regression: bluetooth oopses because of multiple kobject_add()

[Pavel Machek]

Hi!

On 2.6.20-rc2, I got:

This used to work before... certainly with 2.6.19.

Running this multiple times seems to trigger it:

#!/bin/bash
#
# Run tui on desktop machine, using t68i instead of a modem.
#

hciconfig hci0 name billionton
hciconfig hci0 up
hcid
rfcomm unbind 1
# t68
 rfcomm bind 1 00:80:37:??:??:??
stty -echo < /dev/rfcomm1

cd ~pavel/misc/tui/microwindows-0.91/src
( while true; do ~pavel/sf/tui/input_sx1 | bin/phone; done ) &
./launcher.sh

								Pavel

....
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
l2cap_recv_acldata: Unexpected continuation frame (len 0)
kobject_add failed for rfcomm1 with -EEXIST, don't try to register things with the same name in the same directory.
 [<c025121c>] kobject_add+0x1ac/0x1e0
 [<c0328d40>] device_add+0xb0/0x500
 [<c025156b>] kobject_init+0x2b/0x40
 [<c0328510>] device_create_release+0x0/0x10
 [<c0329229>] device_create+0x89/0xc0
 [<c02d854b>] tty_register_device+0x5b/0xf0
 [<c0612038>] _read_lock_bh+0x8/0x20
 [<c05e4072>] hci_get_route+0x112/0x120
 [<c05f04ed>] rfcomm_dev_ioctl+0x4cd/0x690
 [<c05ee6b9>] rfcomm_sock_ioctl+0x29/0x50
 [<c054409f>] sock_ioctl+0xaf/0x1d0
 [<c0543ff0>] sock_ioctl+0x0/0x1d0
 [<c017a23b>] do_ioctl+0x2b/0xa0
 [<c017a30c>] vfs_ioctl+0x5c/0x2e0
 [<c017a5cd>] sys_ioctl+0x3d/0x70
 [<c010304c>] syscall_call+0x7/0xb
 [<c0610033>] schedule+0x2c3/0x8f0
 =======================
BUG: unable to handle kernel NULL pointer dereference at virtual address 0000003c
 printing eip:
c05ef978
*pde = 00000000
BUG: soft lockup detected on CPU#0!
 [<c014d469>] softlockup_tick+0xa9/0xd0
 [<c0131383>] update_process_times+0x33/0x80
 [<c011ab7b>] smp_apic_timer_interrupt+0x6b/0x80
 [<c0103aa4>] apic_timer_interrupt+0x28/0x30
 [<c0255606>] delay_tsc+0x16/0x20
 [<c0255646>] __delay+0x6/0x10
 [<c011fbbb>] do_page_fault+0x35b/0x600
 [<c011f860>] do_page_fault+0x0/0x600
 [<c061237c>] error_code+0x7c/0x84
 [<c02d007b>] read_fan+0x59/0x6f
 [<c05ef978>] rfcomm_tty_chars_in_buffer+0x8/0x20
 [<c02dcd64>] normal_poll+0xd4/0x140
 [<c02dcc90>] normal_poll+0x0/0x140
 [<c02d9f4b>] tty_poll+0x6b/0x90
 [<c017b5c9>] do_select+0x219/0x4b0
 [<c017ac00>] __pollwait+0x0/0x110
 [<c0123c90>] default_wake_function+0x0/0x10
 [<c0123c90>] default_wake_function+0x0/0x10
 [<c0123c90>] default_wake_function+0x0/0x10
 [<c018f0a0>] __find_get_block_slow+0xc0/0x140
 [<c0169c39>] poison_obj+0x29/0x60
 [<c016962e>] dbg_redzone1+0xe/0x20
 [<c016a51e>] cache_alloc_debugcheck_after+0x3e/0x150
 [<c016a364>] check_poison_obj+0x24/0x1a0
 [<c019129f>] __find_get_block+0xcf/0x1c0
 [<c0169c39>] poison_obj+0x29/0x60
 [<c0169c39>] poison_obj+0x29/0x60
 [<c016a220>] cache_free_debugcheck+0xb0/0x1d0
 [<c01c0592>] journal_stop+0x162/0x1f0
 [<c01c0592>] journal_stop+0x162/0x1f0
 [<c01ba0e4>] __ext3_journal_stop+0x24/0x50
 [<c01b29f1>] ext3_ordered_commit_write+0xa1/0xd0
 [<c01b16a0>] ext3_journal_dirty_data+0x0/0x50
 [<c015162b>] generic_file_buffered_write+0x39b/0x680
