Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933830Ab1CXTQ4 (ORCPT ); Thu, 24 Mar 2011 15:16:56 -0400 Received: from www.linutronix.de ([62.245.132.108]:43123 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933573Ab1CXTQz (ORCPT ); Thu, 24 Mar 2011 15:16:55 -0400 Date: Thu, 24 Mar 2011 20:16:42 +0100 (CET) From: Thomas Gleixner To: Ingo Molnar cc: Pekka Enberg , Christoph Lameter , Linus Torvalds , Andrew Morton , Tejun Heo , npiggin@kernel.dk, rientjes@google.com, LKML , linux-mm@kvack.org, Ville Tervo , "Gustavo F. Padovan" Subject: Call Trace:Re: [boot crash #2] Re: [GIT PULL] SLAB changes for v2.6.39-rc1 In-Reply-To: <20110324185258.GA28370@elte.hu> Message-ID: References: <20110324142146.GA11682@elte.hu> <20110324172653.GA28507@elte.hu> <20110324185258.GA28370@elte.hu> User-Agent: Alpine 2.00 (LFD 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2677 Lines: 70 After we made debugobjects working again, we got the following: WARNING: at lib/debugobjects.c:262 debug_print_object+0x8e/0xb0() Hardware name: System Product Name ODEBUG: free active (active state 0) object type: timer_list hint: hci_cmd_timer+0x0/0x60 Pid: 2125, comm: dmsetup Tainted: G W 2.6.38-06707-gc62b389 #110375 Call Trace: [] warn_slowpath_common+0x7a/0xb0 [] warn_slowpath_fmt+0x46/0x50 [] debug_print_object+0x8e/0xb0 [] ? hci_cmd_timer+0x0/0x60 [] debug_check_no_obj_freed+0x125/0x230 [] ? check_object+0xb3/0x2b0 [] kfree+0x150/0x190 [] ? bt_host_release+0x16/0x20 [] bt_host_release+0x16/0x20 [] device_release+0x27/0xa0 [] kobject_release+0x4c/0xa0 [] ? kobject_release+0x0/0xa0 [] kref_put+0x36/0x70 [] kobject_put+0x27/0x60 [] put_device+0x17/0x20 [] hci_free_dev+0x29/0x30 [] vhci_release+0x36/0x70 [] fput+0xd6/0x1f0 [] filp_close+0x66/0x90 [] sys_close+0x99/0xf0 [] system_call_fastpath+0x16/0x1b That timer was introduced with commit 6bd32326cda(Bluetooth: Use proper timer for hci command timout) Timer seems to be running when the thing is closed. Removing the timer unconditionally fixes the problem. And yes, it needs to be fixed before the HCI_UP check. Signed-off-by: Thomas Gleixner --- net/bluetooth/hci_core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) Index: linux-2.6/net/bluetooth/hci_core.c =================================================================== --- linux-2.6.orig/net/bluetooth/hci_core.c +++ linux-2.6/net/bluetooth/hci_core.c @@ -584,6 +584,9 @@ static int hci_dev_do_close(struct hci_d hci_req_cancel(hdev, ENODEV); hci_req_lock(hdev); + /* Stop timer, it might be running */ + del_timer_sync(&hdev->cmd_timer); + if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { hci_req_unlock(hdev); return 0; @@ -623,7 +626,6 @@ static int hci_dev_do_close(struct hci_d /* Drop last sent command */ if (hdev->sent_cmd) { - del_timer_sync(&hdev->cmd_timer); kfree_skb(hdev->sent_cmd); hdev->sent_cmd = NULL; } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/