hw_params
Instead of using CONFIG_DEBUG_SLAB, usb_audio_show_use_after_free.diff can show use after free by setting usb_device pointer to NULL in snd_usb_audio_disconnect. [1]
In order to protect from all the races, before using any usb_device we need to check if it is not freed.
What's the best way to do that ?
A trival fix would be to take a mutex in all snd_pcm_ops callback that access usb :
{ mutex_lock(&chip->shutdown_mutex); if (!chip->dev) { mutex_unlock(&chip->shutdown_mutex); return -ENODEV; } [...] mutex_unlock(&chip->shutdown_mutex); }
But that will serialize all snd_pcm_ops callbacks.
We had already some protections but they don't cover the recent code rewrites at all, so this bad result for now.
Yes, the easiest and maybe sane way would be to put the mutex in each ops except for trigger. open, close, hw_params, hw_free and prepare are ops that don't need much parallelism, so this can be protected well. Or, we may introduce a new mutex per stream if we really want parallel operations, but I don't think it's worth.
The trigger callback is an atomic ops, so it won't need the check. Maybe the spinlock is needed to avoid the race in snd_usb_stream_disconnect().
Another solution could be to use refcounting or rwlock patern :
- snd_pcm_ops callbacks call rdlock_trylock/rdlock_unlock
- usb_driver disconnect callback take rwlock_lock and never release it
I don't think this is needed.
So... the below is a quick hack I did without testing at all. Hopefully this can give some advance.
I checked this issue again actually with a real machine, and tried a bit better version. I'm going to send a series of fix patches.
Takashi
Hi,
Takashi Iwai a écrit :
[Added Daniel and Clemens in the loop]
I don't think this is needed.
So... the below is a quick hack I did without testing at all. Hopefully this can give some advance.
Thanks for the quick patch.
The patch didn't apply cleany of linus tree, of which tree is based your patch ?
It solve the race in snd_usb_hw_params.
But I wonder if snd_usb_substream_playback_trigger, snd_usb_substream_capture_trigger, snd_usb_pcm_pointer are safe : they don't take shutdown_mutex.
Also it is hard to check if everything is safe. Sometimes the chip->shutdown is far from the shutdown_mutex. For example snd_usb_pcm_open take shutdown_mutex, but the check is done in snd_usb_autoresume.
I will do more testing.
Thanks,
Matthieu
Takashi
diff --git a/sound/usb/card.c b/sound/usb/card.c index 561bb74..115484e 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -131,9 +131,13 @@ static void snd_usb_stream_disconnect(struct list_head *head) subs = &as->substream[idx]; if (!subs->num_formats) continue;
if (subs->pcm_substream)snd_pcm_stream_lock_irq(subs->pcm_substream);if (subs->pcm_substream)snd_pcm_stream_unlock_irq(subs->pcm_substream);}
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 55e19e1..01e82ac 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -444,7 +444,6 @@ static int configure_endpoint(struct snd_usb_substream *subs) { int ret;
- mutex_lock(&subs->stream->chip->shutdown_mutex); /* format changed */ stop_endpoints(subs, 0, 0, 0); ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -455,7 +454,7 @@ static int configure_endpoint(struct snd_usb_substream *subs) subs->cur_audiofmt, subs->sync_endpoint); if (ret < 0)
goto unlock;
return ret;if (subs->sync_endpoint) ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -466,8 +465,6 @@ static int configure_endpoint(struct snd_usb_substream *subs) subs->cur_audiofmt, NULL);
-unlock:
- mutex_unlock(&subs->stream->chip->shutdown_mutex); return ret;
}
@@ -488,10 +485,15 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream, struct audioformat *fmt; int ret;
- mutex_lock(&subs->stream->chip->shutdown_mutex);
- if (subs->stream->chip->shutdown) {
ret = -ENODEV;goto unlock;- } ret = snd_pcm_lib_alloc_vmalloc_buffer(substream, params_buffer_bytes(hw_params)); if (ret < 0)
return ret;
goto unlock;subs->pcm_format = params_format(hw_params); subs->period_bytes = params_period_bytes(hw_params);
@@ -502,17 +504,20 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream, if (!fmt) { snd_printd(KERN_DEBUG "cannot set format: format = %#x, rate = %d, channels = %d\n", subs->pcm_format, subs->cur_rate, subs->channels);
return -EINVAL;
ret = -EINVAL;goto unlock;}
if ((ret = set_format(subs, fmt)) < 0)
return ret;
goto unlock;subs->interface = fmt->iface; subs->altset_idx = fmt->altset_idx; subs->need_setup_ep = true;
- return 0;
- unlock:
- mutex_unlock(&subs->stream->chip->shutdown_mutex);
- return ret;
}
/* @@ -547,17 +552,26 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) struct usb_interface *iface; int ret;
- mutex_lock(&subs->stream->chip->shutdown_mutex);
- if (subs->stream->chip->shutdown) {
ret = -ENODEV;goto unlock;- }
- if (! subs->cur_audiofmt) { snd_printk(KERN_ERR "usbaudio: no format is specified!\n");
return -ENXIO;
ret = -ENXIO;goto unlock;
- if (snd_BUG_ON(!subs->data_endpoint))
return -EIO;
if (snd_BUG_ON(!subs->data_endpoint)) {
ret = -EIO;goto unlock;}
ret = set_format(subs, subs->cur_audiofmt); if (ret < 0)
return ret;
goto unlock;iface = usb_ifnum_to_if(subs->dev, subs->cur_audiofmt->iface); alts = &iface->altsetting[subs->cur_audiofmt->altset_idx];
@@ -567,12 +581,12 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) subs->cur_audiofmt, subs->cur_rate); if (ret < 0)
return ret;
goto unlock;if (subs->need_setup_ep) { ret = configure_endpoint(subs); if (ret < 0)
return ret;
goto unlock;@@ -592,8 +606,10 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) /* for playback, submit the URBs now; otherwise, the first hwptr_done * updates for all URBs would happen at the same time when starting */ if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
return start_endpoints(subs, 1);
ret = start_endpoints(subs, 1);unlock:
mutex_unlock(&subs->stream->chip->shutdown_mutex); return 0;
}
@@ -980,14 +996,18 @@ static int snd_usb_pcm_open(struct snd_pcm_substream *substream, int direction) struct snd_usb_stream *as = snd_pcm_substream_chip(substream); struct snd_pcm_runtime *runtime = substream->runtime; struct snd_usb_substream *subs = &as->substream[direction];
int ret;
mutex_lock(&as->chip->shutdown_mutex); subs->interface = -1; subs->altset_idx = 0; runtime->hw = snd_usb_hardware; runtime->private_data = subs; subs->pcm_substream = substream; /* runtime PM is also done there */
- return setup_hw_info(runtime, subs);
- ret = setup_hw_info(runtime, subs);
- mutex_unlock(&as->chip->shutdown_mutex);
- return ret;
}
static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction) @@ -995,6 +1015,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction) struct snd_usb_stream *as = snd_pcm_substream_chip(substream); struct snd_usb_substream *subs = &as->substream[direction];
mutex_lock(&as->chip->shutdown_mutex); stop_endpoints(subs, 0, 0, 0);
if (!as->chip->shutdown && subs->interface >= 0) {
@@ -1004,6 +1025,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
subs->pcm_substream = NULL; snd_usb_autosuspend(subs->stream->chip);
mutex_unlock(&as->chip->shutdown_mutex);
return 0;
} @@ -1222,6 +1244,9 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea { struct snd_usb_substream *subs = substream->runtime->private_data;
- if (subs->stream->chip->shutdown)
return -ENODEV;- switch (cmd) { case SNDRV_PCM_TRIGGER_START: case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
At Fri, 12 Oct 2012 17:42:19 +0200, Matthieu CASTET wrote:
Hi,
Takashi Iwai a écrit :
[Added Daniel and Clemens in the loop]
I don't think this is needed.
So... the below is a quick hack I did without testing at all. Hopefully this can give some advance.
Thanks for the quick patch.
The patch didn't apply cleany of linus tree, of which tree is based your patch ?
Did you try the second one? The second one covers races in more places.
The only uncovered place is the autosuspend stuff in mixer.c (for PCM, it's used only in open/close, so it's no problem). I'll fix it later.
thanks,
Takashi
It solve the race in snd_usb_hw_params.
But I wonder if snd_usb_substream_playback_trigger, snd_usb_substream_capture_trigger, snd_usb_pcm_pointer are safe : they don't take shutdown_mutex.
Also it is hard to check if everything is safe. Sometimes the chip->shutdown is far from the shutdown_mutex. For example snd_usb_pcm_open take shutdown_mutex, but the check is done in snd_usb_autoresume.
I will do more testing.
Thanks,
Matthieu
Takashi
diff --git a/sound/usb/card.c b/sound/usb/card.c index 561bb74..115484e 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -131,9 +131,13 @@ static void snd_usb_stream_disconnect(struct list_head *head) subs = &as->substream[idx]; if (!subs->num_formats) continue;
if (subs->pcm_substream)snd_pcm_stream_lock_irq(subs->pcm_substream);if (subs->pcm_substream)snd_pcm_stream_unlock_irq(subs->pcm_substream);}
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c index 55e19e1..01e82ac 100644 --- a/sound/usb/pcm.c +++ b/sound/usb/pcm.c @@ -444,7 +444,6 @@ static int configure_endpoint(struct snd_usb_substream *subs) { int ret;
- mutex_lock(&subs->stream->chip->shutdown_mutex); /* format changed */ stop_endpoints(subs, 0, 0, 0); ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -455,7 +454,7 @@ static int configure_endpoint(struct snd_usb_substream *subs) subs->cur_audiofmt, subs->sync_endpoint); if (ret < 0)
goto unlock;
return ret;if (subs->sync_endpoint) ret = snd_usb_endpoint_set_params(subs->data_endpoint,
@@ -466,8 +465,6 @@ static int configure_endpoint(struct snd_usb_substream *subs) subs->cur_audiofmt, NULL);
-unlock:
- mutex_unlock(&subs->stream->chip->shutdown_mutex); return ret;
}
@@ -488,10 +485,15 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream, struct audioformat *fmt; int ret;
- mutex_lock(&subs->stream->chip->shutdown_mutex);
- if (subs->stream->chip->shutdown) {
ret = -ENODEV;goto unlock;- } ret = snd_pcm_lib_alloc_vmalloc_buffer(substream, params_buffer_bytes(hw_params)); if (ret < 0)
return ret;
goto unlock;subs->pcm_format = params_format(hw_params); subs->period_bytes = params_period_bytes(hw_params);
@@ -502,17 +504,20 @@ static int snd_usb_hw_params(struct snd_pcm_substream *substream, if (!fmt) { snd_printd(KERN_DEBUG "cannot set format: format = %#x, rate = %d, channels = %d\n", subs->pcm_format, subs->cur_rate, subs->channels);
return -EINVAL;
ret = -EINVAL;goto unlock;}
if ((ret = set_format(subs, fmt)) < 0)
return ret;
goto unlock;subs->interface = fmt->iface; subs->altset_idx = fmt->altset_idx; subs->need_setup_ep = true;
- return 0;
- unlock:
- mutex_unlock(&subs->stream->chip->shutdown_mutex);
- return ret;
}
/* @@ -547,17 +552,26 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) struct usb_interface *iface; int ret;
- mutex_lock(&subs->stream->chip->shutdown_mutex);
- if (subs->stream->chip->shutdown) {
ret = -ENODEV;goto unlock;- }
- if (! subs->cur_audiofmt) { snd_printk(KERN_ERR "usbaudio: no format is specified!\n");
return -ENXIO;
ret = -ENXIO;goto unlock;
- if (snd_BUG_ON(!subs->data_endpoint))
return -EIO;
if (snd_BUG_ON(!subs->data_endpoint)) {
ret = -EIO;goto unlock;}
ret = set_format(subs, subs->cur_audiofmt); if (ret < 0)
return ret;
goto unlock;iface = usb_ifnum_to_if(subs->dev, subs->cur_audiofmt->iface); alts = &iface->altsetting[subs->cur_audiofmt->altset_idx];
@@ -567,12 +581,12 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) subs->cur_audiofmt, subs->cur_rate); if (ret < 0)
return ret;
goto unlock;if (subs->need_setup_ep) { ret = configure_endpoint(subs); if (ret < 0)
return ret;
goto unlock;@@ -592,8 +606,10 @@ static int snd_usb_pcm_prepare(struct snd_pcm_substream *substream) /* for playback, submit the URBs now; otherwise, the first hwptr_done * updates for all URBs would happen at the same time when starting */ if (subs->direction == SNDRV_PCM_STREAM_PLAYBACK)
return start_endpoints(subs, 1);
ret = start_endpoints(subs, 1);unlock:
mutex_unlock(&subs->stream->chip->shutdown_mutex); return 0;
}
@@ -980,14 +996,18 @@ static int snd_usb_pcm_open(struct snd_pcm_substream *substream, int direction) struct snd_usb_stream *as = snd_pcm_substream_chip(substream); struct snd_pcm_runtime *runtime = substream->runtime; struct snd_usb_substream *subs = &as->substream[direction];
int ret;
mutex_lock(&as->chip->shutdown_mutex); subs->interface = -1; subs->altset_idx = 0; runtime->hw = snd_usb_hardware; runtime->private_data = subs; subs->pcm_substream = substream; /* runtime PM is also done there */
- return setup_hw_info(runtime, subs);
- ret = setup_hw_info(runtime, subs);
- mutex_unlock(&as->chip->shutdown_mutex);
- return ret;
}
static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction) @@ -995,6 +1015,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction) struct snd_usb_stream *as = snd_pcm_substream_chip(substream); struct snd_usb_substream *subs = &as->substream[direction];
mutex_lock(&as->chip->shutdown_mutex); stop_endpoints(subs, 0, 0, 0);
if (!as->chip->shutdown && subs->interface >= 0) {
@@ -1004,6 +1025,7 @@ static int snd_usb_pcm_close(struct snd_pcm_substream *substream, int direction)
subs->pcm_substream = NULL; snd_usb_autosuspend(subs->stream->chip);
mutex_unlock(&as->chip->shutdown_mutex);
return 0;
} @@ -1222,6 +1244,9 @@ static int snd_usb_substream_playback_trigger(struct snd_pcm_substream *substrea { struct snd_usb_substream *subs = substream->runtime->private_data;
- if (subs->stream->chip->shutdown)
return -ENODEV;- switch (cmd) { case SNDRV_PCM_TRIGGER_START: case SNDRV_PCM_TRIGGER_PAUSE_RELEASE:
Hi Takashi,
Takashi Iwai a écrit :
At Fri, 12 Oct 2012 17:42:19 +0200, Matthieu CASTET wrote:
Hi,
Takashi Iwai a écrit :
[Added Daniel and Clemens in the loop]
I don't think this is needed.
So... the below is a quick hack I did without testing at all. Hopefully this can give some advance.
Thanks for the quick patch.
The patch didn't apply cleany of linus tree, of which tree is based your patch ?
Did you try the second one? The second one covers races in more places.
