谁来帮帮Linus?(一)

有时候觉得Linus其实蛮搞笑的,不仅仅是他那句名言read the fucking source code.

下面是今天早上Linus同志提出来的一个问题,他的usb设备玩着玩着系统就崩溃了...谁来帮他找出原因吧.应该是用的2.6.22的代码.可能是driver的问题,也可能是设备本身有问题.其中的设备就是我们说过的那个多合一的读卡器.

I have a flaky(?) USB multi-card reader, and I just got an oops with it on
x86-64. It was preceded by some of the IO errors:

end_request: I/O error, dev sdc, sector 0
sd 11:0:0:1: [sdc] Result: hostbyte=0x07 driverbyte=0x00
end_request: I/O error, dev sdc, sector 0
Buffer I/O error on device sdc, logical block 0
usb 2-5: reset high speed USB device using ehci_hcd and address 10
usb 2-5: reset high speed USB device using ehci_hcd and address 10
usb 2-5: reset high speed USB device using ehci_hcd and address 10
usb 2-5: reset high speed USB device using ehci_hcd and address 10
usb 2-5: reset high speed USB device using ehci_hcd and address 10
usb 2-5: reset high speed USB device using ehci_hcd and address 10
usb 2-5: device descriptor read/all, error 0

but the oops itself happened when I then removed the USB device due to
the errors, causing this:

usb 2-5: USB disconnect, address 10
sd 11:0:0:1: [sdc] Result: hostbyte=0x07 driverbyte=0x00
end_request: I/O error, dev sdc, sector 0
Buffer I/O error on device sdc, logical block 0
sd 11:0:0:1: [sdc] Result: hostbyte=0x07 driverbyte=0x00
end_request: I/O error, dev sdc, sector 0
Buffer I/O error on device sdc, logical block 0
sd 11:0:0:1: [sdc] Result: hostbyte=0x01 driverbyte=0x00
end_request: I/O error, dev sdc, sector 0
Buffer I/O error on device sdc, logical block 0
<script type="text/javascript"><!-- D(["mb"," &nbsp; &nbsp; &nbsp; &nbsp;sd 11:0:0:1: [sdc] Result: hostbyte/u003d0x01 driverbyte/u003d0x00/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;end_request: I/O error, dev sdc, sector 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Buffer I/O error on device sdc, logical block 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;sd 11:0:0:1: [sdc] Result: hostbyte/u003d0x01 driverbyte/u003d0x00/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;end_request: I/O error, dev sdc, sector 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Buffer I/O error on device sdc, logical block 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Dev sdc: unable to read RDB block 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;sd 11:0:0:1: [sdc] Result: hostbyte/u003d0x01 driverbyte/u003d0x00/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;end_request: I/O error, dev sdc, sector 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Buffer I/O error on device sdc, logical block 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; unable to read partition table/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;sd 11:0:0:1: [sdc] Attached SCSI removable disk/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;sd 11:0:0:1: Attached scsi generic sg3 type 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;usb-storage: device scan complete/u003cbr //>/u003cbr //>and finally the oops itself:/u003cbr //>/u003cbr //>/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;general protection fault: 0000 [1] SMP/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;CPU 0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Modules linked in:/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Pid: 214, comm: khubd Not tainted 2.6.22-g20082208 #56/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;RIP: 0010:[&lt;ffffffff80274670&gt;] &nbsp;[&lt;ffffffff80274670&gt;] kfree+0x27/0x81/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;RSP: 0018:ffff81012bd0dd90 &nbsp;EFLAGS: 00010212/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;RAX: 037d001b2d7d01b8 RBX: ffff810001000000 RCX: ffffffff80314f0f/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;RDX: ffff81012337b738 RSI: 037c811b2e7d01b8 RDI: ff241b0cff251c0b/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;RBP: ff241b0cff251c0b R08: ffffffff8062eed0 R09: ffff81012bc0f430/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;R10: 0000000000000287 R11: ffffffff803ed953 R12: ffff81008642f140/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;R13: 0000000000000000 R14: 0000000000001540 R15: 0000000000000008/u003cbr //>",1] ); //--></script> sd 11:0:0:1: [sdc] Result: hostbyte=0x01 driverbyte=0x00
end_request: I/O error, dev sdc, sector 0
Buffer I/O error on device sdc, logical block 0
sd 11:0:0:1: [sdc] Result: hostbyte=0x01 driverbyte=0x00
end_request: I/O error, dev sdc, sector 0
Buffer I/O error on device sdc, logical block 0
Dev sdc: unable to read RDB block 0
sd 11:0:0:1: [sdc] Result: hostbyte=0x01 driverbyte=0x00
end_request: I/O error, dev sdc, sector 0
Buffer I/O error on device sdc, logical block 0
unable to read partition table
sd 11:0:0:1: [sdc] Attached SCSI removable disk
sd 11:0:0:1: Attached scsi generic sg3 type 0
usb-storage: device scan complete

and finally the oops itself:


