[Bugme-new] [Bug 13675] New: sierra_close sometimes crashes upon device removal

[bugzilla-daemon at bugzilla.kernel.org]

http://bugzilla.kernel.org/show_bug.cgi?id=13675

           Summary: sierra_close sometimes crashes upon device removal
           Product: Drivers
           Version: 2.5
    Kernel Version: 2.6.31-rc1-git5
          Platform: All
        OS/Version: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: USB
        AssignedTo: greg at kroah.com
        ReportedBy: peter at mushroomnetworks.com
        Regression: Yes


First time submitting a kernel.org bug.  Apologies for anything I've missed.

I think was this introduced in 2.6.29.  I do not see this in 2.6.28.x kernels.

I am seeing this on both AMD Geode and Via C7 platforms.

In this system there are other processes which may be attempting to read
related /sys files or the device node itself.  In this case, I am removing an
AT&T Mercury USB Modem:

usb 1-3: USB disconnect, address 3
sierra ttyUSB4: resubmit read urb failed.(-19)
sierra ttyUSB4: resubmit read urb failed.(-19)
sierra ttyUSB0: Sierra USB modem converter now disconnected from ttyUSB0
sierra 1-3:1.0: device disconnected
sierra ttyUSB1: Sierra USB modem converter now disconnected from ttyUSB1
sierra 1-3:1.1: device disconnected
sierra ttyUSB2: Sierra USB modem converter now disconnected from ttyUSB2
sierra 1-3:1.2: device disconnected
sierra ttyUSB3: Sierra USB modem converter now disconnected from ttyUSB3
sierra 1-3:1.3: device disconnected
sierra ttyUSB4: Sierra USB modem converter now disconnected from ttyUSB4
sierra 1-3:1.4: device disconnected
sierra ttyUSB5: Sierra USB modem converter now disconnected from ttyUSB5
sierra 1-3:1.5: device disconnected
sierra ttyUSB6: Sierra USB modem converter now disconnected from ttyUSB6
sierra 1-3:1.6: device disconnected
BUG: unable to handle kernel NULL pointer dereference at 00000040
IP: [<c02fe3f4>] sierra_close+0x14/0xc0
*pde = 00000000
Oops: 0002 [#1]
last sysfs file: /sys/devices/pci0000:00/0000:00:0e.0/usb1/1-3/idProduct
Modules linked in: coop_gateways(P) sctp

Pid: 4, comm: events/0 Tainted: P           (2.6.31-rc1-git5 #11)
EIP: 0060:[<c02fe3f4>] EFLAGS: 00010282 CPU: 0
EIP is at sierra_close+0x14/0xc0
EAX: cfa62c00 EBX: ced278c0 ECX: 00000000 EDX: c02fe3e0
ESI: c055b6c0 EDI: 00000000 EBP: cf83bf04 ESP: cf83bef4
 DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
Process events/0 (pid: 4, ti=cf83a000 task=cf8391b0 task.ti=cf83a000)
Stack:
 cfa62c00 cfa62c00 c055b6c0 cfa62ce8 cf83bf18 c02f95cd cfa62c00 ffffffff
<0> ced9c000 cf83bf24 c02faee1 00000296 cf83bf50 c0267606 ced9c098 00000000
<0> 00000000 00000001 00000000 ced9c10a ced9c1e4 ced9c1e0 cf803ce0 cf83bfa0
Call Trace:
 [<c02f95cd>] ? serial_do_down+0x4d/0x60
 [<c02faee1>] ? serial_hangup+0x11/0x30
 [<c0267606>] ? do_tty_hangup+0xc6/0x330
 [<c012dc0c>] ? worker_thread+0x13c/0x240
 [<c012dbaa>] ? worker_thread+0xda/0x240
 [<c0267540>] ? do_tty_hangup+0x0/0x330
 [<c0131510>] ? autoremove_wake_function+0x0/0x50
 [<c012dad0>] ? worker_thread+0x0/0x240
 [<c01312c4>] ? kthread+0x74/0x80
 [<c0131250>] ? kthread+0x0/0x80
 [<c010345b>] ? kernel_thread_helper+0x7/0x1c
Code: 8b 1c 24 8b 74 24 04 89 ec 5d c3 8d b6 00 00 00 00 8d bf 00 00 00 00 55
89 e5 57 56 53 83 ec 04 89 45 f0 8b 18 8b b8 20 02 00 00 <c7> 47 40 00 00 00 00
c7 47 44 00 00 00 00 8b 0b 85 c9 74 77 8d
EIP: [<c02fe3f4>] sierra_close+0x14/0xc0 SS:ESP 0068:cf83bef4
CR2: 0000000000000040
---[ end trace af1048799077b9ee ]---

-- 
Configure bugmail: http://bugzilla.kernel.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.