The only uncovered place is the autosuspend stuff in mixer.c (for PCM, it's used only in open/close, so it's no problem). I'll fix it later.
I didn't have time to test your latest patches : I will test them tomorrow. On which git tree are they based ? gregkh/usb.git ?
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
Matthieu
[1] [ 30.768341] Alignment trap: not handling instruction e1960f9f at [<c0087ba4>] [ 30.775878] Unhandled fault: alignment exception (0x001) at 0x6b6b6c6f [ 30.782775] Internal error: : 1 [#1] SMP ARM [ 30.787292] Modules linked in: [ 30.790557] CPU: 0 Tainted: G W (3.6.0-03888-g9c0226d-dirty #25) [ 30.798187] PC is at __lock_acquire.clone.19+0x164/0xd40 [ 30.803802] LR is at lock_acquire+0x5c/0x70 [ 30.808227] pc : [<c0087ba8>] lr : [<c0088d54>] psr: 20000093 [ 30.808227] sp : cd727c70 ip : 00000001 fp : cd727ccc [ 30.820343] r10: c05c3994 r9 : c328c218 r8 : 6b6b6b6b [ 30.825866] r7 : cd74f640 r6 : 6b6b6c6f r5 : c05a4d5c r4 : cd726000 [ 30.832763] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : c328c218 [ 30.839660] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 30.847290] Control: 10c5387d Table: 8329c019 DAC: 00000015 [ 30.853363] Process arecord (pid: 635, stack limit = 0xcd7262f8) [ 30.859680] Stack: (0xcd727c70 to 0xcd728000) [ 30.864288] 7c60: 000000ec 00000000 c059ce68 00000001 [ 30.872955] 7c80: 00000000 c05c2cc0 00000009 c059ce38 60000013 00000004 cd727d14 cd727ca8 [ 30.881591] 7ca0: c00455b0 00000000 cd726000 60000013 cd74f640 c09c7d70 00000024 c3297440 [ 30.890228] 7cc0: cd727cfc cd727cd0 c0088d54 c0087a50 00000000 00000000 c02e3984 00000000 [ 30.898864] 7ce0: c328c208 00000001 c318cf40 c328c208 cd727d24 cd727d00 c03d8274 c0088d04 [ 30.907501] 7d00: 00000001 00000000 c02e3984 c32c7a48 c328c000 c32c7a48 cd727d44 cd727d28 [ 30.916107] 7d20: c02e3984 c03d824c c32c7a48 c328c000 00000000 07400000 cd727d64 cd727d48 [ 30.924774] 7d40: c02e68cc c02e3940 c04042d0 c32c7a48 c3291b20 07400000 cd727d8c cd727d68 [ 30.933380] 7d60: c02e3494 c02e6868 c3291b20 c32c7a48 cf9f83c0 00000000 c00f18c8 00000000 [ 30.942047] 7d80: cd727db4 cd727d90 c00f1960 c02e33f8 c00eedcc 00000000 c32c7a48 c3291b20 [ 30.950683] 7da0: c32c7a50 00000001 cd727ddc cd727db8 c00eb8b0 c00f18d4 cd727ea0 cd727f60 [ 30.959320] 7dc0: 00000000 00000000 cd727e98 00000000 cd727df4 cd727de0 c00eb96c c00eb6ec [ 30.967956] 7de0: cd727ea0 cd727ee0 cd727e6c cd727df8 c00fb974 c00eb950 cd727e6c cd727e08 [ 30.976593] 7e00: c00f8bd4 c00f8b1c c00f97fc 00000000 cd727ee0 00000001 00000000 cd727ee8 [ 30.985229] 7e20: 00000000 00000000 cf737178 c32c7a48 00000000 00000000 c3291b20 cd67f848 [ 30.993865] 7e40: 00000020 cd727ee0 c32c7a48 cd727f60 cd727e98 00000000 cd727ea0 cd726000 [ 31.002502] 7e60: cd727ed4 cd727e70 c00fc028 c00fb39c cd727ea0 cd727e80 00000000 c32cad64 [ 31.011138] 7e80: cd74f640 00000000 cd74f968 00000000 00000004 00000000 cf815e58 cf74a8f8 [ 31.019775] 7ea0: 00000000 00000000 cd726000 cd727f60 00000001 ffffff9c cfb07000 ffffff9c [ 31.028411] 7ec0: cd726000 00000000 cd727f54 cd727ed8 c00fc730 c00fbf84 00000041 00000000 [ 31.037048] 7ee0: cf815e58 cf74a8f8 35c12985 00000009 cfb07009 cd727e30 00000000 cf4fcb38 [ 31.045684] 7f00: c3291b20 00000101 00000008 00000000 00000000 cd773e98 cd727f54 cd727f28 [ 31.054321] 7f20: c0109814 c03d8818 00000000 cfb07000 00000000 00026150 cfb07000 00000000 [ 31.062957] 7f40: 00000003 00000001 cd727f94 cd727f58 c00ec7bc c00fc708 00000000 cd726000 [ 31.071594] 7f60: 00000000 00000000 00000024 00000100 becb28da b6eef8a0 00026150 00000005 [ 31.080261] 7f80: c0014728 00000000 cd727fa4 cd727f98 c00ec880 c00ec6d8 00000000 cd727fa8 [ 31.088897] 7fa0: c00145a0 c00ec864 becb28da b6eef8a0 becb28da 00000000 becb28ec ffffffff [ 31.097534] 7fc0: becb28da b6eef8a0 00026150 00000005 00000001 0001c3b8 000260b8 ffffffff [ 31.106170] 7fe0: 00000000 becb28d8 b6ea8c10 b6dc078c 60000010 becb28da de10c4ff be918a5f [ 31.114807] Backtrace: [ 31.117401] [<c0087a44>] (__lock_acquire.clone.19+0x0/0xd40) from [<c0088d54>] (lock_acquire+0x5c/0x70) [ 31.127349] [<c0088cf8>] (lock_acquire+0x0/0x70) from [<c03d8274>] (_raw_spin_lock+0x34/0x44) [ 31.136322] r7:c328c208 r6:c318cf40 r5:00000001 r4:c328c208 [ 31.142364] [<c03d8240>] (_raw_spin_lock+0x0/0x44) from [<c02e3984>] (snd_card_file_add+0x50/0xc0) [ 31.151824] r5:c32c7a48 r4:c328c000 [ 31.155639] [<c02e3934>] (snd_card_file_add+0x0/0xc0) from [<c02e68cc>] (snd_ctl_open+0x70/0x190) [ 31.164978] r7:07400000 r6:00000000 r5:c328c000 r4:c32c7a48 [ 31.170989] [<c02e685c>] (snd_ctl_open+0x0/0x190) from [<c02e3494>] (snd_open+0xa8/0x1a0) [ 31.179595] r7:07400000 r6:c3291b20 r5:c32c7a48 r4:c04042d0 [ 31.185638] [<c02e33ec>] (snd_open+0x0/0x1a0) from [<c00f1960>] (chrdev_open+0x98/0x160) [ 31.194183] [<c00f18c8>] (chrdev_open+0x0/0x160) from [<c00eb8b0>] (do_dentry_open.clone.18+0x1d0/0x264) [ 31.204193] r7:00000001 r6:c32c7a50 r5:c3291b20 r4:c32c7a48 [ 31.210205] [<c00eb6e0>] (do_dentry_open.clone.18+0x0/0x264) from [<c00eb96c>] (finish_open+0x28/0x40) [ 31.220062] [<c00eb944>] (finish_open+0x0/0x40) from [<c00fb974>] (do_last.clone.40+0x5e4/0xbe8) [ 31.229309] r4:cd727ee0 r3:cd727ea0 [ 31.233123] [<c00fb390>] (do_last.clone.40+0x0/0xbe8) from [<c00fc028>] (path_openat+0xb0/0x488) [ 31.242401] [<c00fbf78>] (path_openat+0x0/0x488) from [<c00fc730>] (do_filp_open+0x34/0x88) [ 31.251190] [<c00fc6fc>] (do_filp_open+0x0/0x88) from [<c00ec7bc>] (do_sys_open+0xf0/0x18c) [ 31.260009] r7:00000001 r6:00000003 r5:00000000 r4:cfb07000 [ 31.266021] [<c00ec6cc>] (do_sys_open+0x0/0x18c) from [<c00ec880>] (sys_open+0x28/0x2c) [ 31.274475] [<c00ec858>] (sys_open+0x0/0x2c) from [<c00145a0>] (ret_fast_syscall+0x0/0x30) [ 31.283203] Code: e3580000 0affffbe e2886f41 e1960f9f (e2800001) [ 31.289642] ---[ end trace e749a1146c99522c ]--- [ 31.294525] Kernel panic - not syncing: Fatal exception
diff --git a/sound/core/control.c b/sound/core/control.c index 2487a6b..34c80d4 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -45,6 +45,7 @@ static LIST_HEAD(snd_control_ioctls); static LIST_HEAD(snd_control_compat_ioctls); #endif
+#include <linux/delay.h> static int snd_ctl_open(struct inode *inode, struct file *file) { unsigned long flags; @@ -61,6 +62,10 @@ static int snd_ctl_open(struct inode *inode, struct file *file) err = -ENODEV; goto __error1; } + printk("msleep o %p\n", card); + msleep(5000); + printk("msleep o+\n"); + err = snd_card_file_add(card, file); if (err < 0) { err = -ENODEV;
At Mon, 15 Oct 2012 19:41:40 +0200, Matthieu CASTET wrote:
Hi Takashi,
Takashi Iwai a écrit :
At Fri, 12 Oct 2012 17:42:19 +0200, Matthieu CASTET wrote:
Hi,
Takashi Iwai a écrit :
[Added Daniel and Clemens in the loop]
I don't think this is needed.
So... the below is a quick hack I did without testing at all. Hopefully this can give some advance.
Thanks for the quick patch.
The patch didn't apply cleany of linus tree, of which tree is based your patch ?
Did you try the second one? The second one covers races in more places.
The only uncovered place is the autosuspend stuff in mixer.c (for PCM, it's used only in open/close, so it's no problem). I'll fix it later.
I didn't have time to test your latest patches : I will test them tomorrow. On which git tree are they based ? gregkh/usb.git ?
3.7-rc1.
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
OK, we'd need a generic open/close protection. For PCM, there is already a fix in my last patchset, so it should work, but for other devices, the paths are still uncovered.
Takashi
Matthieu
[1] [ 30.768341] Alignment trap: not handling instruction e1960f9f at [<c0087ba4>] [ 30.775878] Unhandled fault: alignment exception (0x001) at 0x6b6b6c6f [ 30.782775] Internal error: : 1 [#1] SMP ARM [ 30.787292] Modules linked in: [ 30.790557] CPU: 0 Tainted: G W (3.6.0-03888-g9c0226d-dirty #25) [ 30.798187] PC is at __lock_acquire.clone.19+0x164/0xd40 [ 30.803802] LR is at lock_acquire+0x5c/0x70 [ 30.808227] pc : [<c0087ba8>] lr : [<c0088d54>] psr: 20000093 [ 30.808227] sp : cd727c70 ip : 00000001 fp : cd727ccc [ 30.820343] r10: c05c3994 r9 : c328c218 r8 : 6b6b6b6b [ 30.825866] r7 : cd74f640 r6 : 6b6b6c6f r5 : c05a4d5c r4 : cd726000 [ 30.832763] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : c328c218 [ 30.839660] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 30.847290] Control: 10c5387d Table: 8329c019 DAC: 00000015 [ 30.853363] Process arecord (pid: 635, stack limit = 0xcd7262f8) [ 30.859680] Stack: (0xcd727c70 to 0xcd728000) [ 30.864288] 7c60: 000000ec 00000000 c059ce68 00000001 [ 30.872955] 7c80: 00000000 c05c2cc0 00000009 c059ce38 60000013 00000004 cd727d14 cd727ca8 [ 30.881591] 7ca0: c00455b0 00000000 cd726000 60000013 cd74f640 c09c7d70 00000024 c3297440 [ 30.890228] 7cc0: cd727cfc cd727cd0 c0088d54 c0087a50 00000000 00000000 c02e3984 00000000 [ 30.898864] 7ce0: c328c208 00000001 c318cf40 c328c208 cd727d24 cd727d00 c03d8274 c0088d04 [ 30.907501] 7d00: 00000001 00000000 c02e3984 c32c7a48 c328c000 c32c7a48 cd727d44 cd727d28 [ 30.916107] 7d20: c02e3984 c03d824c c32c7a48 c328c000 00000000 07400000 cd727d64 cd727d48 [ 30.924774] 7d40: c02e68cc c02e3940 c04042d0 c32c7a48 c3291b20 07400000 cd727d8c cd727d68 [ 30.933380] 7d60: c02e3494 c02e6868 c3291b20 c32c7a48 cf9f83c0 00000000 c00f18c8 00000000 [ 30.942047] 7d80: cd727db4 cd727d90 c00f1960 c02e33f8 c00eedcc 00000000 c32c7a48 c3291b20 [ 30.950683] 7da0: c32c7a50 00000001 cd727ddc cd727db8 c00eb8b0 c00f18d4 cd727ea0 cd727f60 [ 30.959320] 7dc0: 00000000 00000000 cd727e98 00000000 cd727df4 cd727de0 c00eb96c c00eb6ec [ 30.967956] 7de0: cd727ea0 cd727ee0 cd727e6c cd727df8 c00fb974 c00eb950 cd727e6c cd727e08 [ 30.976593] 7e00: c00f8bd4 c00f8b1c c00f97fc 00000000 cd727ee0 00000001 00000000 cd727ee8 [ 30.985229] 7e20: 00000000 00000000 cf737178 c32c7a48 00000000 00000000 c3291b20 cd67f848 [ 30.993865] 7e40: 00000020 cd727ee0 c32c7a48 cd727f60 cd727e98 00000000 cd727ea0 cd726000 [ 31.002502] 7e60: cd727ed4 cd727e70 c00fc028 c00fb39c cd727ea0 cd727e80 00000000 c32cad64 [ 31.011138] 7e80: cd74f640 00000000 cd74f968 00000000 00000004 00000000 cf815e58 cf74a8f8 [ 31.019775] 7ea0: 00000000 00000000 cd726000 cd727f60 00000001 ffffff9c cfb07000 ffffff9c [ 31.028411] 7ec0: cd726000 00000000 cd727f54 cd727ed8 c00fc730 c00fbf84 00000041 00000000 [ 31.037048] 7ee0: cf815e58 cf74a8f8 35c12985 00000009 cfb07009 cd727e30 00000000 cf4fcb38 [ 31.045684] 7f00: c3291b20 00000101 00000008 00000000 00000000 cd773e98 cd727f54 cd727f28 [ 31.054321] 7f20: c0109814 c03d8818 00000000 cfb07000 00000000 00026150 cfb07000 00000000 [ 31.062957] 7f40: 00000003 00000001 cd727f94 cd727f58 c00ec7bc c00fc708 00000000 cd726000 [ 31.071594] 7f60: 00000000 00000000 00000024 00000100 becb28da b6eef8a0 00026150 00000005 [ 31.080261] 7f80: c0014728 00000000 cd727fa4 cd727f98 c00ec880 c00ec6d8 00000000 cd727fa8 [ 31.088897] 7fa0: c00145a0 c00ec864 