2003-03-26 19:52:53

by Martin J. Bligh

[permalink] [raw]
Subject: [Bug 509] New: NULL pointer when rmmod faulty driver

http://bugme.osdl.org/show_bug.cgi?id=509

Summary: NULL pointer when rmmod faulty driver
Kernel Version: 2.5.62
Status: NEW
Severity: normal
Owner: [email protected]
Submitter: [email protected]


Distribution:
downloaded and built with gcc 3.2.1
Hardware Environment:
Intel 586
Software Environment:
glibc 1.2.10
module-init-tools version 0.9.10
Problem Description:
I'm removing a usb driver which has failed. when I remove the usb cable before
rmmod the driver

Mar 26 20:23:33 localhost modprobe: FATAL: Module /dev/video0 not found.
Mar 26 20:27:14 localhost kernel: drivers/usb/host/uhci-hcd.c: 1000: host
controller halted. very bad
Mar 26 20:27:14 localhost kernel: usb 1-1: USB disconnect, address 2
Mar 26 20:27:14 localhost kernel: Unable to handle kernel NULL pointer
dereference at virtual address 0000008f
Mar 26 20:27:14 localhost kernel: printing eip:
Mar 26 20:27:14 localhost kernel: ce8c2a3c
Mar 26 20:27:14 localhost kernel: *pde = 00000000
Mar 26 20:27:14 localhost kernel: Oops: 0000
Mar 26 20:27:14 localhost kernel: CPU: 0
Mar 26 20:27:14 localhost kernel: EIP: 0060:[<ce8c2a3c>] Tainted: GF
Mar 26 20:27:14 localhost kernel: EFLAGS: 00010206
Mar 26 20:27:14 localhost kernel: EIP is at qc_usb_disconnect+0x98/0x268 [quickcam]
Mar 26 20:27:14 localhost kernel: eax: ce8d07c0 ebx: 00000077 ecx: ce8c29a4
edx: ca38b3e0
Mar 26 20:27:14 localhost kernel: esi: ce8d07d8 edi: ce8d07c0 ebp: c13edeb0
esp: c13ede50
Mar 26 20:27:14 localhost kernel: ds: 007b es: 007b ss: 0068
Mar 26 20:27:14 localhost kernel: Process khubd (pid: 4, threadinfo=c13ec000
task=cdfab240)
Mar 26 20:27:14 localhost kernel: Stack: c6f0b160 c13ede68 c016a099 cdfec4b0
c13121a0 c13121a0 c13ede7c c016b0d3
Mar 26 20:27:14 localhost kernel: c13121a0 c6f0b160 c6f0b160 c13ede94
c01683d0 ce8d0844 ce8d0844 c02e8bde
Mar 26 20:27:14 localhost kernel: ca38b3e0 00000077 c0186009 c6f0b980
ca38b3e0 ca38b3f8 ce8d07d8 ca38b3f8
Mar 26 20:27:14 localhost kernel: Call Trace:
Mar 26 20:27:14 localhost kernel: [<c016a099>] destroy_inode+0x59/0x60
Mar 26 20:27:14 localhost kernel: [<c016b0d3>] iput+0x63/0x90
Mar 26 20:27:14 localhost kernel: [<c01683d0>] dput+0x30/0x170
Mar 26 20:27:14 localhost kernel: [<ce8d0844>] qc_usb_driver+0x84/0xa0 [quickcam]
Mar 26 20:27:14 localhost kernel: [<ce8d0844>] qc_usb_driver+0x84/0xa0 [quickcam]
Mar 26 20:27:14 localhost kernel: [<c02e8bde>] usb_device_remove+0xde/0x120
Mar 26 20:27:14 localhost kernel: [<c0186009>] hash_and_remove+0x69/0xb0
Mar 26 20:27:14 localhost kernel: [<ce8d07d8>] qc_usb_driver+0x18/0xa0 [quickcam]
Mar 26 20:27:14 localhost kernel: [<c0250e56>] device_release_driver+0x66/0x70
Mar 26 20:27:14 localhost kernel: [<c0250fef>] bus_remove_device+0x7f/0xd0
Mar 26 20:27:14 localhost kernel: [<c025013c>] device_del+0x7c/0xc0
Mar 26 20:27:14 localhost kernel: [<c0250194>] device_unregister+0x14/0x22
Mar 26 20:27:14 localhost kernel: [<c02e9637>] usb_disconnect+0x97/0x100
Mar 26 20:27:14 localhost kernel: [<c02ec06f>]
usb_hub_port_connect_change+0x33f/0x350
Mar 26 20:27:14 localhost kernel: [<c02eb938>] usb_hub_port_status+0x68/0xb0
Mar 26 20:27:14 localhost kernel: [<c02ec398>] usb_hub_events+0x318/0x3a0
Mar 26 20:27:14 localhost kernel: [<c02ec455>] usb_hub_thread+0x35/0xf0
Mar 26 20:27:14 localhost kernel: [<c011c930>] default_wake_function+0x0/0x20
Mar 26 20:27:14 localhost kernel: [<c02ec420>] usb_hub_thread+0x0/0xf0
Mar 26 20:27:14 localhost kernel: [<c010826d>] kernel_thread_helper+0x5/0x18
Mar 26 20:27:14 localhost kernel:
Mar 26 20:27:14 localhost kernel: Code: 8b 43 18 85 c0 75 39 83 ec 0c 8d 44 24
2c 50 e8 90 cf 84 f1

