Re: Kernel oops with bluetooth usb dongle

Re: Kernel oops with bluetooth usb dongle

[Quel Qun]

 -------------- Original message ----------------------
From: Thomas Gleixner <tglx@linutronix.de>
> On Fri, 22 Feb 2008, David Woodhouse wrote:
>  
> > On Fri, 2008-02-22 at 08:23 +0100, Thomas Gleixner wrote:
> > > 
> > > +       del_timer(&conn->info_timer);
> > > +
> > >         hcon->l2cap_data = NULL;
> > >         kfree(conn);
> > 
> > Shouldn't that be del_timer_sync() ?
> 
> Hmm, probably yes.
> 
Hi,

Great news: only adding adding del_timer_sync() to 2.6.25-rc3 does prevent the crash.

Bad news: I still cannot use the device.

hcitool inq, hcitool scan, hcitool name <btaddr> and hcitool info <btaddr> 
commands work.

hcitool cc <btaddr>, sdptool <btaddr>, rfcomm connect command fail, most of them 
with a 'Connection reset by peer' error.

# rpm -q bluez-utils
bluez-utils-3.27-1mdv2008.1

Thank you,
--
Eric

Re: Kernel oops with bluetooth usb dongle

[Marcel Holtmann]

Hi Quel,

> -------------- Original message ----------------------
> From: Thomas Gleixner <tglx@linutronix.de>
>> On Fri, 22 Feb 2008, David Woodhouse wrote:
>>
>>> On Fri, 2008-02-22 at 08:23 +0100, Thomas Gleixner wrote:
>>>>
>>>> +       del_timer(&conn->info_timer);
>>>> +
>>>>        hcon->l2cap_data = NULL;
>>>>        kfree(conn);
>>>
>>> Shouldn't that be del_timer_sync() ?
>>
>> Hmm, probably yes.
>>
> Hi,
>
> Great news: only adding adding del_timer_sync() to 2.6.25-rc3 does  
> prevent the crash.
>
> Bad news: I still cannot use the device.
>
> hcitool inq, hcitool scan, hcitool name <btaddr> and hcitool info  
> <btaddr>
> commands work.
>
> hcitool cc <btaddr>, sdptool <btaddr>, rfcomm connect command fail,  
> most of them
> with a 'Connection reset by peer' error.

what does "hciconfig hci0 version" tell you about your device? Some of  
the none major based Bluetooth chips are broken and might need an  
extra tweak within the USB driver.

Regards

Marcel

[PATCH] bluetooth: delete timer in l2cap_conn_del()

[Thomas Gleixner]

Delete a possibly armed timer before kfree'ing the connection object.

Solves: http://lkml.org/lkml/2008/2/15/514

Reported-by:Quel Qun <kelk1@comcast.net>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

---
 net/bluetooth/l2cap.c |    2 ++
 1 file changed, 2 insertions(+)

Index: linux-2.6/net/bluetooth/l2cap.c
===================================================================
--- linux-2.6.orig/net/bluetooth/l2cap.c
+++ linux-2.6/net/bluetooth/l2cap.c
@@ -417,6 +417,8 @@ static void l2cap_conn_del(struct hci_co
 		l2cap_sock_kill(sk);
 	}
 
+	del_timer_sync(&conn->info_timer);
+
 	hcon->l2cap_data = NULL;
 	kfree(conn);
 }

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Marcel Holtmann]

Hi Quel,

> Delete a possibly armed timer before kfree'ing the connection object.
>
> Solves: http://lkml.org/lkml/2008/2/15/514
>
> Reported-by:Quel Qun <kelk1@comcast.net>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
>
> ---
> net/bluetooth/l2cap.c |    2 ++
> 1 file changed, 2 insertions(+)
>
> Index: linux-2.6/net/bluetooth/l2cap.c
> ===================================================================
> --- linux-2.6.orig/net/bluetooth/l2cap.c
> +++ linux-2.6/net/bluetooth/l2cap.c
> @@ -417,6 +417,8 @@ static void l2cap_conn_del(struct hci_co
> 		l2cap_sock_kill(sk);
> 	}
>
> +	del_timer_sync(&conn->info_timer);
> +
> 	hcon->l2cap_data = NULL;
> 	kfree(conn);
> }

can you confirm that this actually fixes the issue.