becb28da b6eef8a0 becb28da 00000000 becb28ec ffffffff [ 31.097534] 7fc0: becb28da b6eef8a0 00026150 00000005 00000001 0001c3b8 000260b8 ffffffff [ 31.106170] 7fe0: 00000000 becb28d8 b6ea8c10 b6dc078c 60000010 becb28da de10c4ff be918a5f [ 31.114807] Backtrace: [ 31.117401] [<c0087a44>] (__lock_acquire.clone.19+0x0/0xd40) from [<c0088d54>] (lock_acquire+0x5c/0x70) [ 31.127349] [<c0088cf8>] (lock_acquire+0x0/0x70) from [<c03d8274>] (_raw_spin_lock+0x34/0x44) [ 31.136322] r7:c328c208 r6:c318cf40 r5:00000001 r4:c328c208 [ 31.142364] [<c03d8240>] (_raw_spin_lock+0x0/0x44) from [<c02e3984>] (snd_card_file_add+0x50/0xc0) [ 31.151824] r5:c32c7a48 r4:c328c000 [ 31.155639] [<c02e3934>] (snd_card_file_add+0x0/0xc0) from [<c02e68cc>] (snd_ctl_open+0x70/0x190) [ 31.164978] r7:07400000 r6:00000000 r5:c328c000 r4:c32c7a48 [ 31.170989] [<c02e685c>] (snd_ctl_open+0x0/0x190) from [<c02e3494>] (snd_open+0xa8/0x1a0) [ 31.179595] r7:07400000 r6:c3291b20 r5:c32c7a48 r4:c04042d0 [ 31.185638] [<c02e33ec>] (snd_open+0x0/0x1a0) from [<c00f1960>] (chrdev_open+0x98/0x160) [ 31.194183] [<c00f18c8>] (chrdev_open+0x0/0x160) from [<c00eb8b0>] (do_dentry_open.clone.18+0x1d0/0x264) [ 31.204193] r7:00000001 r6:c32c7a50 r5:c3291b20 r4:c32c7a48 [ 31.210205] [<c00eb6e0>] (do_dentry_open.clone.18+0x0/0x264) from [<c00eb96c>] (finish_open+0x28/0x40) [ 31.220062] [<c00eb944>] (finish_open+0x0/0x40) from [<c00fb974>] (do_last.clone.40+0x5e4/0xbe8) [ 31.229309] r4:cd727ee0 r3:cd727ea0 [ 31.233123] [<c00fb390>] (do_last.clone.40+0x0/0xbe8) from [<c00fc028>] (path_openat+0xb0/0x488) [ 31.242401] [<c00fbf78>] (path_openat+0x0/0x488) from [<c00fc730>] (do_filp_open+0x34/0x88) [ 31.251190] [<c00fc6fc>] (do_filp_open+0x0/0x88) from [<c00ec7bc>] (do_sys_open+0xf0/0x18c) [ 31.260009] r7:00000001 r6:00000003 r5:00000000 r4:cfb07000 [ 31.266021] [<c00ec6cc>] (do_sys_open+0x0/0x18c) from [<c00ec880>] (sys_open+0x28/0x2c) [ 31.274475] [<c00ec858>] (sys_open+0x0/0x2c) from [<c00145a0>] (ret_fast_syscall+0x0/0x30) [ 31.283203] Code: e3580000 0affffbe e2886f41 e1960f9f (e2800001) [ 31.289642] ---[ end trace e749a1146c99522c ]--- [ 31.294525] Kernel panic - not syncing: Fatal exception [2 diff <text/plain (base64)>] diff --git a/sound/core/control.c b/sound/core/control.c index 2487a6b..34c80d4 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -45,6 +45,7 @@ static LIST_HEAD(snd_control_ioctls); static LIST_HEAD(snd_control_compat_ioctls); #endif
+#include <linux/delay.h> static int snd_ctl_open(struct inode *inode, struct file *file) { unsigned long flags; @@ -61,6 +62,10 @@ static int snd_ctl_open(struct inode *inode, struct file *file) err = -ENODEV; goto __error1; }
printk("msleep o %p\n", card);msleep(5000);printk("msleep o+\n");- err = snd_card_file_add(card, file); if (err < 0) { err = -ENODEV;
At Mon, 15 Oct 2012 20:45:44 +0200, Takashi Iwai wrote:
At Mon, 15 Oct 2012 19:41:40 +0200, Matthieu CASTET wrote:
Hi Takashi,
Takashi Iwai a écrit :
At Fri, 12 Oct 2012 17:42:19 +0200, Matthieu CASTET wrote:
Hi,
Takashi Iwai a écrit :
[Added Daniel and Clemens in the loop]
I don't think this is needed.
So... the below is a quick hack I did without testing at all. Hopefully this can give some advance.
Thanks for the quick patch.
The patch didn't apply cleany of linus tree, of which tree is based your patch ?
Did you try the second one? The second one covers races in more places.
The only uncovered place is the autosuspend stuff in mixer.c (for PCM, it's used only in open/close, so it's no problem). I'll fix it later.
I didn't have time to test your latest patches : I will test them tomorrow. On which git tree are they based ? gregkh/usb.git ?
3.7-rc1.
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
OK, we'd need a generic open/close protection. For PCM, there is already a fix in my last patchset, so it should work, but for other devices, the paths are still uncovered.
I hacked a bit more fixes but had no time to test them due to another bug (hit an NFS problem on server). If you are interested, feel free to test topic/usb-disconnect-fix branch of sound-unstable git tree
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-unstable.git
The master branch of sound-unstable tree contains all patches but is likely broken. Just pull topic/usb-disconnect-fix branch onto the upstream Linus tree.
thanks,
Takashi
Takashi
Matthieu
[1] [ 30.768341] Alignment trap: not handling instruction e1960f9f at [<c0087ba4>] [ 30.775878] Unhandled fault: alignment exception (0x001) at 0x6b6b6c6f [ 30.782775] Internal error: : 1 [#1] SMP ARM [ 30.787292] Modules linked in: [ 30.790557] CPU: 0 Tainted: G W (3.6.0-03888-g9c0226d-dirty #25) [ 30.798187] PC is at __lock_acquire.clone.19+0x164/0xd40 [ 30.803802] LR is at lock_acquire+0x5c/0x70 [ 30.808227] pc : [<c0087ba8>] lr : [<c0088d54>] psr: 20000093 [ 30.808227] sp : cd727c70 ip : 00000001 fp : cd727ccc [ 30.820343] r10: c05c3994 r9 : c328c218 r8 : 6b6b6b6b [ 30.825866] r7 : cd74f640 r6 : 6b6b6c6f r5 : c05a4d5c r4 : cd726000 [ 30.832763] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : c328c218 [ 30.839660] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 30.847290] Control: 10c5387d Table: 8329c019 DAC: 00000015 [ 30.853363] Process arecord (pid: 635, stack limit = 0xcd7262f8) [ 30.859680] Stack: (0xcd727c70 to 0xcd728000) [ 30.864288] 7c60: 000000ec 00000000 c059ce68 00000001 [ 30.872955] 7c80: 00000000 c05c2cc0 00000009 c059ce38 60000013 00000004 cd727d14 cd727ca8 [ 30.881591] 7ca0: c00455b0 00000000 cd726000 60000013 cd74f640 c09c7d70 00000024 c3297440 [ 30.890228] 7cc0: cd727cfc cd727cd0 c0088d54 c0087a50 00000000 00000000 c02e3984 00000000 [ 30.898864] 7ce0: c328c208 00000001 c318cf40 c328c208 cd727d24 cd727d00 c03d8274 c0088d04 [ 30.907501] 7d00: 00000001 00000000 c02e3984 c32c7a48 c328c000 c32c7a48 cd727d44 cd727d28 [ 30.916107] 7d20: c02e3984 c03d824c c32c7a48 c328c000 00000000 07400000 cd727d64 cd727d48 [ 30.924774] 7d40: c02e68cc c02e3940 c04042d0 c32c7a48 c3291b20 07400000 cd727d8c cd727d68 [ 30.933380] 7d60: c02e3494 c02e6868 c3291b20 c32c7a48 cf9f83c0 00000000 c00f18c8 00000000 [ 30.942047] 7d80: cd727db4 cd727d90 c00f1960 c02e33f8 c00eedcc 00000000 c32c7a48 c3291b20 [ 30.950683] 7da0: c32c7a50 00000001 cd727ddc cd727db8 c00eb8b0 c00f18d4 cd727ea0 cd727f60 [ 30.959320] 7dc0: 00000000 00000000 cd727e98 00000000 cd727df4 cd727de0 c00eb96c c00eb6ec [ 30.967956] 7de0: cd727ea0 cd727ee0 cd727e6c cd727df8 c00fb974 c00eb950 cd727e6c cd727e08 [ 30.976593] 7e00: c00f8bd4 c00f8b1c c00f97fc 00000000 cd727ee0 00000001 00000000 cd727ee8 [ 30.985229] 7e20: 00000000 00000000 cf737178 c32c7a48 00000000 00000000 c3291b20 cd67f848 [ 30.993865] 7e40: 00000020 cd727ee0 c32c7a48 cd727f60 cd727e98 00000000 cd727ea0 cd726000 [ 31.002502] 7e60: cd727ed4 cd727e70 c00fc028 c00fb39c cd727ea0 cd727e80 00000000 c32cad64 [ 31.011138] 7e80: cd74f640 00000000 cd74f968 00000000 00000004 00000000 cf815e58 cf74a8f8 [ 31.019775] 7ea0: 00000000 00000000 cd726000 cd727f60 00000001 ffffff9c cfb07000 ffffff9c [ 31.028411] 7ec0: cd726000 00000000 cd727f54 cd727ed8 c00fc730 c00fbf84 00000041 00000000 [ 31.037048] 7ee0: cf815e58 cf74a8f8 35c12985 00000009 cfb07009 cd727e30 00000000 cf4fcb38 [ 31.045684] 7f00: c3291b20 00000101 00000008 00000000 00000000 cd773e98 cd727f54 cd727f28 [ 31.054321] 7f20: c0109814 c03d8818 00000000 cfb07000 00000000 00026150 cfb07000 00000000 [ 31.062957] 7f40: 00000003 00000001 cd727f94 cd727f58 c00ec7bc c00fc708 00000000 cd726000 [ 31.071594] 7f60: 00000000 00000000 00000024 00000100 becb28da b6eef8a0 00026150 00000005 [ 31.080261] 7f80: c0014728 00000000 cd727fa4 cd727f98 c00ec880 c00ec6d8 00000000 cd727fa8 [ 31.088897] 7fa0: c00145a0 c00ec864 becb28da b6eef8a0 becb28da 00000000 becb28ec ffffffff [ 31.097534] 7fc0: becb28da b6eef8a0 00026150 00000005 00000001 0001c3b8 000260b8 ffffffff [ 31.106170] 7fe0: 00000000 becb28d8 b6ea8c10 b6dc078c 60000010 becb28da de10c4ff be918a5f [ 31.114807] Backtrace: [ 31.117401] [<c0087a44>] (__lock_acquire.clone.19+0x0/0xd40) from [<c0088d54>] (lock_acquire+0x5c/0x70) [ 31.127349] [<c0088cf8>] (lock_acquire+0x0/0x70) from [<c03d8274>] (_raw_spin_lock+0x34/0x44) [ 31.136322] r7:c328c208 r6:c318cf40 r5:00000001 r4:c328c208 [ 31.142364] [<c03d8240>] (_raw_spin_lock+0x0/0x44) from [<c02e3984>] (snd_card_file_add+0x50/0xc0) [ 31.151824] r5:c32c7a48 r4:c328c000 [ 31.155639] [<c02e3934>] (snd_card_file_add+0x0/0xc0) from [<c02e68cc>] (snd_ctl_open+0x70/0x190) [ 31.164978] r7:07400000 r6:00000000 r5:c328c000 r4:c32c7a48 [ 31.170989] [<c02e685c>] (snd_ctl_open+0x0/0x190) from [<c02e3494>] (snd_open+0xa8/0x1a0) [ 31.179595] r7:07400000 r6:c3291b20 r5:c32c7a48 r4:c04042d0 [ 31.185638] [<c02e33ec>] (snd_open+0x0/0x1a0) from [<c00f1960>] (chrdev_open+0x98/0x160) [ 31.194183] [<c00f18c8>] (chrdev_open+0x0/0x160) from [<c00eb8b0>] (do_dentry_open.clone.18+0x1d0/0x264) [ 31.204193] r7:00000001 r6:c32c7a50 r5:c3291b20 r4:c32c7a48 [ 31.210205] [<c00eb6e0>] (do_dentry_open.clone.18+0x0/0x264) from [<c00eb96c>] (finish_open+0x28/0x40) [ 31.220062] [<c00eb944>] (finish_open+0x0/0x40) from [<c00fb974>] (do_last.clone.40+0x5e4/0xbe8) [ 31.229309] r4:cd727ee0 r3:cd727ea0 [ 31.233123] [<c00fb390>] (do_last.clone.40+0x0/0xbe8) from [<c00fc028>] (path_openat+0xb0/0x488) [ 31.242401] [<c00fbf78>] (path_openat+0x0/0x488) from [<c00fc730>] (do_filp_open+0x34/0x88) [ 31.251190] [<c00fc6fc>] (do_filp_open+0x0/0x88) from [<c00ec7bc>] (do_sys_open+0xf0/0x18c) [ 31.260009] r7:00000001 r6:00000003 r5:00000000 r4:cfb07000 [ 31.266021] [<c00ec6cc>] (do_sys_open+0x0/0x18c) from [<c00ec880>] (sys_open+0x28/0x2c) [ 31.274475] [<c00ec858>] (sys_open+0x0/0x2c) from [<c00145a0>] (ret_fast_syscall+0x0/0x30) [ 31.283203] Code: e3580000 0affffbe e2886f41 e1960f9f (e2800001) [ 31.289642] ---[ end trace e749a1146c99522c ]--- [ 31.294525] Kernel panic - not syncing: Fatal exception [2 diff <text/plain (base64)>] diff --git a/sound/core/control.c b/sound/core/control.c index 2487a6b..34c80d4 100644 --- a/sound/core/control.c +++ b/sound/core/control.c @@ -45,6 +45,7 @@ static LIST_HEAD(snd_control_ioctls); static LIST_HEAD(snd_control_compat_ioctls); #endif
+#include <linux/delay.h> static int snd_ctl_open(struct inode *inode, struct file *file) { unsigned long flags; @@ -61,6 +62,10 @@ static int snd_ctl_open(struct inode *inode, struct file *file) err = -ENODEV; goto __error1; }
printk("msleep o %p\n", card);msleep(5000);printk("msleep o+\n");- err = snd_card_file_add(card, file); if (err < 0) { err = -ENODEV;
Takashi Iwai a écrit :
At Mon, 15 Oct 2012 19:41:40 +0200, Matthieu CASTET wrote:
Hi Takashi,
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
OK, we'd need a generic open/close protection. For PCM, there is already a fix in my last patchset, so it should work, but for other devices, the paths are still uncovered.
