On Monday 24 January 2005 4:14 am, Matthias Urlichs wrote: > Hi, > > our famous insert/eject tests with 2.6.11-rc1-mm1 look rather good, > except for this crash, observed once: > > > Unable to handle kernel NULL pointer dereference at virtual address 00000006 > > printing eip: > > e0233e53 > > *pde = 00000000 > > Oops: 0000 [#1] > > Modules linked in: edd md5 ipv6 af_packet pcmcia evdev joydev sg st sd_mod > > ohci_hcd sr_mod scsi_mod ide_cd cdrom ehci_hcd yenta_socket rsrc_nonstatic > > ftdi_sio usbserial pcmcia_core i2c_viapro i2c_core uhci_hcd parport_pc > > parport via_agp agpgart dm_mod usbcore 8139too mii > > CPU: 0 > > EIP: 0060:[<e0233e53>] Not tainted VLI > > EFLAGS: 00010046 (2.6.11-SIGOS-1) > > EIP is at finish_unlinks+0x113/0x2d0 [ohci_hcd]
Which FWIW seems to be incrementing urb_priv->td_cnt, right after the call to td_done(). And %esi holds urb_priv, which came from urb->hcpriv, which somehow became null. There's only one place that urb->hcpriv is nulled, and that's when the URB is given back to the driver. So the puzzle is how any URB got freed while one of its TDs was still on the endpoint queue. - Dave > > eax: dad6006c ebx: d5afcb00 ecx: 00000002 edx: 0000000f > > esi: 00000000 edi: d9fd9008 ebp: dad6006c esp: db2dbdc0 > > ds: 007b es: 007b ss: 0068 > > Process cardctl (pid: 9348, threadinfo=db2da000 task=da761060) > > Stack: dd08ecf0 d5afcb00 dad60140 d9fd9008 dd08ecfc dd08ec00 d9fd9020 > > 00000000 > > 00000000 dd08ecfc d9fd9000 0000cb00 d9fd9000 000003e8 00000286 > > dd08ecf0 > > e0234553 dd08ecf0 00000000 00000000 e02344d0 dee30448 dee30450 > > dd08ec00 > > Call Trace: > > [<e0234553>] ohci_endpoint_disable+0x83/0x160 [ohci_hcd] > > [<e02344d0>] ohci_endpoint_disable+0x0/0x160 [ohci_hcd] > > [<e017a1b6>] hcd_endpoint_disable+0x86/0xd0 [usbcore] > > ... ------------------------------------------------------- This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting Tool for open source databases. Create drag-&-drop reports. Save time by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc. Download a FREE copy at http://www.intelliview.com/go/osdn_nl _______________________________________________ linux-usb-devel@lists.sourceforge.net To unsubscribe, use the last form field at: https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