general protection fault: 0000 [1] SMP
CPU 0
Modules linked in:
Pid: 214, comm: khubd Not tainted 2.6.22-g20082208 #56
RIP: 0010:[<ffffffff80274670>] [<ffffffff80274670>] kfree+0x27/0x81
RSP: 0018:ffff81012bd0dd90 EFLAGS: 00010212
RAX: 037d001b2d7d01b8 RBX: ffff810001000000 RCX: ffffffff80314f0f
RDX: ffff81012337b738 RSI: 037c811b2e7d01b8 RDI: ff241b0cff251c0b
RBP: ff241b0cff251c0b R08: ffffffff8062eed0 R09: ffff81012bc0f430
R10: 0000000000000287 R11: ffffffff803ed953 R12: ffff81008642f140
R13: 0000000000000000 R14: 0000000000001540 R15: 0000000000000008
<script type="text/javascript"><!-- D(["mb"," &nbsp; &nbsp; &nbsp; &nbsp;FS: &nbsp;0000000000000000(0000) GS:ffffffff806a0000(0000) knlGS:0000000000000000/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;CS: &nbsp;0010 DS: 0018 ES: 0018 CR0: 000000008005003b/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;CR2: 00002b02340410a0 CR3: 000000010bd4b000 CR4: 00000000000006e0/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Process khubd (pid: 214, threadinfo ffff81012bd0c000, task ffff81012bed36b0)/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Stack: &nbsp;ffff81012337b738 ffff81011e9fa800 ffff81008642f140 ffffffff803f50c4/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; ffff81012337b738 ffff81011e9fa800 ffffffff8064ae70 ffff81011e9fa888/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; ffff81012ad60978 ffff81012ad60800 ffff81012ad60800 ffffffff803ed96c/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Call Trace:/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff803f50c4&gt;] usb_destroy_configuration+0x85/u003cwbr //>/0xee/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff803ed96c&gt;] usb_release_dev+0x19/0x55/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff803140c9&gt;] kobject_cleanup+0x52/0x70/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff803140e7&gt;] kobject_release+0x0/0x9/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff80314f0f&gt;] kref_put+0x5d/0x68/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff803ef78f&gt;] hub_thread+0x390/0xb27/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff8023dcb1&gt;] autoremove_wake_function+0x0/u003cwbr //>/0x2e/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff803ef3ff&gt;] hub_thread+0x0/0xb27/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff8023db95&gt;] kthread+0x47/0x76/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff8020c0f8&gt;] child_rip+0xa/0x12/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff8023db4e&gt;] kthread+0x0/0x76/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; [&lt;ffffffff8020c0ee&gt;] child_rip+0x0/0x12/u003cbr //>/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;Code: 48 8b 06 25 00 40 02 00 48 3d 00 40 02 00 75 04 48 8b 76 10/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp;RIP &nbsp;[&lt;ffffffff80274670&gt;] kfree+0x27/0x81/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; RSP &lt;ffff81012bd0dd90&gt;/u003cbr //>",1] ); //--></script> FS: 0000000000000000(0000) GS:ffffffff806a0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
CR2: 00002b02340410a0 CR3: 000000010bd4b000 CR4: 00000000000006e0
Process khubd (pid: 214, threadinfo ffff81012bd0c000, task ffff81012bed36b0)
Stack: ffff81012337b738 ffff81011e9fa800 ffff81008642f140 ffffffff803f50c4
ffff81012337b738 ffff81011e9fa800 ffffffff8064ae70 ffff81011e9fa888
ffff81012ad60978 ffff81012ad60800 ffff81012ad60800 ffffffff803ed96c
Call Trace:
[<ffffffff803f50c4>] usb_destroy_configuration+0x85<wbr></wbr>/0xee
[<ffffffff803ed96c>] usb_release_dev+0x19/0x55
[<ffffffff803140c9>] kobject_cleanup+0x52/0x70
[<ffffffff803140e7>] kobject_release+0x0/0x9
[<ffffffff80314f0f>] kref_put+0x5d/0x68
[<ffffffff803ef78f>] hub_thread+0x390/0xb27
[<ffffffff8023dcb1>] autoremove_wake_function+0x0<wbr></wbr>/0x2e
[<ffffffff803ef3ff>] hub_thread+0x0/0xb27
[<ffffffff8023db95>] kthread+0x47/0x76
[<ffffffff8020c0f8>] child_rip+0xa/0x12
[<ffffffff8023db4e>] kthread+0x0/0x76
[<ffffffff8020c0ee>] child_rip+0x0/0x12

Code: 48 8b 06 25 00 40 02 00 48 3d 00 40 02 00 75 04 48 8b 76 10
RIP [<ffffffff80274670>] kfree+0x27/0x81
RSP <ffff81012bd0dd90>
<script type="text/javascript"><!-- D(["mb","/u003cbr //>Looks like another reference counting bug.../u003cbr //>/u003cbr //> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;Linus/u003cbr //>/u003cbr //>------------------------------/u003cwbr //>------------------------------/u003cwbr //>-------------/u003cbr //>This SF.net email is sponsored by: Splunk Inc./u003cbr //>Still grepping through log files to find problems? &nbsp;Stop./u003cbr //>Now Search log events and configuration files using AJAX and a browser./u003cbr //>Download your FREE copy of Splunk now &gt;&gt; &nbsp;/u003ca onclick/u003d/"return top.js.OpenExtLink(window,event,this)/" href/u003d/"http://get.splunk.com//" target/u003d_blank/>http://get.splunk.com//u003c/a/>/u003cbr //>/u003c/div/>",1] ); //--></script>
Looks like another reference counting bug...

Linus