I don't think it will work for pcm : the begin of snd_pcm_open is not protected by any lock even with your patch In snd_open we release sound_mutex before calling file->f_op->open.
The snd_lookup_minor_data and snd_card_file_add should be protected by a lock. Attached a patch (pcm.crash) that help to trigger [1].
One idea could be to do the snd_card_file_add in snd_lookup_minor_data : it will be protected by sound_mutex.
That what rfc attachement does (with debug printk and delay) : it add a snd_lookup_minor_data2 that do the snd_card_file_add.
Matthieu
[1]
# cat /dev/pcmC0D0c [ 572.187866] msleep o cf1e1200 [ 573.534454] usb 1-2: USB disconnect, device number 2 [ 573.543670] usb 1-2.1: USB disconnect, device number 3 [ 573.561645] usb 1-2.1.2: USB disconnect, device number 4 [ 577.337005] msleep o+ [ 577.339477] Unable to handle kernel paging request at virtual address 6b6b6d87 [ 577.347106] pgd = cccf4000 [ 577.349975] [6b6b6d87] *pgd=00000000 [ 577.353759] Internal error: Oops: 5 [#1] PREEMPT SMP ARM [ 577.359374] Modules linked in: [ 577.362640] CPU: 0 Not tainted (3.7.0-rc1-00004-gd6355f5-dirty #27) [ 577.369628] PC is at __lock_acquire.clone.19+0x150/0xd40 [ 577.375274] LR is at lock_acquire+0x5c/0x70 [ 577.379699] pc : [<c0088b10>] lr : [<c0089cd0>] psr: 80000093 [ 577.379699] sp : cca01c28 ip : 00000001 fp : cca01c84 [ 577.391784] r10: c05d5814 r9 : 6b6b6d83 r8 : 00000080 [ 577.397308] r7 : cf15f480 r6 : 00000000 r5 : c05b67bc r4 : cca00000 [ 577.404205] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : 6b6b6d83 [ 577.411102] Flags: Nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment user [ 577.418731] Control: 10c5387d Table: 8ccf4019 DAC: 00000015 [ 577.424804] Process cat (pid: 642, stack limit = 0xcca00240) [ 577.430786] Stack: (0xcca01c28 to 0xcca02000) [ 577.435394] 1c20: 00000001 20000093 000000c4 00000000 c05ae4a8 00000001 [ 577.444030] 1c40: 00000000 c05d4b40 00000009 c05ae478 60000013 00000004 cca01ccc 00000000 [ 577.452667] 1c60: cca00000 60000013 cf15f480 00000001 00000024 cf7bcd40 cca01cb4 cca01c88 [ 577.461334] 1c80: c0089cd0 c00889cc 00000000 00000000 c02eacec 00000000 6b6b6d73 c02eacec [ 577.469970] 1ca0: ccd12f00 6b6b6d73 cca01cdc cca01cb8 c03e5234 c0089c80 00000001 00000000 [ 577.478607] 1cc0: c02eacec cf0980a8 6b6b6b6b cf0980a8 cca01cfc cca01ce0 c02eacec c03e51f8 [ 577.487243] 1ce0: cf0980a8 ffffffff c05b65d4 cf1e1200 cca01d4c cca01d00 c02fbb84 c02eaca8 [ 577.495880] 1d00: 22222222 cf1e1200 00000018 cd9d0120 07400018 c09d9af8 cca01d34 cca01d28 [ 577.504547] 1d20: c03e33fc cf0980a8 cd9d0120 cd9d0120 07400018 c09d9af8 00000024 cf7bcd40 [ 577.513183] 1d40: cca01d64 cca01d50 c02fbd90 c02fbb20 c0411378 cf0980a8 cca01d8c cca01d68 [ 577.521820] 1d60: c02ea810 c02fbd58 cd9d0120 cf0980a8 cf1fb1c0 00000000 c00f505c 00000000 [ 577.530456] 1d80: cca01db4 cca01d90 c00f50f4 c02ea774 c00f25cc 00000018 cf0980a8 cd9d0120 [ 577.539093] 1da0: cf0980b0 00020001 cca01ddc cca01db8 c00ef404 c00f5068 cca01ea0 cca01f60 [ 577.547729] 1dc0: 00000000 00020000 cca01e98 00000000 cca01df4 cca01de0 c00ef4c0 c00ef240 [ 577.556365] 1de0: cca01ea0 cca01ee0 cca01e6c cca01df8 c00fe348 c00ef4a4 cca01e6c cca01e08 [ 577.565002] 1e00: c00fb704 c00fb4a8 cca01e3c cca01e18 c004b2c8 c007d99c 00000000 cca01ee8 [ 577.573638] 1e20: 00000000 00000000 ceb2f178 cf0980a8 cf016e58 ceb2f178 cd9d0120 cf2fa830 [ 577.582275] 1e40: 386d45b8 cca01ee0 ceb42bf8 cca01e98 cca01f60 00000000 cca01ea0 cca00000 [ 577.590911] 1e60: cca01ed4 cca01e70 c00fec00 c00fdd70 cca01ea0 00000000 00000004 00000000 [ 577.599548] 1e80: 000000e5 00000000 cf0980a8 cca01e90 cf016e58 ceb42bf8 cf016e58 ceb40d38 [ 577.608215] 1ea0: 00000000 00000000 cca01ee4 cca01f60 00000001 ffffff9c cf30f000 ffffff9c [ 577.616851] 1ec0: cca00000 00000000 cca01f54 cca01ed8 c00ff0f8 c00fe958 00000041 cf0235e0 [ 577.625488] 1ee0: cf016e58 ceb40d38 d24edc20 00000008 ce487d44 cf7b3d90 cf016318 ce8021f8 [ 577.634124] 1f00: cd9d0120 00000101 00000004 00000000 00000000 ce487d40 00020000 cf30f000 [ 577.642761] 1f20: 00020000 be9ecf92 00000001 ffffff9c cca00000 00000000 cf30f000 00020000 [ 577.651397] 1f40: 00000003 00000001 cca01f94 cca01f58 c00f044c c00ff0d0 c0060598 c03e44d0 [ 577.660034] 1f60: 00020000 cca00000 00000024 00000100 00000000 00000000 be9ecf92 00000005 [ 577.668701] 1f80: c0014808 00000000 cca01fa4 cca01f98 c00f0504 c00f036c 00000000 cca01fa8 [ 577.677337] 1fa0: c0014660 c00f04e8 00000000 00000000 be9ecf92 00020000 00000000 000030ec [ 577.685974] 1fc0: 00000000 00000000 be9ecf92 00000005 00000008 00000000 b6f5f000 00000000 [ 577.694610] 1fe0: b6e163b0 be9eccd0 0000d898 b6e16400 60000010 be9ecf92 00000000 00000000 [ 577.703247] Backtrace: [ 577.705841] [<c00889c0>] (__lock_acquire.clone.19+0x0/0xd40) from [<c0089cd0>] (lock_acquire+0x5c/0x70) [ 577.715789] [<c0089c74>] (lock_acquire+0x0/0x70) from [<c03e5234>] (_raw_spin_lock+0x48/0x58) [ 577.724792] r7:6b6b6d73 r6:ccd12f00 r5:c02eacec r4:6b6b6d73 [ 577.730834] [<c03e51ec>] (_raw_spin_lock+0x0/0x58) from [<c02eacec>] (snd_card_file_add+0x50/0xac) [ 577.740295] r5:cf0980a8 r4:6b6b6b6b [ 577.744110] [<c02eac9c>] (snd_card_file_add+0x0/0xac) from [<c02fbb84>] (snd_pcm_open+0x70/0x238) [ 577.753479] r7:cf1e1200 r6:c05b65d4 r5:ffffffff r4:cf0980a8 [ 577.759521] [<c02fbb14>] (snd_pcm_open+0x0/0x238) from [<c02fbd90>] (snd_pcm_capture_open+0x44/0x48) [ 577.769165] [<c02fbd4c>] (snd_pcm_capture_open+0x0/0x48) from [<c02ea810>] (snd_open+0xa8/0x1a0) [ 577.778442] r5:cf0980a8 r4:c0411378 [ 577.782257] [<c02ea768>] (snd_open+0x0/0x1a0) from [<c00f50f4>] (chrdev_open+0x98/0x160) [ 577.790832] [<c00f505c>] (chrdev_open+0x0/0x160) from [<c00ef404>] (do_dentry_open.clone.16+0x1d0/0x264) [ 577.800842] r7:00020001 r6:cf0980b0 r5:cd9d0120 r4:cf0980a8 [ 577.806884] [<c00ef234>] (do_dentry_open.clone.16+0x0/0x264) from [<c00ef4c0>] (finish_open+0x28/0x40) [ 577.816711] [<c00ef498>] (finish_open+0x0/0x40) from [<c00fe348>] (do_last.clone.47+0x5e4/0xbe8) [ 577.825988] r4:cca01ee0 r3:cca01ea0 [ 577.829803] [<c00fdd64>] (do_last.clone.47+0x0/0xbe8) from [<c00fec00>] (path_openat.clone.48+0x2b4/0x488) [ 577.839996] [<c00fe94c>] (path_openat.clone.48+0x0/0x488) from [<c00ff0f8>] (do_filp_open+0x34/0x88) [ 577.849670] [<c00ff0c4>] (do_filp_open+0x0/0x88) from [<c00f044c>] (do_sys_open+0xec/0x17c) [ 577.858489] r7:00000001 r6:00000003 r5:00020000 r4:cf30f000 [ 577.864532] [<c00f0360>] (do_sys_open+0x0/0x17c) from [<c00f0504>] (sys_open+0x28/0x2c) [ 577.872985] [<c00f04dc>] (sys_open+0x0/0x2c) from [<c0014660>] (ret_fast_syscall+0x0/0x30) [ 577.881744] Code: ebfeebea e1a00004 ea000038 e0890106 (e5908004) [ 577.888183] ---[ end trace 5c43a835149de569 ]---
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index 8753c89..0cbe471 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -2130,11 +2130,16 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file) return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE); }
+#include <linux/delay.h> static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream) { int err; wait_queue_t wait;
+ printk("msleep o %p\n", pcm); + mdelay(5000); + printk("msleep o+\n"); + if (pcm == NULL) { err = -ENODEV; goto __error1;
diff --git a/include/sound/core.h b/include/sound/core.h index bc05668..9869087 100644 --- a/include/sound/core.h +++ b/include/sound/core.h @@ -185,6 +185,7 @@ static inline int snd_power_wait(struct snd_card *card, unsigned int state) { re struct snd_minor { int type; /* SNDRV_DEVICE_TYPE_XXX */ int card; /* card number */ + struct snd_card *cardp; int device; /* device number */ const struct file_operations *f_ops; /* file operations */ void *private_data; /* private data for f_ops->open */ @@ -241,6 +242,7 @@ static inline int snd_register_device(int type, struct snd_card *card, int dev,
int snd_unregister_device(int type, struct snd_card *card, int dev); void *snd_lookup_minor_data(unsigned int minor, int type); +void *snd_lookup_minor_data2(unsigned int minor, int type, struct file *file); int snd_add_device_sysfs_file(int type, struct snd_card *card, int dev, struct device_attribute *attr);
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c index 8753c89..c2445c0 100644 --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -2114,8 +2114,8 @@ static int snd_pcm_playback_open(struct inode *inode, struct file *file) int err = nonseekable_open(inode, file); if (err < 0) return err; - pcm = snd_lookup_minor_data(iminor(inode), - SNDRV_DEVICE_TYPE_PCM_PLAYBACK); + pcm = snd_lookup_minor_data2(iminor(inode), + SNDRV_DEVICE_TYPE_PCM_PLAYBACK, file); return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_PLAYBACK); }
@@ -2125,23 +2125,24 @@ static int snd_pcm_capture_open(struct inode *inode, struct file *file) int err = nonseekable_open(inode, file); if (err < 0) return err; - pcm = snd_lookup_minor_data(iminor(inode), - SNDRV_DEVICE_TYPE_PCM_CAPTURE); + pcm = snd_lookup_minor_data2(iminor(inode), + SNDRV_DEVICE_TYPE_PCM_CAPTURE, file); return snd_pcm_open(file, pcm, SNDRV_PCM_STREAM_CAPTURE); }
+#include <linux/delay.h> static int snd_pcm_open(struct file *file, struct snd_pcm *pcm, int stream) { int err; wait_queue_t wait;
+ printk("msleep o2 %p\n", pcm); + mdelay(5000); + printk("msleep o2+\n"); if (pcm == NULL) { err = -ENODEV; goto __error1; } - err = snd_card_file_add(pcm->card, file); - if (err < 0) - goto __error1; if (!try_module_get(pcm->card->module)) { err = -EFAULT; goto __error2; diff --git a/sound/core/sound.c b/sound/core/sound.c index 6439760..5ea8010 100644 --- a/sound/core/sound.c +++ b/sound/core/sound.c @@ -118,6 +118,35 @@ void *snd_lookup_minor_data(unsigned int minor, int type)
EXPORT_SYMBOL(snd_lookup_minor_data);
+#include <linux/delay.h> +void *snd_lookup_minor_data2(unsigned int minor, int type, struct file *file) +{ + struct snd_minor *mreg; + void *private_data; + + if (minor >= ARRAY_SIZE(snd_minors)) + return NULL; + mutex_lock(&sound_mutex); + mreg = snd_minors[minor]; + if (mreg && mreg->type == type) + private_data = mreg->private_data; + else + private_data = NULL; + printk("msleep o %p\n", NULL); + mdelay(5000); + printk("msleep o+\n"); + + + if (private_data) { + if (snd_card_file_add(mreg->cardp, file) < 0) + private_data = NULL; + } + mutex_unlock(&sound_mutex); + return private_data; +} + +EXPORT_SYMBOL(snd_lookup_minor_data2); + #ifdef CONFIG_MODULES static struct snd_minor *autoload_device(unsigned int minor) { @@ -272,6 +301,7 @@ int snd_register_device_for_dev(int type, struct snd_card *card, int dev, return -ENOMEM; preg->type = type; preg->card = card ? card->number : -1; + preg->cardp = card; preg->device = dev; preg->f_ops = f_ops; preg->private_data = private_data;
At Tue, 16 Oct 2012 18:01:13 +0200, Matthieu CASTET wrote:
Takashi Iwai a écrit :
At Mon, 15 Oct 2012 19:41:40 +0200, Matthieu CASTET wrote:
Hi Takashi,
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
OK, we'd need a generic open/close protection. For PCM, there is already a fix in my last patchset, so it should work, but for other devices, the paths are still uncovered.
I don't think it will work for pcm : the begin of snd_pcm_open is not protected by any lock even with your patch In snd_open we release sound_mutex before calling file->f_op->open.
The snd_lookup_minor_data and snd_card_file_add should be protected by a lock. Attached a patch (pcm.crash) that help to trigger [1].
Check out my latest patches in topic/usb-disconnect-fix branch. It's been fixed there.