Thomas, if confirmed, this is Acked-by me.

Regards

Marcel

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[David Miller]

From: Thomas Gleixner <tglx@linutronix.de>
Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)

> Delete a possibly armed timer before kfree'ing the connection object.
> 
> Solves: http://lkml.org/lkml/2008/2/15/514
> 
> Reported-by:Quel Qun <kelk1@comcast.net>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

I'll apply this, thanks Thomas.

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Marcel Holtmann]

Hi Dave,

> From: Thomas Gleixner <tglx@linutronix.de>
> Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
>
>> Delete a possibly armed timer before kfree'ing the connection object.
>>
>> Solves: http://lkml.org/lkml/2008/2/15/514
>>
>> Reported-by:Quel Qun <kelk1@comcast.net>
>> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
>
> I'll apply this, thanks Thomas.

can you please wait for a confirmation from Quel that this fixes it.  
My ACK is based on that he confirms that it fixes it for sure.

Regards

Marcel

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Thomas Gleixner]

On Wed, 27 Feb 2008, Marcel Holtmann wrote:

> Hi Dave,
> 
> > From: Thomas Gleixner <tglx@linutronix.de>
> > Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
> > 
> > > Delete a possibly armed timer before kfree'ing the connection object.
> > > 
> > > Solves: http://lkml.org/lkml/2008/2/15/514
> > > 
> > > Reported-by:Quel Qun <kelk1@comcast.net>
> > > Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> > 
> > I'll apply this, thanks Thomas.
> 
> can you please wait for a confirmation from Quel that this fixes it. My ACK is
> based on that he confirms that it fixes it for sure.

http://lkml.org/lkml/2008/2/25/463

Thanks,

	tglx

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[David Miller]

From: Marcel Holtmann <marcel@holtmann.org>
Date: Wed, 27 Feb 2008 10:55:07 +0100

> Hi Dave,
> 
> > From: Thomas Gleixner <tglx@linutronix.de>
> > Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
> >
> >> Delete a possibly armed timer before kfree'ing the connection object.
> >>
> >> Solves: http://lkml.org/lkml/2008/2/15/514
> >>
> >> Reported-by:Quel Qun <kelk1@comcast.net>
> >> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> >
> > I'll apply this, thanks Thomas.
> 
> can you please wait for a confirmation from Quel that this fixes it.  
> My ACK is based on that he confirms that it fixes it for sure.

It doesn't hurt to toss this to Linus now, if it's bogus we
have tons of time to revert it.

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[David Miller]

Marcel/Dave, can you or someone else followup with
the bug reportor to get their dongle working now that
the OOPS problem is fixed?

Let's not lose track of this bug, thanks.

Re: Kernel oops with bluetooth usb dongle

[Dave Young]

On Tue, Feb 26, 2008 at 8:03 AM, Quel Qun <kelk1@comcast.net> wrote:
>  -------------- Original message ----------------------
>  From: Thomas Gleixner <tglx@linutronix.de>
>
>
> > On Fri, 22 Feb 2008, David Woodhouse wrote:
>  >
>  > > On Fri, 2008-02-22 at 08:23 +0100, Thomas Gleixner wrote:
>  > > >
>  > > > +       del_timer(&conn->info_timer);
>  > > > +
>  > > >         hcon->l2cap_data = NULL;
>  > > >         kfree(conn);
>  > >
>  > > Shouldn't that be del_timer_sync() ?
>  >
>  > Hmm, probably yes.
>  >
>  Hi,
>
>  Great news: only adding adding del_timer_sync() to 2.6.25-rc3 does prevent the crash.
>
>  Bad news: I still cannot use the device.
>
>  hcitool inq, hcitool scan, hcitool name <btaddr> and hcitool info <btaddr>
>  commands work.
>
>  hcitool cc <btaddr>, sdptool <btaddr>, rfcomm connect command fail, most of them
>  with a 'Connection reset by peer' error.

Could you send the dmesg and hcidump content while connecting (eg.
rfcomm connect)?

