oops with usb-serial converter

Hello,

the attached kernel oops happens repeatable

Hardware:
Dell Inspiron 2600 Laptop
USB-Serial Converter: UC-232A

Software:
minicom (V1.82.1)
kernel: 2.4.19-rc3

          2.4.19-rc3-ac3

Description:
After modprobing the appropiate modules (pl2303, usbserial, usbcore, uhci) and calling minicom on the device (/dev/usb/tts/0), everything seems fine (can login, etc). But after exiting minicom, it ends with a segmentation fault and the oops occurs. So the oops always occurs at the moment I exit minicom. The oops also occurs when running a getty on the device. After that, I cannot remove the modules anymore.

ksymoops < the_oops.txt:

--------------------------------------8<--------------------------------------

Unable to handle kernel NULL pointer dereference at virtual address 00000014
c8bb0345
*pde = 00000000
Oops: 0000
CPU:    0
EIP:    0010:[<c8bb0345>]    Not tainted

Using defaults from ksymoops -t elf32-i386 -a i386
EFLAGS: 00010006
eax: c48fc800 ebx: ffffff8d ecx: c4f1d800 edx: 00000000
esi: c545a420 edi: 00000000 ebp: 00000246 esp: c1dbbe70
ds: 0018 es: 0018 ss: 0018
Process minicom (pid: 571, stackpage=c1dbb000)

Stack: ffffff8d c545a420 00000000 00000282 c8bb1a78 c545a420 c545a428 c545a420
       00000286 c5452060 00000001 00000000 c48fcc00 c23781d4 c8bb0fd0 c545a420
       c4f1d87c c4f1d820 ffffffff c4f1d800 00000064 c23781d4 c8b9604e c545a420
Call Trace:    [<c8bb1a78>] [<c8bb0fd0>] [<c8b9604e>] [<c8baaee9>] [<c8ba4484>]
  [<c01b4d80>] [<c017a6d6>] [<c017a650>] [<c0142486>] [<c014388f>] [<c0141f38>]
  [<c01b53ae>] [<c0131ff4>] [<c0131045>] [<c0131093>] [<c01086ab>]
Code: 8b 52 14 8b 42 e8 8b 7a ec 25 00 00 00 2f 0d 00 00 80 01 89

Trace; c8bb1a78 <[uhci]uhci_call_completion+170/1b0> Trace; c8bb0fd0 <[uhci]uhci_unlink_urb+168/174> Trace; c8b9604e <[usbcore]usb_unlink_urb+26/30> Trace; c8baaee8 <[pl2303]pl2303_close+14c/194> Trace; c8ba4484 <[usbserial]serial_close+a0/b0> Trace; c01b4d80 <release_dev+240/4fc>
Trace; c017a6d6 <reiserfs_delete_inode+86/98> Trace; c017a650 <reiserfs_delete_inode+0/98> Trace; c0142486 <destroy_inode+26/2c>
Trace; c014388e <iput+1ce/1d8>
Trace; c0141f38 <d_delete+4c/6c>
Trace; c01b53ae <tty_release+a/10>
Trace; c0131ff4 <fput+4c/d0>
Trace; c0131044 <filp_close+54/60>
Trace; c0131092 <sys_close+42/54>
Trace; c01086aa <system_call+32/38>
Code; c8bb0344 <[uhci]uhci_reset_interrupt+24/a0> 00000000 <_EIP>:
Code; c8bb0344 <[uhci]uhci_reset_interrupt+24/a0> <=====
0: 8b 52 14 mov 0x14(%edx),%edx <=====
Code; c8bb0346 <[uhci]uhci_reset_interrupt+26/a0>
3: 8b 42 e8 mov 0xffffffe8(%edx),%eax
Code; c8bb034a <[uhci]uhci_reset_interrupt+2a/a0>
6: 8b 7a ec mov 0xffffffec(%edx),%edi
Code; c8bb034c <[uhci]uhci_reset_interrupt+2c/a0>
9: 25 00 00 00 2f and $0x2f000000,%eax
Code; c8bb0352 <[uhci]uhci_reset_interrupt+32/a0>
e: 0d 00 00 80 01 or $0x1800000,%eax
Code; c8bb0356 <[uhci]uhci_reset_interrupt+36/a0>
13: 89 00 mov %eax,(%eax)

--------------------------------------8<--------------------------------------

Greetings,

Peter

Can you see if the 2.5.29 kernel fixes this problem? The usb-serial close() call has been modified to hopefully prevent this from happening in the 2.5 tree.

And can you also send the output of /proc/bus/usb/devices with your device plugged in? There are a lot of different devices that work with this driver, and I'd like to try to keep track of those that have problems.

thanks,

greg k-h

If you do - make a backup before you try it

Thx for the hint, since I'll need the laptop tomorrow at a customer, I can try this the day after.

cheers,

Peter

Peter Kruse <[email protected]>
Q-Leap Networks GmbH
+497071-703171

Hello,

unfortunately the kernel doesn't compile:

lvm.c:1: #error Broken until maintainers will sanitize kdev_t handling lvm.c: In function `lvm_user_bmap':
lvm.c:1012: structure has no member named bi_dev' lvm.c:1013: structure has no member named bi_dev' lvm.c:1021: structure has no member named bi_dev' lvm.c:1021: structure has no member named bi_dev' lvm.c:1021: structure has no member named bi_dev' lvm.c:1021: structure has no member named bi_dev'
lvm.c: In function `lvm_map':
lvm.c:1091: structure has no member named bi_dev' lvm.c:1215: structure has no member named bi_dev'
lvm.c: In function `lvm_do_pe_lock_unlock':
lvm.c:1321: warning: implicit declaration of function fsync_dev' lvm.c: In function __update_hardsectsize':
lvm.c:1789: warning: implicit declaration of function `get_hardsect_size'
lvm.c: In function `lvm_do_lv_remove':
lvm.c:2127: warning: implicit declaration of function `invalidate_buffers'
lvm.c: In function `lvm_geninit':
lvm.c:2660: `blksize_size' undeclared (first use in this function) lvm.c:2660: (Each undeclared identifier is reported only once lvm.c:2660: for each function it appears in.)
make[2]: *** [lvm.o] Error 1
make[2]: Leaving directory `/usr/src/linux-2.5.29/drivers/md' make[1]: *** [md] Error 2
make[1]: Leaving directory `/usr/src/linux-2.5.29/drivers'
make: *** [drivers] Error 2

this is with: gcc --version 2.95.4

well, I use lvm, now I could try to compile without lvm support and boot into single user mode, and see if that works... or could you send me the function in question (maybe as a patch to 2.4.19-rc3?) - and if it works then, maybe the 2.4.19 final will include the patch?

thanks for your support,

Peter

Peter Kruse <[email protected]>
Q-Leap Networks GmbH
+497071-703171

Sorry, it's a big change, that will get backported to 2.4.20, but I don't have the time to do it right now (and it's too late for 2.4.19 anyway.) So I don't have a 2.4.19-rc3 patch.

Sorry,

greg k-h

ok, didn't recognize that, so I'll try to do without lvm.

Peter

Peter Kruse <[email protected]>
Q-Leap Networks GmbH
+497071-703171