Takashi
Takashi Iwai a écrit :
At Tue, 16 Oct 2012 18:01:13 +0200, Matthieu CASTET wrote:
Takashi Iwai a écrit :
At Mon, 15 Oct 2012 19:41:40 +0200, Matthieu CASTET wrote:
Hi Takashi,
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
OK, we'd need a generic open/close protection. For PCM, there is already a fix in my last patchset, so it should work, but for other devices, the paths are still uncovered.
I don't think it will work for pcm : the begin of snd_pcm_open is not protected by any lock even with your patch In snd_open we release sound_mutex before calling file->f_op->open.
The snd_lookup_minor_data and snd_card_file_add should be protected by a lock. Attached a patch (pcm.crash) that help to trigger [1].
Check out my latest patches in topic/usb-disconnect-fix branch. It's been fixed there.
Thanks,
the first tests seems ok. We will do more strees test.
Matthieu
At Thu, 18 Oct 2012 17:39:05 +0200, Matthieu CASTET wrote:
Takashi Iwai a écrit :
At Tue, 16 Oct 2012 18:01:13 +0200, Matthieu CASTET wrote:
Takashi Iwai a écrit :
At Mon, 15 Oct 2012 19:41:40 +0200, Matthieu CASTET wrote:
Hi Takashi,
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
OK, we'd need a generic open/close protection. For PCM, there is already a fix in my last patchset, so it should work, but for other devices, the paths are still uncovered.
I don't think it will work for pcm : the begin of snd_pcm_open is not protected by any lock even with your patch In snd_open we release sound_mutex before calling file->f_op->open.
The snd_lookup_minor_data and snd_card_file_add should be protected by a lock. Attached a patch (pcm.crash) that help to trigger [1].
Check out my latest patches in topic/usb-disconnect-fix branch. It's been fixed there.
Thanks,
the first tests seems ok. We will do more strees test.
OK, thanks!
I seem to have forgotten to send two patches in that branch to ML. Will follow soon.
Takashi
At Thu, 18 Oct 2012 17:39:05 +0200, Matthieu CASTET wrote:
Takashi Iwai a écrit :
At Tue, 16 Oct 2012 18:01:13 +0200, Matthieu CASTET wrote:
Takashi Iwai a écrit :
At Mon, 15 Oct 2012 19:41:40 +0200, Matthieu CASTET wrote:
Hi Takashi,
But I believe I found other races in the alsa char device handling. With the attached patch, if you disconnect the usb audio device between "msleep o" and "msleep o+", you will free the card resource (snd_card_do_free) and then use it [1].
I did in in snd_ctl_open, but the same thing could be done in snd_pcm_open, ...
OK, we'd need a generic open/close protection. For PCM, there is already a fix in my last patchset, so it should work, but for other devices, the paths are still uncovered.
I don't think it will work for pcm : the begin of snd_pcm_open is not protected by any lock even with your patch In snd_open we release sound_mutex before calling file->f_op->open.
The snd_lookup_minor_data and snd_card_file_add should be protected by a lock. Attached a patch (pcm.crash) that help to trigger [1].
Check out my latest patches in topic/usb-disconnect-fix branch. It's been fixed there.
Thanks,
the first tests seems ok. We will do more strees test.
Do you have any good/bad test result? If no regression is seen, I'm going to apply the patches for 3.7-rc4.
thanks,
Takashi
Takashi Iwai a écrit :
Thanks,
the first tests seems ok. We will do more strees test.
Do you have any good/bad test result? If no regression is seen, I'm going to apply the patches for 3.7-rc4.
The patches fix the races.
But I saw a failure I didn't saw before during stress test [1]. It is hard to say if it is related to your patches : - we test on a older kernel version and I backported usbaudio from 3.7 with your patches - the start of the trace is missing and it is difficult to understand the list corruption.
Matthieu
[1] <4>[ 570.313385] bf40: c06ae6a0 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.313385] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.313415] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.313446] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.313476] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.313476] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.313507] unwind: Unknown symbol address c0108984 <4>[ 570.313507] unwind: Index not found c0108984 <4>[ 570.313507] ---[ end trace 069f4a4f8aedac20 ]--- <4>[ 570.324859] ------------[ cut here ]------------ <4>[ 570.324890] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.324920] Process swapper (0) <4>[ 570.324920] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.324951] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.325012] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.325012] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.325042] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.325073] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.325103] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.325103] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.325134] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.325164] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.325195] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.325195] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.325225] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.325256] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.325256] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.325286] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.325317] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.325347] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.325347] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.325347] bf20: 000e4e42 00000000 000e4e42 00000000 <4>[ 570.325378] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.325408] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.325408] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.325439] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.325469] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.325469] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.325500] unwind: Unknown symbol address c0108984 <4>[ 570.325500] unwind: Index not found c0108984 <4>[ 570.325500] ---[ end trace 069f4a4f8aedac21 ]--- <4>[ 570.336883] ------------[ cut here ]------------ <4>[ 570.336914] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.336914] Process swapper (0) <4>[ 570.336944] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.336944] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.337005] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.337036] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.337066] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.337066] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.337097] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.337127] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.337158] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.337158] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.337188] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.337219] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.337219] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.337249] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.337280] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.337310] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.337310] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.337341] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.337341] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.337371] bf20: 0008fe22 00000000 0008fe22 00000000 <4>[ 570.337371] bf40: c06ae6a0 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.337402] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.337402] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.337432] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.337463] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.337493] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.337493] unwind: Unknown symbol address c0108984 <4>[ 570.337493] unwind: Index not found c0108984 <4>[ 570.337524] ---[ end trace 069f4a4f8aedac22 ]--- <4>[ 570.348876] ------------[ cut here ]------------ <4>[ 570.348907] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.348937] Process swapper (0) <4>[ 570.348937] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.348968] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.349029] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.349060] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.349060] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.349090] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.349121] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.349151] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.349182] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.349212] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.349212] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.349243] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.349273] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.349273] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.349304] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.349334] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.349365] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.349365] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.349395] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.349395] bf20: 0007ad24 00000000 0007ad24 00000000 <4>[ 570.349426] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.349426] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.349456] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.349487] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.349487] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.349517] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.349548] unwind: Unknown symbol address c0108984 <4>[ 570.349548] unwind: Index not found c0108984 <4>[ 570.349548] ---[ end trace 069f4a4f8aedac23 ]--- <4>[ 570.360900] ------------[ cut here ]------------ <4>[ 570.360931] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.360931] Process swapper (0) <4>[ 570.360961] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.360961] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.361053] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.361053] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.361083] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.361114] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.361145] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.361175] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.361175] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.361206] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.361236] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.361267] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.361267] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.361297] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.361328] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.361358] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.361358] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.361389] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.361389] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.361419] bf20: 000198f4 00000000 000198f4 00000000 <4>[ 570.361419] bf40: c06ae6a0 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.361450] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.361480] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.361480] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.361511] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.361541] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.361541] unwind: Unknown symbol address c0108984 <4>[ 570.361541] unwind: Index not found c0108984 <4>[ 570.361572] ---[ end trace 069f4a4f8aedac24 ]--- <4>[ 570.372894] ------------[ cut here ]------------ <4>[ 570.372924] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.372924] Process swapper (0) <4>[ 570.372955] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.372955] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.373016] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.373046] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.373077] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.373107] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.373138] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.373138] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.373168] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.373199] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.373229] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.373229] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.373260] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.373260] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.373291] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.373321] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.373352] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.373382] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.373382] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.373382] bf20: 0004747a 00000000 0004747a 00000000 <4>[ 570.373413] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.373443] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.373443] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.373474] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.373504] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.373504] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.373535] unwind: Unknown symbol address c0108984 <4>[ 570.373535] unwind: Index not found c0108984 <4>[ 570.373535] ---[ end trace 069f4a4f8aedac25 ]--- <4>[ 570.384857] ------------[ cut here ]------------ <4>[ 570.384887] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.384918] Process swapper (0) <4>[ 