>
>  # rpm -q bluez-utils
>  bluez-utils-3.27-1mdv2008.1
>
>  Thank you,
>  --
>  Eric
>

Re: Kernel oops with bluetooth usb dongle

[Dave Young]

add davem to cc-list

On Thu, Feb 28, 2008 at 9:03 AM, Dave Young <hidave.darkstar@gmail.com> wrote:
>
> On Tue, Feb 26, 2008 at 8:03 AM, Quel Qun <kelk1@comcast.net> wrote:
>  >  -------------- Original message ----------------------
>  >  From: Thomas Gleixner <tglx@linutronix.de>
>  >
>  >
>  > > On Fri, 22 Feb 2008, David Woodhouse wrote:
>  >  >
>  >  > > On Fri, 2008-02-22 at 08:23 +0100, Thomas Gleixner wrote:
>  >  > > >
>  >  > > > +       del_timer(&conn->info_timer);
>  >  > > > +
>  >  > > >         hcon->l2cap_data = NULL;
>  >  > > >         kfree(conn);
>  >  > >
>  >  > > Shouldn't that be del_timer_sync() ?
>  >  >
>  >  > Hmm, probably yes.
>  >  >
>  >  Hi,
>  >
>  >  Great news: only adding adding del_timer_sync() to 2.6.25-rc3 does prevent the crash.
>  >
>  >  Bad news: I still cannot use the device.
>  >
>  >  hcitool inq, hcitool scan, hcitool name <btaddr> and hcitool info <btaddr>
>  >  commands work.
>  >
>  >  hcitool cc <btaddr>, sdptool <btaddr>, rfcomm connect command fail, most of them
>  >  with a 'Connection reset by peer' error.
>
>  Could you send the dmesg and hcidump content while connecting (eg.
>  rfcomm connect)?
>
>
>
>  >
>  >  # rpm -q bluez-utils
>  >  bluez-utils-3.27-1mdv2008.1
>  >
>  >  Thank you,
>  >  --
>  >  Eric
>  >
>

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Quel Qun]

 -------------- Original message ----------------------
From: David Miller <davem@davemloft.net>
> 
> Marcel/Dave, can you or someone else followup with
> the bug reporter to get their dongle working now that
> the OOPS problem is fixed?
> 
> Let's not lose track of this bug, thanks.

I entered #10126

http://bugzilla.kernel.org/show_bug.cgi?id=10126

Thank you,
--
kk1

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Thomas Gleixner]

On Wed, 27 Feb 2008, Quel Qun wrote:
> > > > I'll apply this, thanks Thomas.
> > > 
> > > can you please wait for a confirmation from Quel that this fixes it.  
> > > My ACK is based on that he confirms that it fixes it for sure.
> > 
> > It doesn't hurt to toss this to Linus now, if it's bogus we
> > have tons of time to revert it.
>
> As I said, it prevents the crash, but does not 'fix' my problem, in
> that I still cannot use the dongle.

The disfunctionality of your dongle is a separate problem and I hope
that the bluetooth wizards will help you to get this sucker running.

The timer which is not deactivated before the data structure
containing it is a simple bug, which needs to be addressed ASAP.

Thanks again for your patience in tracking this down,

	tglx

Re: [PATCH] bluetooth: delete timer in l2cap_conn_del()

[Quel Qun]

 -------------- Original message ----------------------
From: David Miller <davem@davemloft.net>
> From: Marcel Holtmann <marcel@holtmann.org>
> Date: Wed, 27 Feb 2008 10:55:07 +0100
> 
> > Hi Dave,
> > 
> > > From: Thomas Gleixner <tglx@linutronix.de>
> > > Date: Tue, 26 Feb 2008 09:28:13 +0100 (CET)
> > >
> > >> Delete a possibly armed timer before kfree'ing the connection object.
> > >>
> > >> Solves: http://lkml.org/lkml/2008/2/15/514
> > >>
> > >> Reported-by:Quel Qun <kelk1@comcast.net>
> > >> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> > >
> > > I'll apply this, thanks Thomas.
> > 
> > can you please wait for a confirmation from Quel that this fixes it.  
> > My ACK is based on that he confirms that it fixes it for sure.
> 
> It doesn't hurt to toss this to Linus now, if it's bogus we
> have tons of time to revert it.

As I said, it prevents the crash, but does not 'fix' my problem, in that I still cannot use the dongle.
--
kk1