Then when I try to rmmod the driver I get

Unable to handle kernel NULL pointer dereference at virtual address 00000000
printing eip:
00000000
*pde = 00000000
Oops: 0000
CPU: 0
EIP: 0060:[<00000000>] Tainted: GF
EFLAGS: 00010246
EIP is at 0x0
eax: 00000000 ebx: c042b9d8 ecx: c042b9d8 edx: 00000000
esi: 00000880 edi: ce8d1860 ebp: c3fe5fbc esp: c3fe5f58
ds: 007b es: 007b ss: 0068
Process rmmod (pid: 13369, threadinfo=c3fe4000 task=c92aa7a0)
Stack: c01321eb c03b087b 00000077 0000003b 00000000 00000000 63697571 6d61636b
c3fe5f00 00000046 c04dbb48 00000046 c3fe4000 c3fe4000 00000000 c3fe5fbc
c010bd78 00000000 c3fe5fc4 c0429124 00429124 c04a9900 bffff768 bffff97a
Call Trace:
[<c01321eb>] sys_delete_module+0x1cb/0x220
[<c010bd78>] do_IRQ+0x108/0x130
[<c010a563>] syscall_call+0x7/0xb

Code: Bad EIP value.

Steps to reproduce:

is this a kernel problem??



2003-03-27 04:35:06

by dan carpenter

[permalink] [raw]
Subject: Re: [Bug 509] New: NULL pointer when rmmod faulty driver

On Wednesday 26 March 2003 08:54 pm, Martin J. Bligh wrote:
> http://bugme.osdl.org/show_bug.cgi?id=509
>

> Mar 26 20:23:33 localhost modprobe: FATAL: Module /dev/video0 not found.
> Mar 26 20:27:14 localhost kernel: drivers/usb/host/uhci-hcd.c: 1000: host
> controller halted. very bad

There is a fixme next to the printf statement in
drivers/usb/host/uhci-hcd.c

1886 if ((status & USBSTS_HCH) && !uhci->is_suspended) {
1887 err("%x: host controller halted. very bad", io_addr);
1888 /* FIXME: Reset the controller, fix the offending TD */
1889 }

> Mar 26 20:27:14 localhost kernel: EIP: 0060:[<ce8c2a3c>] Tainted: GF
> Mar 26 20:27:14 localhost kernel: EFLAGS: 00010206
> Mar 26 20:27:14 localhost kernel: EIP is at qc_usb_disconnect+0x98/0x268
> [quickcam] Mar 26 20:27:14 localhost kernel: eax: ce8d07c0 ebx: 00000077

The quickcam source isn't available to fix the null dereference bug.

regards,
dan

2003-03-27 22:52:56

by Dave Jones

[permalink] [raw]
Subject: Re: [Bug 509] New: NULL pointer when rmmod faulty driver

On Wed, Mar 26, 2003 at 12:25:28PM +0100, dan carpenter wrote:

> > Mar 26 20:27:14 localhost kernel: drivers/usb/host/uhci-hcd.c: 1000: host
> > controller halted. very bad
>
> There is a fixme next to the printf statement in
> drivers/usb/host/uhci-hcd.c

I saw the same message until recently.
I believe this was fixed in 2.5.65, see http://bugzilla.kernel.org/show_bug.cgi?id=403

> The quickcam source isn't available to fix the null dereference bug.

Indeed.

Dave