570.384918] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.384948] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.385009] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.385009] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.385040] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.385070] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.385101] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.385101] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.385131] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.385162] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.385192] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.385192] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.385223] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.385253] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.385253] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.385284] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.385314] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.385314] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.385345] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.385345] bf20: 000e8cc2 00000000 000e8cc2 00000000 <4>[ 570.385375] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.385375] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.385406] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.385437] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.385437] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.385467] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.385498] unwind: Unknown symbol address c0108984 <4>[ 570.385498] unwind: Index not found c0108984 <4>[ 570.385498] ---[ end trace 069f4a4f8aedac26 ]--- <4>[ 570.396881] ------------[ cut here ]------------ <4>[ 570.396911] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.396942] Process swapper (0) <4>[ 570.396942] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.396942] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.397003] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.397033] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.397064] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.397094] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.397094] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.397125] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.397155] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.397186] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.397186] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.397216] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.397247] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.397247] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.397277] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.397308] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.397308] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.397338] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.397369] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.397369] bf20: 00018d63 00000000 00018d63 00000000 <4>[ 570.397399] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.397399] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.397430] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.397430] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.397460] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.397491] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.397491] unwind: Unknown symbol address c0108984 <4>[ 570.397521] unwind: Index not found c0108984 <4>[ 570.397521] ---[ end trace 069f4a4f8aedac27 ]--- <4>[ 570.408874] ------------[ cut here ]------------ <4>[ 570.408905] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.408905] Process swapper (0) <4>[ 570.408935] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.408935] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.408996] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.409027] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.409057] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.409057] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.409088] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.409118] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.409149] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.409179] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.409179] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.409210] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.409210] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.409240] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.409271] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.409301] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.409301] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.409332] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.409332] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.409362] bf20: 00019941 00000000 00019941 00000000 <4>[ 570.409362] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.409393] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.409423] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.409423] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.409454] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.409484] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.409484] unwind: Unknown symbol address c0108984 <4>[ 570.409484] unwind: Index not found c0108984 <4>[ 570.409515] ---[ end trace 069f4a4f8aedac28 ]--- <4>[ 570.420837] ------------[ cut here ]------------ <4>[ 570.420867] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.420898] Process swapper (0) <4>[ 570.420898] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.420898] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.420989] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.421020] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.421020] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.421051] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.421081] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.421112] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.421142] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.421142] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.421173] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.421203] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.421203] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.421234] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.421264] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.421295] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.421295] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.421325] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.421325] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.421356] bf20: 0002af59 00000000 0002af59 00000000 <4>[ 570.421356] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.421386] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.421417] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.421417] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.421447] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.421478] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.421478] unwind: Unknown symbol address c0108984 <4>[ 570.421478] unwind: Index not found c0108984 <4>[ 570.421508] ---[ end trace 069f4a4f8aedac29 ]--- <4>[ 570.432861] ------------[ cut here ]------------ <4>[ 570.432891] WARNING: at /kernel/omap/lib/list_debug.c:30 __list_add+0x60/0x80() <4>[ 570.432922] Process swapper (0) <4>[ 570.432922] list_add corruption. prev->next should be next (d76f3e50), but was ced0bd98. (prev=ced0bb18). <4>[ 570.432922] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.433013] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c016f828>] (warn_slowpath_common+0x6c/0x88) <4>[ 570.433013] [<c016f828>] (warn_slowpath_common+0x6c/0x88) from [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) <4>[ 570.433044] [<c016f8c4>] (warn_slowpath_fmt+0x2c/0x3c) from [<c02983fc>] (__list_add+0x60/0x80) <4>[ 570.433074] [<c02983fc>] (__list_add+0x60/0x80) from [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) <4>[ 570.433074] [<c034e8d0>] (usb_hcd_link_urb_to_ep+0x88/0xb8) from [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) <4>[ 570.433105] [<c0365cc0>] (ehci_urb_enqueue+0x584/0xee0) from [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) <4>[ 570.433135] [<c03509b4>] (usb_hcd_submit_urb+0x92c/0x960) from [<c042403c>] (snd_complete_urb+0x204/0x258) <4>[ 570.433166] [<c042403c>] (snd_complete_urb+0x204/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 570.433197] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 570.433197] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 570.433227] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 570.433227] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 570.433258] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 570.433288] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 570.433319] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 570.433319] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 570.433349] Exception stack(0xc065bf30 to 0xc065bf78) <4>[ 570.433349] bf20: 0007764f 00000000 0007764f 00000000 <4>[ 570.433380] bf40: c06ae684 c06ae684 00000003 00000003 8012bd80 413fc082 00000000 00000000 <4>[ 570.433380] bf60: 3b9ac9ff c065bf78 c014f224 c014f230 60000053 ffffffff <4>[ 570.433410] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c014f230>] (omap3_enter_idle+0x104/0x134) <4>[ 570.433441] [<c014f230>] (omap3_enter_idle+0x104/0x134) from [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) <4>[ 570.433441] [<c03ef4f4>] (cpuidle_idle_call+0xa4/0x108) from [<c0139cf0>] (cpu_idle+0x40/0x94) <4>[ 570.433471] [<c0139cf0>] (cpu_idle+0x40/0x94) from [<c0108984>] (start_kernel+0x280/0x2e0) <4>[ 570.433471] unwind: Unknown symbol address c0108984 <4>[ 570.433502] unwind: Index not found c0108984 <4>[ 570.433502] ---[ end trace 069f4a4f8aedac2a ]--- <6>[ 570.442962] usb 1-2.4: USB disconnect, address 8 <1>[ 570.453521] Unable to handle kernel paging request at virtual address 6b6b6b6b <1>[ 570.461120] pgd = c0104000 <1>[ 570.463958] [6b6b6b6b] *pgd=00000000 <0>[ 570.467712] Internal error: Oops: 5 [#1] PREEMPT <0>[ 570.472534] last sysfs file: /sys/devices/platform/ehci-omap.0/usb1/1-2/1-2.4/idProduct <4>[ 570.480926] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 570.495025] CPU: 0 Tainted: G W (2.6.35.13-02836-g764dcf5 #12) <4>[ 570.502349] PC is at usb_hcd_flush_endpoint+0x9c/0x160 <4>[ 570.507751] LR is at usb_disable_endpoint+0x6c/0x84 <4>[ 570.512847] pc : [<c034f6b4>] lr : [<c03518b0>] psr: 20000093 <4>[ 570.512878] sp : dfd89e38 ip : 00000002 fp : d7691280 <4>[ 570.524902] r10: 6b6b6b53 r9 : 00000100 r8 : df42a100 <4>[ 570.530395] r7 : d76f3e50 r6 : d76f3e40 r5 : 6b6b6b53 r4 : dfd88000 <4>[ 570.537231] r3 : 6b6b6b6b r2 : 6b6b6b6b r1 : d76f3e40 r0 : d7691280 <4>[ 570.544067] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel <4>[ 570.551818] Control: 10c5387d Table: 9f7a4019 DAC: 00000015 <4>[ 570.557861] <4>[ 570.557861] PC: 0xc034f634: <4>[ 570.562316] f634 e3c4403f e5943004 e2833001 e5843004 e2867010 e5965010 e2455018 ea000016 <4>[ 570.570953] f654 e5952010 e3520000 12435018 1a000012 e1a00005 eb000664 e5943004 e2433001 <4>[ 570.579559] f674 e5843004 e5943000 e3130002 0a000000 eb06adc2 e1a01005 e3e0206b e1a00008 <4>[ 570.588165] f694 ebffff91 e1a00005 eb000687 e5943004 e2833001 e5843004 eaffffe5 e1a0a005 <4>[ 570.596771] f6b4 e5ba3018 f5d3f000 e15a0007 1affffe3 f1080080 e1a0200d e3c23d7f e3c3303f <4>[ 570.605377] f6d4 e5932004 e2422001 e5832004 e5933000 e3130002 0a000000 eb06ada8 e1a0300d <4>[ 570.613983] f6f4 e3c34d7f e3c4403f ea000019 f10c0080 e5943004 e2833001 e5843004 e5963010 <4>[ 570.622589] f714 e153000a 03a05000 0a000003 e5965014 e2455018 e1a00005 eb000633 f1080080 <4>[ 570.631195] <4>[ 570.631195] LR: 0xc0351830: <4>[ 570.635681] 1830 059111c4 15911184 e3510000 012fff1e eafff28e e92d4070 e2504000 e1a06002 <4>[ 570.644287] 1850 08bd8070 e2113080 e201100f 1a000005 e2811070 e3520000 e0841101 e5915004 <4>[ 570.652893] 1870 0a000007 ea000005 e2811060 e3520000 e0841101 e5915004 0a000001 e3a03000 <4>[ 570.661499] 1890 e5813004 e3550000 08bd8070 e3a03000 e1a00004 e5853028 e1a01005 ebfff759 <4>[ 570.670104] 18b0 e3560000 08bd8070 e1a00004 e1a01005 e8bd4070 eafff265 e92d41f0 e5903180 <4>[ 570.678710] 18d0 e1a04000 e1a05001 e3530000 13a07000 1a00000b ea00002d e7936101 e5d63048 <4>[ 570.687316] 18f0 e3130002 0a000006 e5d63018 e1a00006 e3833004 e5c63018 ebffff85 e2860020 <4>[ 570.695922] 1910 ebfecade e5943180 e2871014 e5d32004 e1570002 e2877001 baffffee e3a06000 <4>[ 570.704528] <4>[ 570.704528] SP: 0xdfd89db8: <4>[ 570.709014] 9db8 dfc00080 dfc02e40 0000000f c01e2060 ceca0258 dfc05c10 00000010 dfc0010c <4>[ 570.717620] 9dd8 ceca0000 ffffffff dfd89e24 d76f3e40 d76f3e50 c0138a6c d7691280 d76f3e40 <4>[ 570.726226] 9df8 6b6b6b6b 6b6b6b6b dfd88000 6b6b6b53 d76f3e40 d76f3e50 df42a100 00000100 <4>[ 570.734832] 9e18 6b6b6b53 d7691280 00000002 dfd89e38 c03518b0 c034f6b4 20000093 ffffffff <4>[ 570.743438] 9e38 d7691280 d76f3e40 00000000 00000000 d7691280 00000100 c069ac48 c03518b0 <4>[ 570.752044] 9e58 0000002c 00000001 d76f30e4 c03519e8 d57c9aa0 d57c9a80 d7691280 00000000 <4>[ 570.760650] 9e78 c069ac18 c0354750 d57c9aa0 c069ac48 c068d208 00000002 df5902bc 00000100 <4>[ 570.769256] 9e98 0000001f c0306708 d57c9ad4 d57c9aa0 c068d208 c0306858 d57c9aa0 d76912e8 <4>[ 570.777862] <4>[ 570.777893] FP: 0xd7691200: <4>[ 570.782348] 1200 4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439 c0000000 00a00000 <4>[ 570.790954] 1220 00004000 80080080 00000000 00000022 635688c0 d84156c5 00000021 c0406b78 <4>[ 570.799560] 1240 4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439 c0000000 0800c000 <4>[ 570.808166] 1260 00000001 0a200000 00a00008 40000028 84004000 00000000 635688c0 d84156c5 <4>[ 570.816772] 1280 00000008 00342e32 00000000 00000000 00000000 00000004 00000000 00000003 <4>[ 570.825378] 12a0 00000000 00000000 00000009 00000008 df590080 df42a100 00000507 00000040 <4>[ 570.833984] 12c0 00000000 00000000 d76912c8 d76912c8 d76f3240 d7545d80 00000000 00000000 <4>[ 570.842590] 12e0 00000001 00000000 df5900e8 d76ae7c0 d72e0300 d57c9aac dc5ec35c df5900f0 <4>[ 570.851196] <4>[ 570.851196] R0: 0xd7691200: <4>[ 570.855682] 1200 4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439 c0000000 00a00000 <4>[ 570.864288] 1220 00004000 80080080 00000000 00000022 635688c0 d84156c5 00000021 c0406b78 <4>[ 570.872894] 1240 4468ffff 00074409 4468ffff 0007441c 46a00b02 08074439 c0000000 0800c000 <4>[ 570.881500] 1260 00000001 0a200000 00a00008 40000028 84004000 00000000 635688c0 d84156c5 <4>[ 570.890106] 1280 00000008 00342e32 00000000 00000000 00000000 00000004 00000000 00000003 <4>[ 570.898712] 12a0 00000000 00000000 00000009 00000008 df590080 df42a100 00000507 00000040 <4>[ 570.907318] 12c0 00000000 00000000 d76912c8 d76912c8 d76f3240 d7545d80 00000000 00000000 <4>[ 570.915924] 12e0 00000001 00000000 df5900e8 d76ae7c0 d72e0300 d57c9aac dc5ec35c df5900f0 <4>[ 570.924530] <4>[ 570.924530] R1: 0xd76f3dc0: <4>[ 570.929016] 3dc0 4468ffff 00092409 4468ffff 0009241c 46a00701 08092439 c0000000 00040080 <4>[ 570.937622] 3de0 00008000 00000000 00000001 00000000 635688c0 d84156c5 00808040 c03558d0 <4>[ 570.946228] 3e00 4468ffff 00092409 4468ffff 0009241c 46a8ffff 08092439 c0000000 01000080 <4>[ 570.954833] 3e20 00000020 00190020 00000500 05800000 50800000 00200000 635688c0 d84156c5 <4>[ 570.963439] 3e40 01810509 000400c0 00000000 00000000 ced0b758 ced0bb18 cf9ee0c0 00000000 <4>[ 570.972045] 3e60 d7259175 00000007 00000000 00000000 00000000 00000000 00000000 00000000 <4>[ 570.980651] 3e80 4468ffff 00092409 4468ffff 0009241c 46a00b02 08092439 c0000000 00400080 <4>[ 570.989257] 3ea0 00002000 80004000 01000000 00810000 635688c0 d84156c5 00a80002 c03558d0 <4>[ 570.997894] <4>[ 570.997894] R4: 0xdfd87f80: <4>[ 571.002349] 7f80 635688c0 d84156c5 dfd65180 c023041c 635688c0 d84156c5 00000001 00000000 <4>[ 571.010955] 7fa0 dfd87a40 dfd87f08 c05c3c7c 00000000 c068a894 00000000 00000002 00008124 <4>[ 571.019561] 7fc0 0000073c 00000000 635688c0 d84156c5 00000013 c023041c 00000000 00000000 <4>[ 571.028167] 7fe0 00000000 c01813f8 dfd63400 c0181354 c01399a0 c01399a0 ffeffdfa fffffb5e <4>[ 571.036773] 8000 00000000 00000003 00000000 dfd68c40 c0670c70 00000000 00000015 dfd68c40 <4>[ 571.045379] 8020 dfd88000 c06707d8 dc9fdb40 c0670bd4 de3a9690 d74c81c0 dfd89e54 dfd89e28 <4>[ 571.053985] 8040 c04fab54 00000000 00000000 00000000 00000000 00000000 00000000 00000000 <4>[ 571.062591] 8060 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 <4>[ 571.071228] <4>[ 571.071228] R6: 0xd76f3dc0: <4>[ 571.075683] 3dc0 4468ffff 00092409 4468ffff 0009241c 46a00701 08092439 c0000000 00040080 <4>[ 571.084289] 3de0 00008000 00000000 00000001 00000000 635688c0 d84156c5 00808040 c03558d0 <4>[ 571.092895] 3e00 4468ffff 00092409 4468ffff 0009241c 46a8ffff 08092439 c0000000 01000080 <4>[ 571.101531] 3e20 00000020 00190020 00000500 05800000 50800000 00200000 635688c0 d84156c5 <4>[ 571.110137] 3e40 01810509 000400c0 00000000 00000000 ced0b758 ced0bb18 cf9ee0c0 00000000 <4>[ 571.118743] 3e60 d7259175 00000007 00000000 00000000 00000000 00000000 00000000 00000000 <4>[ 571.127349] 3e80 4468ffff 00092409 4468ffff 0009241c 46a00b02 08092439 c0000000 00400080 <4>[ 571.135955] 3ea0 00002000 80004000 01000000 00810000 635688c0 d84156c5 00a80002 c03558d0 <4>[ 571.144561] <4>[ 571.144561] R7: 0xd76f3dd0: <4>[ 571.149017] 3dd0 46a00701 08092439 c0000000 00040080 00008000 00000000 00000001 00000000 <4>[ 571.157623] 3df0 635688c0 d84156c5 00808040 c03558d0 4468ffff 00092409 4468ffff 0009241c <4>[ 571.166259] 3e10 46a8ffff 08092439 c0000000 01000080 00000020 00190020 00000500 05800000 <4>[ 571.174865] 3e30 50800000 00200000 635688c0 d84156c5 01810509 000400c0 00000000 00000000 <4>[ 571.183471] 3e50 ced0b758 ced0bb18 cf9ee0c0 00000000 d7259175 00000007 00000000 00000000 <4>[ 571.192077] 3e70 00000000 00000000 00000000 00000000 4468ffff 00092409 4468ffff 0009241c <4>[ 571.200683] 3e90 46a00b02 08092439 c0000000 00400080 00002000 80004000 01000000 00810000 <4>[ 571.209289] 3eb0 635688c0 d84156c5 00a80002 c03558d0 4468ffff 00092409 4468ffff 0009241c <4>[ 571.217895] <4>[ 571.217895] R8: 0xdf42a080: <4>[ 571.222351] a080 dfffd040 df510000 000000c0 df42a0c0 00000006 ffffffff 00000000 fffffffe <4>[ 571.230957] a0a0 fffffffe fffffffe fffffffe fffffffe fffffffe 00000000 00000000 00000000 <4>[ 571.239562] a0c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 <4>[ 571.248168] a0e0 00000000 00000000 00000000 00000000 00000000 00000000 635688c0 d84156c5 <4>[ 571.256774] a100 c066f5d8 00000001 dfcf1d00 00000001 ffffffff 0000000f 000059de 00000000 <4>[ 571.265380] a120 00000000 00000000 df522080 00000000 c068d19c dfc73030 00000005 00000005 <4>[ 571.273986] a140 00000002 df806aa8 00000000 00000000 0000000c c05f06a6 69636865 6463685f <4>[ 571.282592] a160 6273753a 00000031 00000000 00000000 00000000 00200200 ffff8c07 c06efd80 <0>[ 571.291229] Process khubd (pid: 269, stack limit = 0xdfd882e8) <0>[ 571.297332] Stack: (0xdfd89e38 to 0xdfd8a000) <0>[ 571.301910] 9e20: d7691280 d76f3e40 <0>[ 571.310485] 9e40: 00000000 00000000 d7691280 00000100 c069ac48 c03518b0 0000002c 00000001 <0>[ 571.319061] 9e60: d76f30e4 c03519e8 d57c9aa0 d57c9a80 d7691280 00000000 c069ac18 c0354750 <0>[ 571.327636] 9e80: d57c9aa0 c069ac48 c068d208 00000002 df5902bc 00000100 0000001f c0306708 <0>[ 571.336242] 9ea0: d57c9ad4 d57c9aa0 c068d208 c0306858 d57c9aa0 d76912e8 c068d208 c0305d80 <0>[ 571.344818] 9ec0: d57c9aa0 d76912e8 d57c9a80 c03045a0 d7691280 00000000 d57c9a80 c0351914 <0>[ 571.353393] 9ee0: d7691280 d769131c d76912e8 d76912fc df5902bc c034c780 dfc91700 00000001 <0>[ 571.361968] 9f00: 00000004 dfd88000 df590080 00000100 c068d044 c034d630 dfc1db30 dfc1db00 <0>[ 571.370574] 9f20: dfc1db30 dfc1db00 00000001 dfd68c70 df42a118 daff45a0 00000000 daff45a0 <0>[ 571.379150] 9f40: df42a100 df590080 00000004 df60d280 df59008c dfc91703 dfc91738 daff4580 <0>[ 571.387725] 9f60: 00000000 00000003 dfc91740 dfc91790 dfc91708 df59011c 00000009 dfc9173c <0>[ 571.396301] 9f80: dfc91734 dfd89f94 00000000 dfd68c40 c0185954 dfd89f94 dfd89f94 00000101 <0>[ 571.404876] 9fa0: 01000001 c018560c 00000000 dfc31f68 dfd89fd4 c034d1c4 00000000 00000000 <0>[ 571.413452] 9fc0: 00000000 00000000 00000000 c0185624 00000000 00000000 dfd89fd8 dfd89fd8 <0>[ 571.422058] 9fe0: 00000000 dfc31f68 c01855ac c01399a0 00000013 c01399a0 feefff7b ffffd9ef <4>[ 571.430633] [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) from [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) <4>[ 571.441223] [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) from [<c03519e8>] (usb_disable_interface+0x30/0x4c) <4>[ 571.451629] [<c03519e8>] (usb_disable_interface+0x30/0x4c) from [<c0354750>] (usb_unbind_interface+0x50/0x1a8) <4>[ 571.462158] [<c0354750>] (usb_unbind_interface+0x50/0x1a8) from [<c0306708>] (__device_release_driver+0x84/0xd0) <4>[ 571.472839] [<c0306708>] (__device_release_driver+0x84/0xd0) from [<c0306858>] (device_release_driver+0x1c/0x28) <4>[ 571.483520] [<c0306858>] (device_release_driver+0x1c/0x28) from [<c0305d80>] (bus_remove_device+0xa4/0xb4) <4>[ 571.493621] [<c0305d80>] (bus_remove_device+0xa4/0xb4) from [<c03045a0>] (device_del+0x110/0x16c) <4>[ 571.502960] [<c03045a0>] (device_del+0x110/0x16c) from [<c0351914>] (usb_disable_device+0x4c/0xf0) <4>[ 571.512359] [<c0351914>] (usb_disable_device+0x4c/0xf0) from [<c034c780>] (usb_disconnect+0x90/0x134) <4>[ 571.522033] [<c034c780>] (usb_disconnect+0x90/0x134) from [<c034d630>] (hub_thread+0x46c/0xf00) <4>[ 571.531158] [<c034d630>] (hub_thread+0x46c/0xf00) from [<c0185624>] (kthread+0x78/0x80) <4>[ 571.539581] [<c0185624>] (kthread+0x78/0x80) from [<c01399a0>] (kernel_thread_exit+0x0/0x8) <0>[ 571.548339] Code: e2833001 e5843004 eaffffe5 e1a0a005 (e5ba3018) <1>[ 571.554748] Unable to handle kernel paging request at virtual address 6b6b6b6b <1>[ 571.562316] pgd = c0104000 <1>[ 571.565155] [6b6b6b6b] *pgd=00000000 <0>[ 571.568908] Internal error: Oops: 5 [#2] PREEMPT <0>[ 571.573760] last sysfs file: /sys/devices/platform/ehci-omap.0/usb1/1-2/1-2.4/idProduct <4>[ 571.582122] Modules linked in: blackberry cdc_acm sierra option usb_wwan hso omap3_isp tnx_mxt_ts cp210x pl2303 usbserial 88w8688_wlan tun omap_hsmmc <4>[ 571.596252] CPU: 0 Tainted: G D W (2.6.35.13-02836-g764dcf5 #12) <4>[ 571.603546] PC is at snd_complete_urb+0x230/0x258 <4>[ 571.608489] LR is at usb_hcd_giveback_urb+0xa0/0xec <4>[ 571.613616] pc : [<c0424068>] lr : [<c034f494>] psr: 00000193 <4>[ 571.613616] sp : dfd89b38 ip : ced0b898 fp : ffffffb9 <4>[ 571.625640] r10: 00000000 r9 : df4d3670 r8 : 00000000 <4>[ 571.631134] r7 : df42a100 r6 : ced0b880 r5 : cf9202c8 r4 : 6b6b6b6b <4>[ 571.637969] r3 : 00000000 r2 : ced0b880 r1 : 00000000 r0 : ced0b880 <4>[ 571.644805] Flags: nzcv IRQs off FIQs on Mode SVC_32 ISA ARM Segment kernel <4>[ 571.652587] Control: 10c5387d Table: 9f7a4019 DAC: 00000015 <4>[ 571.658599] <4>[ 571.658599] PC: 0xc0423fe8: <4>[ 571.663085] 3fe8 e794e00c e082200e e595e014 e2811010 e150000e e2800001 bafffff5 e5832054 <4>[ 571.671691] 4008 e5952014 e5832068 ea000006 e3022994 e3a01000 e7942002 e583107c e3520004 <4>[ 571.680297] 4028 23a02004 e5832080 e3a01020 e1a00006 ebfcb34f e2501000 08bd81f0 e59f0040 <4>[ 571.688903] 4048 eb0359bb e2841da5 e5950010 e281101c e8bd41f0 eaf9992a e373006c 0afffff8 <4>[ 571.697509] 4068 e5943000 e5d3302c e3130001 0affff7a eafffff3 e1a00004 e1a01005 ebfffad9 <4>[ 571.706115] 4088 eaffffe8 c060bb8c e92d4ff8 e1a06000 e2807014 e1a04000 e1a00007 e1a05001 <4>[ 571.714721] 40a8 e1a0b003 e1a0a002 e59d9028 eb035dcc e5b63040 e30209ac e30219b0 ea00000d <4>[ 571.723327] 40c8 e2433da6 e2438038 e5133030 e153000a 1a000007 e5d53002 e798c000 e15c0003 <4>[ 571.731933] <4>[ 571.731933] LR: 0xc034f414: <4>[ 571.736419] f414 11a05003 1a00000a e5913040 e3130001 0a000007 e5911058 e2753001 33a03000 <4>[ 571.745025] f434 e5942054 e1510002 23a03000 e3530000 13e05078 e1a00006 e1a01004 ebffff97 <4>[ 571.753631] f454 e596304c e3530000 0a000006 e59f3070 e1a00006 e1a01004 e1a02005 e5933000 <4>[ 571.762237] f474 e1a0e00f e593f008 e1a00004 eb00076c e584503c e1a00004 e1a0e00f e594f078 <4>[ 571.770843] f494 e2843008 e1932f9f e2422001 e1831f92 e3310000 1afffffa e594300c e3530000 <4>[ 571.779449] f4b4 0a000004 e59f001c e3a01003 e3a02001 e3a03000 ebf86e03 e1a00004 e8bd4070 <4>[ 571.788055] f4d4 ea0006f9 c0707b34 c068d194 e92d41f0 e591302c e1a05001 e1a04000 e1a08002 <4>[ 571.796661] f4f4 e5933030 e3530000 1a00003f e10f6000 f10c0080 e1a0c00d e3cc3d7f e3c3303f <4>[ 571.805267] <4>[ 571.805267] SP: 0xdfd89ab8: <4>[ 571.809753] 9ab8 c06b3534 dffe4d00 0000005d 0000005c c0300f4c 00000010 c06af6a8 c02fd7b0 <4>[ 571.818359] 9ad8 c06bca8c ffffffff dfd89b24 ced0b880 df42a100 c0138a6c ced0b880 00000000 <4>[ 571.826965] 9af8 ced0b880 00000000 6b6b6b6b cf9202c8 ced0b880 df42a100 00000000 df4d3670 <4>[ 571.835571] 9b18 00000000 ffffffb9 ced0b898 dfd89b38 c034f494 c0424068 00000193 ffffffff <4>[ 571.844177] 9b38 ced0b880 00000000 df42a100 df42a100 00000000 c034f494 00000000 00000000 <4>[ 571.852783] 9b58 ced0b880 c0360728 df42a1ec ffcea500 df42a100 cf9ee0c0 00000000 c0362600 <4>[ 571.861389] 9b78 7268746b 00000acf 00000159 00000430 0000010c ffc02430 ffcea520 00000fff <4>[ 571.869995] 9b98 00000000 00000860 df42a224 df42a22c 352e3137 df42a1ec df42a100 0000c00b <4>[ 571.878601] <4>[ 571.878601] IP: 0xced0b818: <4>[ 571.883087] b818 f47ffd50 fbedd122 0c5d7d8b e8a18eab c9edf871 fa42458e 9d74e35b 09f91102 <4>[ 571.891693] b838 9f7b67b6 c028f924 be7374ea 76cfeff7 3dedf6eb b3bdafca efeb3cb9 48b9b393 <4>[ 571.900299] b858 71e79e75 ff27ed31 ef4af61b edffffc3 7dbafefa c4fff7fd eefbeff7 e686ee2b <4>[ 571.908905] b878 635688c0 d84156c5 00000001 00000000 00000001 00000000 00000000 00000000 <4>[ 571.917510] b898 ced0b898 ced0b898 ced0b8a0 ced0b8a0 00000000 d7691280 d76f3e40 00008880 <4>[ 571.926116] b8b8 00000000 00000000 00000206 ffce9200 8ed0c200 00000000 00000000 000000c0 <4>[ 571.934722] b8d8 00000000 00000000 00000000 00000867 00000001 00000008 00000002 cf9202c8 <4>[ 571.943328] b8f8 c0423e38 00000000 000000c0 00000000 ffffffb9 5a5a5a5a 5a5a5a5a 5a5a5a5a <4>[ 571.951934] <4>[ 571.951934] R0: 0xced0b800: <4>[ 571.956420] b800 e2238576 a5e97707 5bcd6f77 875e9294 feeba4be d0cc4a11 f47ffd50 fbedd122 <4>[ 571.965026] b820 0c5d7d8b e8a18eab c9edf871 fa42458e 9d74e35b 09f91102 9f7b67b6 c028f924 <4>[ 571.973632] b840 be7374ea 76cfeff7 3dedf6eb b3bdafca efeb3cb9 48b9b393 71e79e75 ff27ed31 <4>[ 571.982238] b860 ef4af61b edffffc3 7dbafefa c4fff7fd eefbeff7 e686ee2b 635688c0 d84156c5 <4>[ 571.990844] b880 00000001 00000000 00000001 00000000 00000000 00000000 ced0b898 ced0b898 <4>[ 571.999450] b8a0 ced0b8a0 ced0b8a0 00000000 d7691280 d76f3e40 00008880 00000000 00000000 <4>[ 572.008056] b8c0 00000206 ffce9200 8ed0c200 00000000 00000000 000000c0 00000000 00000000 <4>[ 572.016662] b8e0 00000000 00000867 00000001 00000008 00000002 cf9202c8 c0423e38 00000000 <4>[ 572.025268] <4>[ 572.025268] R2: 0xced0b800: <4>[ 572.029754] b800 e2238576 a5e97707 5bcd6f77 875e9294 feeba4be d0cc4a11 f47ffd50 fbedd122 <4>[ 572.038360] b820 0c5d7d8b e8a18eab c9edf871 fa42458e 9d74e35b 09f91102 9f7b67b6 c028f924 <4>[ 572.046966] b840 be7374ea 76cfeff7 3dedf6eb b3bdafca efeb3cb9 48b9b393 71e79e75 ff27ed31 <4>[ 572.055572] b860 ef4af61b edffffc3 7dbafefa c4fff7fd eefbeff7 e686ee2b 635688c0 d84156c5 <4>[ 572.064178] b880 00000001 00000000 00000001 00000000 00000000 00000000 ced0b898 ced0b898 <4>[ 572.072784] b8a0 ced0b8a0 ced0b8a0 00000000 d7691280 d76f3e40 00008880 00000000 00000000 <4>[ 572.081390] b8c0 00000206 ffce9200 8ed0c200 00000000 00000000 000000c0 00000000 00000000 <4>[ 572.089996] b8e0 00000000 00000867 00000001 00000008 00000002 cf9202c8 c0423e38 00000000 <4>[ 572.098602] <4>[ 572.098602] R5: 0xcf920248: <4>[ 572.103088] 0248 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.111694] 0268 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.120300] 0288 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.128906] 02a8 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.137512] 02c8 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.146118] 02e8 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.154724] 0308 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.163330] 0328 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b 6b6b6b6b <4>[ 572.171936] <4>[ 572.171936] R6: 0xced0b800: <4>[ 572.176422] b800 e2238576 a5e97707 5bcd6f77 875e9294 feeba4be d0cc4a11 f47ffd50 fbedd122 <4>[ 572.185028] b820 0c5d7d8b e8a18eab c9edf871 fa42458e 9d74e35b 09f91102 9f7b67b6 c028f924 <4>[ 572.193634] b840 be7374ea 76cfeff7 3dedf6eb b3bdafca efeb3cb9 48b9b393 71e79e75 ff27ed31 <4>[ 572.202239] b860 ef4af61b edffffc3 7dbafefa c4fff7fd eefbeff7 e686ee2b 635688c0 d84156c5 <4>[ 572.210845] b880 00000001 00000000 00000001 00000000 00000000 00000000 ced0b898 ced0b898 <4>[ 572.219451] b8a0 ced0b8a0 ced0b8a0 00000000 d7691280 d76f3e40 00008880 00000000 00000000 <4>[ 572.228057] b8c0 00000206 ffce9200 8ed0c200 00000000 00000000 000000c0 00000000 00000000 <4>[ 572.236663] b8e0 00000000 00000867 00000001 00000008 00000002 cf9202c8 c0423e38 00000000 <4>[ 572.245269] <4>[ 572.245269] R7: 0xdf42a080: <4>[ 572.249755] a080 dfffd040 df510000 000000c0 df42a0c0 00000006 ffffffff 00000000 fffffffe <4>[ 572.258361] a0a0 fffffffe fffffffe fffffffe fffffffe fffffffe 00000000 00000000 00000000 <4>[ 572.266967] a0c0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 <4>[ 572.275573] a0e0 00000000 00000000 00000000 00000000 00000000 00000000 635688c0 d84156c5 <4>[ 572.284179] a100 c066f5d8 00000001 dfcf1d00 00000001 ffffffff 0000000f 000059de 00000000 <4>[ 572.292785] a120 00000000 00000000 df522080 00000000 c068d19c dfc73030 00000005 00000005 <4>[ 572.301391] a140 00000002 df806aa8 00000000 00000000 0000000c c05f06a6 69636865 6463685f <4>[ 572.309997] a160 6273753a 00000031 00000000 00000000 00000000 00200200 ffff8c07 c06efd80 <4>[ 572.318603] <4>[ 572.318603] R9: 0xdf4d35f0: <4>[ 572.323089] 35f0 00000000 00000000 d685a300 00000000 00000000 00000000 d685a300 00000000 <4>[ 572.331695] 3610 00000000 00000000 d685a300 00000000 00000000 00000000 d685a300 00000000 <4>[ 572.340301] 3630 00000000 00000000 d685a300 00000000 00000000 dfc8c6c0 defc6d00 dedc8dc0 <4>[ 572.348907] 3650 d6a42540 00000000 d685a300 00000000 00000000 00000000 d685a300 00000000 <4>[ 572.357513] 3670 00000000 ffcea000 d685a300 00000000 00000000 00000000 d685a300 00000000 <4>[ 572.366119] 3690 00000000 00000000 d685a300 00000000 00000000 00000000 d685a300 00000000 <4>[ 572.374725] 36b0 00000000 00000000 d685a300 00000000 00000000 00000000 d685a300 00000000 <4>[ 572.383331] 36d0 00000000 00000000 d685a300 00000000 00000000 00000000 d685a300 00000000 <0>[ 572.391937] Process khubd (pid: 269, stack limit = 0xdfd882e8) <0>[ 572.398040] Stack: (0xdfd89b38 to 0xdfd8a000) <0>[ 572.402618] 9b20: ced0b880 00000000 <0>[ 572.411193] 9b40: df42a100 df42a100 00000000 c034f494 00000000 00000000 ced0b880 c0360728 <0>[ 572.419769] 9b60: df42a1ec ffcea500 df42a100 cf9ee0c0 00000000 c0362600 7268746b 00000acf <0>[ 572.428375] 9b80: 00000159 00000430 0000010c ffc02430 ffcea520 00000fff 00000000 00000860 <0>[ 572.436950] 9ba0: df42a224 df42a22c 352e3137 df42a1ec df42a100 0000c00b 00000000 00010035 <0>[ 572.445526] 9bc0: dfd88000 6b6b6b53 d7691280 c0364b88 df42a100 df42a100 00010003 df42a100 <0>[ 572.454101] 9be0: 40000193 00000000 0000004d 00000002 dfd88000 6b6b6b53 d7691280 c034ebd0 <0>[ 572.462707] 9c00: df508c40 00000000 00000000 c01a8e38 c0674ec8 0000004d df508c40 00000003 <0>[ 572.471282] 9c20: 00000002 c01ab034 0000004d 00000000 dfd68c40 c013806c ffffffff fa200000 <0>[ 572.479858] 9c40: dfd68c40 c0138ac8 00000000 c06af260 00000080 00000080 dfd89df0 dfd882e8 <0>[ 572.488433] 9c60: dfd68c40 00000000 00000005 00000005 6b6b6b53 d7691280 00000000 dfd89c90 <0>[ 572.497009] 9c80: c013c7fc c013c800 60000113 ffffffff dfd882e8 0000000b 6b6b6b6b dfd89df0 <0>[ 572.505615] 9ca0: 00000000 00000005 00000000 c0141754 dfd89df0 c065e988 6b6b6b6b dfd68c40 <0>[ 572.514190] 9cc0: 00000000 c0141a08 dfd89d0c 00000000 0000054a d6a790f4 d6a79884 c0138314 <0>[ 572.522766] 9ce0: d6a790f4 d6a79884 0000ffff 00000000 db3c9bf4 000000c1 dfd68c40 c0670808 <0>[ 572.531341] 9d00: 002d4f8a d1ab29ff dfd89d4c c0169994 0000004d d166b63b dfd68c40 c0670808 <0>[ 572.539916] 9d20: dfd46cb0 00000001 c0670808 00000005 c065e988 6b6b6b6b dfd89df0 df42a100 <0>[ 572.548522] 9d40: 20000193 6b6b6b53 d7691280 c0138314 dfd68c40 c06707d8 00000003 dfd46cb0 <0>[ 572.557098] 9d60: dfd68c70 dfd68c40 dfd89d8c c0169ca8 dfd46c80 c06707d8 00000001 40000093 <0>[ 572.565673] 9d80: d751d000 dc3ac000 dfc0bd80 dfc10e40 0000000f c01e2060 dfd89db4 dfc11ad0 <0>[ 572.574249] 9da0: 00000010 dfc0be0c dfd89e0c dfc0bd80 d751f000 d722f000 dfc00080 dfc02e40 <0>[ 572.582824] 9dc0: 0000000f c01e2060 ceca0258 dfc05c10 00000010 dfc0010c ceca0000 ffffffff <0>[ 572.591430] 9de0: dfd89e24 d76f3e40 d76f3e50 c0138a6c d7691280 d76f3e40 6b6b6b6b 6b6b6b6b <0>[ 572.600006] 9e00: dfd88000 6b6b6b53 d76f3e40 d76f3e50 df42a100 00000100 6b6b6b53 d7691280 <0>[ 572.608581] 9e20: 00000002 dfd89e38 c03518b0 c034f6b4 20000093 ffffffff d7691280 d76f3e40 <0>[ 572.617156] 9e40: 00000000 00000000 d7691280 00000100 c069ac48 c03518b0 0000002c 00000001 <0>[ 572.625732] 9e60: d76f30e4 c03519e8 d57c9aa0 d57c9a80 d7691280 00000000 c069ac18 c0354750 <0>[ 572.634338] 9e80: d57c9aa0 c069ac48 c068d208 00000002 df5902bc 00000100 0000001f c0306708 <0>[ 572.642913] 9ea0: d57c9ad4 d57c9aa0 c068d208 c0306858 d57c9aa0 d76912e8 c068d208 c0305d80 <0>[ 572.651489] 9ec0: d57c9aa0 d76912e8 d57c9a80 c03045a0 d7691280 00000000 d57c9a80 c0351914 <0>[ 572.660064] 9ee0: d7691280 d769131c d76912e8 d76912fc df5902bc c034c780 dfc91700 00000001 <0>[ 572.668670] 9f00: 00000004 dfd88000 df590080 00000100 c068d044 c034d630 dfc1db30 dfc1db00 <0>[ 572.677246] 9f20: dfc1db30 dfc1db00 00000001 dfd68c70 df42a118 daff45a0 00000000 daff45a0 <0>[ 572.685821] 9f40: df42a100 df590080 00000004 df60d280 df59008c dfc91703 dfc91738 daff4580 <0>[ 572.694396] 9f60: 00000000 00000003 dfc91740 dfc91790 dfc91708 df59011c 00000009 dfc9173c <0>[ 572.702972] 9f80: dfc91734 dfd89f94 00000000 dfd68c40 c0185954 dfd89f94 dfd89f94 00000101 <0>[ 572.711547] 9fa0: 01000001 c018560c 00000000 dfc31f68 dfd89fd4 c034d1c4 00000000 00000000 <0>[ 572.720123] 9fc0: 00000000 00000000 00000000 c0185624 00000000 00000000 dfd89fd8 dfd89fd8 <0>[ 572.728729] 9fe0: 00000000 dfc31f68 c01855ac c01399a0 00000013 c01399a0 feefff7b ffffd9ef <4>[ 572.737304] [<c0424068>] (snd_complete_urb+0x230/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 572.747436] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 572.757293] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 572.766326] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 572.774932] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 572.783508] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 572.792663] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 572.802337] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 572.811462] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 572.819854] Exception stack(0xdfd89c48 to 0xdfd89c90) <4>[ 572.825164] 9c40: 00000000 c06af260 00000080 00000080 dfd89df0 dfd882e8 <4>[ 572.833740] 9c60: dfd68c40 00000000 00000005 00000005 6b6b6b53 d7691280 00000000 dfd89c90 <4>[ 572.842315] 9c80: c013c7fc c013c800 60000113 ffffffff <4>[ 572.847625] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c013c800>] (die+0x140/0x1e4) <4>[ 572.855560] [<c013c800>] (die+0x140/0x1e4) from [<c0141754>] (__do_kernel_fault+0x64/0x84) <4>[ 572.864227] [<c0141754>] (__do_kernel_fault+0x64/0x84) from [<c0141a08>] (do_page_fault+0x294/0x2b4) <4>[ 572.873809] [<c0141a08>] (do_page_fault+0x294/0x2b4) from [<c0138314>] (do_DataAbort+0x34/0x94) <4>[ 572.882965] [<c0138314>] (do_DataAbort+0x34/0x94) from [<c0138a6c>] (__dabt_svc+0x4c/0x60) <4>[ 572.891601] Exception stack(0xdfd89df0 to 0xdfd89e38) <4>[ 572.896911] 9de0: d7691280 d76f3e40 6b6b6b6b 6b6b6b6b <4>[ 572.905487] 9e00: dfd88000 6b6b6b53 d76f3e40 d76f3e50 df42a100 00000100 6b6b6b53 d7691280 <4>[ 572.914062] 9e20: 00000002 dfd89e38 c03518b0 c034f6b4 20000093 ffffffff <4>[ 572.921020] [<c0138a6c>] (__dabt_svc+0x4c/0x60) from [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) <4>[ 572.930694] [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) from [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) <4>[ 572.941284] [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) from [<c03519e8>] (usb_disable_interface+0x30/0x4c) <4>[ 572.951690] [<c03519e8>] (usb_disable_interface+0x30/0x4c) from [<c0354750>] (usb_unbind_interface+0x50/0x1a8) <4>[ 572.962188] [<c0354750>] (usb_unbind_interface+0x50/0x1a8) from [<c0306708>] (__device_release_driver+0x84/0xd0) <4>[ 572.972869] [<c0306708>] (__device_release_driver+0x84/0xd0) from [<c0306858>] (device_release_driver+0x1c/0x28) <4>[ 572.983551] [<c0306858>] (device_release_driver+0x1c/0x28) from [<c0305d80>] (bus_remove_device+0xa4/0xb4) <4>[ 572.993682] [<c0305d80>] (bus_remove_device+0xa4/0xb4) from [<c03045a0>] (device_del+0x110/0x16c) <4>[ 573.002990] [<c03045a0>] (device_del+0x110/0x16c) from [<c0351914>] (usb_disable_device+0x4c/0xf0) <4>[ 573.012390] [<c0351914>] (usb_disable_device+0x4c/0xf0) from [<c034c780>] (usb_disconnect+0x90/0x134) <4>[ 573.022064] [<c034c780>] (usb_disconnect+0x90/0x134) from [<c034d630>] (hub_thread+0x46c/0xf00) <4>[ 573.031219] [<c034d630>] (hub_thread+0x46c/0xf00) from [<c0185624>] (kthread+0x78/0x80) <4>[ 573.039611] [<c0185624>] (kthread+0x78/0x80) from [<c01399a0>] (kernel_thread_exit+0x0/0x8) <0>[ 573.048370] Code: e8bd41f0 eaf9992a e373006c 0afffff8 (e5943000) <4>[ 573.055084] ---[ end trace 069f4a4f8aedac2b ]--- <0>[ 573.060180] Kernel panic - not syncing: Fatal exception in interrupt <4>[ 573.066864] [<c013e608>] (unwind_backtrace+0x0/0xf0) from [<c04fa6c0>] (panic+0x6c/0xe8) <4>[ 573.075408] [<c04fa6c0>] (panic+0x6c/0xe8) from [<c013c868>] (die+0x1a8/0x1e4) <4>[ 573.083007] [<c013c868>] (die+0x1a8/0x1e4) from [<c0141754>] (__do_kernel_fault+0x64/0x84) <4>[ 573.091674] [<c0141754>] (__do_kernel_fault+0x64/0x84) from [<c0141a08>] (do_page_fault+0x294/0x2b4) <4>[ 573.101287] [<c0141a08>] (do_page_fault+0x294/0x2b4) from [<c0138314>] (do_DataAbort+0x34/0x94) <4>[ 573.110443] [<c0138314>] (do_DataAbort+0x34/0x94) from [<c0138a6c>] (__dabt_svc+0x4c/0x60) <4>[ 573.119110] Exception stack(0xdfd89af0 to 0xdfd89b38) <4>[ 573.124420] 9ae0: ced0b880 00000000 ced0b880 00000000 <4>[ 573.133026] 9b00: 6b6b6b6b cf9202c8 ced0b880 df42a100 00000000 df4d3670 00000000 ffffffb9 <4>[ 573.141601] 9b20: ced0b898 dfd89b38 c034f494 c0424068 00000193 ffffffff <4>[ 573.148559] [<c0138a6c>] (__dabt_svc+0x4c/0x60) from [<c0424068>] (snd_complete_urb+0x230/0x258) <4>[ 573.157806] [<c0424068>] (snd_complete_urb+0x230/0x258) from [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) <4>[ 573.167938] [<c034f494>] (usb_hcd_giveback_urb+0xa0/0xec) from [<c0360728>] (ehci_urb_done+0x100/0x120) <4>[ 573.177825] [<c0360728>] (ehci_urb_done+0x100/0x120) from [<c0362600>] (ehci_work+0x550/0x9b4) <4>[ 573.186889] [<c0362600>] (ehci_work+0x550/0x9b4) from [<c0364b88>] (ehci_irq+0x218/0x260) <4>[ 573.195465] [<c0364b88>] (ehci_irq+0x218/0x260) from [<c034ebd0>] (usb_hcd_irq+0x38/0x90) <4>[ 573.204071] [<c034ebd0>] (usb_hcd_irq+0x38/0x90) from [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) <4>[ 573.213226] [<c01a8e38>] (handle_IRQ_event+0x24/0xe4) from [<c01ab034>] (handle_level_irq+0xdc/0x188) <4>[ 573.222930] [<c01ab034>] (handle_level_irq+0xdc/0x188) from [<c013806c>] (asm_do_IRQ+0x6c/0x8c) <4>[ 573.232086] [<c013806c>] (asm_do_IRQ+0x6c/0x8c) from [<c0138ac8>] (__irq_svc+0x48/0xa8) <4>[ 573.240478] Exception stack(0xdfd89c48 to 0xdfd89c90) <4>[ 573.245788] 9c40: 00000000 c06af260 00000080 00000080 dfd89df0 dfd882e8 <4>[ 573.254364] 9c60: dfd68c40 00000000 00000005 00000005 6b6b6b53 d7691280 00000000 dfd89c90 <4>[ 573.262969] 9c80: c013c7fc c013c800 60000113 ffffffff <4>[ 573.268280] [<c0138ac8>] (__irq_svc+0x48/0xa8) from [<c013c800>] (die+0x140/0x1e4) <4>[ 573.276245] [<c013c800>] (die+0x140/0x1e4) from [<c0141754>] (__do_kernel_fault+0x64/0x84) <4>[ 573.284912] [<c0141754>] (__do_kernel_fault+0x64/0x84) from [<c0141a08>] (do_page_fault+0x294/0x2b4) <4>[ 573.294525] [<c0141a08>] (do_page_fault+0x294/0x2b4) from [<c0138314>] (do_DataAbort+0x34/0x94) <4>[ 573.303680] [<c0138314>] (do_DataAbort+0x34/0x94) from [<c0138a6c>] (__dabt_svc+0x4c/0x60) <4>[ 573.312377] Exception stack(0xdfd89df0 to 0xdfd89e38) <4>[ 573.317657] 9de0: d7691280 d76f3e40 6b6b6b6b 6b6b6b6b <4>[ 573.326263] 9e00: dfd88000 6b6b6b53 d76f3e40 d76f3e50 df42a100 00000100 6b6b6b53 d7691280 <4>[ 573.334869] 9e20: 00000002 dfd89e38 c03518b0 c034f6b4 20000093 ffffffff <4>[ 573.341827] [<c0138a6c>] (__dabt_svc+0x4c/0x60) from [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) <4>[ 573.351531] [<c034f6b4>] (usb_hcd_flush_endpoint+0x9c/0x160) from [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) <4>[ 573.362121] [<c03518b0>] (usb_disable_endpoint+0x6c/0x84) from [<c03519e8>] (usb_disable_interface+0x30/0x4c) <4>[ 573.372558] [<c03519e8>] (usb_disable_interface+0x30/0x4c) from [<c0354750>] (usb_unbind_interface+0x50/0x1a8) <4>[ 573.383056] [<c0354750>] (usb_unbind_interface+0x50/0x1a8) from [<c0306708>] (__device_release_driver+0x84/0xd0) <4>[ 573.393768] [<c0306708>] (__device_release_driver+0x84/0xd0) from [<c0306858>] (device_release_driver+0x1c/0x28) <4>[ 573.404449] [<c0306858>] (device_release_driver+0x1c/0x28) from [<c0305d80>] (bus_remove_device+0xa4/0xb4) <4>[ 573.414611] [<c0305d80>] (bus_remove_device+0xa4/0xb4) from [<c03045a0>] (device_del+0x110/0x16c) <4>[ 573.423919] [<c03045a0>] (device_del+0x110/0x16c) from [<c0351914>] (usb_disable_device+0x4c/0xf0) <4>[ 573.433349] [<c0351914>] (usb_disable_device+0x4c/0xf0) from [<c034c780>] (usb_disconnect+0x90/0x134) <4>[ 573.443054] [<c034c780>] (usb_disconnect+0x90/0x134) from [<c034d630>] (hub_thread+0x46c/0xf00) <4>[ 573.452178] [<c034d630>] (hub_thread+0x46c/0xf00) from [<c0185624>] (kthread+0x78/0x80) <4>[ 573.460601] [<c0185624>] (kthread+0x78/0x80) from [<c01399a0>] (kernel_thread_exit+0x0/0x8)
At Tue, 30 Oct 2012 11:52:33 +0100, Matthieu CASTET wrote:
Takashi Iwai a écrit :
Thanks,
the first tests seems ok. We will do more strees test.
Do you have any good/bad test result? If no regression is seen, I'm going to apply the patches for 3.7-rc4.
The patches fix the races.
But I saw a failure I didn't saw before during stress test [1].
Hm, it's a list corruption, so everything is possible, including my patch...
It is hard to say if it is related to your patches :
- we test on a older kernel version and I backported usbaudio from 3.7 with your
patches
- the start of the trace is missing and it is difficult to understand the list
corruption.
Yeah, if you can catch the first trace, let me know.
thanks,
Takashi
participants (2)
-
Matthieu CASTET -
Takashi Iwai