 [<c01ba0e4>] __ext3_journal_stop+0x24/0x50
 [<c018a824>] __mark_inode_dirty+0x34/0x1c0
 [<c0152a43>] __generic_file_aio_write_nolock+0x283/0x590
 [<c017ba26>] core_sys_select+0x1c6/0x2e0
 [<c06112cf>] __mutex_lock_slowpath+0xef/0x230
 [<c0152db2>] generic_file_aio_write+0x62/0xd0
 [<c01b0570>] ext3_file_write+0x30/0xc0
 [<c016ea77>] do_sync_write+0xc7/0x130
 [<c015e392>] __handle_mm_fault+0x642/0x890
 [<c013c680>] autoremove_wake_function+0x0/0x50
 [<c02d82d5>] tty_ldisc_deref+0x15/0x70
 [<c017bea1>] sys_select+0x51/0x1c0
 [<c010304c>] syscall_call+0x7/0xb
 =======================
Oops: 0000 [#1]
SMP 
Modules linked in:
CPU:    0
EIP:    0060:[<c05ef978>]    Not tainted VLI
EFLAGS: 00010246   (2.6.20-rc2 #384)
EIP is at rfcomm_tty_chars_in_buffer+0x8/0x20
eax: 00000000   ebx: db0e5704   ecx: 00000000   edx: f79858ac
esi: 00000000   edi: f7599528   ebp: 00000000   esp: da73bb54
ds: 007b   es: 007b   ss: 0068
Process phone (pid: 3930, ti=da73a000 task=dc212a70 task.ti=da73a000)
Stack: c02dcd64 00610a52 f7599528 db0e5704 c02dcc90 c02d9f4b 00000000 db0e5710 
       00000010 f7599528 00000004 0000001c c017b5c9 00000000 da73bf9c da73bf54 
       00000000 da73be60 da73be64 da73be68 da73be58 da73be5c da73be60 00000011 
Call Trace:
 [<c02dcd64>] normal_poll+0xd4/0x140
 [<c02dcc90>] normal_poll+0x0/0x140
 [<c02d9f4b>] tty_poll+0x6b/0x90
 [<c017b5c9>] do_select+0x219/0x4b0
 [<c017ac00>] __pollwait+0x0/0x110
 [<c0123c90>] default_wake_function+0x0/0x10
 [<c0123c90>] default_wake_function+0x0/0x10
 [<c0123c90>] default_wake_function+0x0/0x10
 [<c018f0a0>] __find_get_block_slow+0xc0/0x140
 [<c0169c39>] poison_obj+0x29/0x60
 [<c016962e>] dbg_redzone1+0xe/0x20
 [<c016a51e>] cache_alloc_debugcheck_after+0x3e/0x150
 [<c016a364>] check_poison_obj+0x24/0x1a0
 [<c019129f>] __find_get_block+0xcf/0x1c0
 [<c0169c39>] poison_obj+0x29/0x60
 [<c0169c39>] poison_obj+0x29/0x60
 [<c016a220>] cache_free_debugcheck+0xb0/0x1d0
 [<c01c0592>] journal_stop+0x162/0x1f0
 [<c01c0592>] journal_stop+0x162/0x1f0
 [<c01ba0e4>] __ext3_journal_stop+0x24/0x50
 [<c01b29f1>] ext3_ordered_commit_write+0xa1/0xd0
 [<c01b16a0>] ext3_journal_dirty_data+0x0/0x50
 [<c015162b>] generic_file_buffered_write+0x39b/0x680
 [<c01ba0e4>] __ext3_journal_stop+0x24/0x50
 [<c018a824>] __mark_inode_dirty+0x34/0x1c0
 [<c0152a43>] __generic_file_aio_write_nolock+0x283/0x590
 [<c017ba26>] core_sys_select+0x1c6/0x2e0
 [<c06112cf>] __mutex_lock_slowpath+0xef/0x230
 [<c0152db2>] generic_file_aio_write+0x62/0xd0
 [<c01b0570>] ext3_file_write+0x30/0xc0
 [<c016ea77>] do_sync_write+0xc7/0x130
 [<c015e392>] __handle_mm_fault+0x642/0x890
 [<c013c680>] autoremove_wake_function+0x0/0x50
 [<c02d82d5>] tty_ldisc_deref+0x15/0x70
 [<c017bea1>] sys_select+0x51/0x1c0
 [<c010304c>] syscall_call+0x7/0xb
 =======================
Code: 8d 76 00 8b 80 60 01 00 00 8b 50 3c f0 0f ba 72 3c 00 19 c0 85 c0 75 01 c3 89 d0 e9 f3 cb ff ff 8d 76 00 8b 80 60 01 00 00 31 c9 <8b> 50 3c 8d 42 0c 39 42 0c 74 03 8b 4a 50 89 c8 c3 8d b4 26 00 
EIP: [<c05ef978>] rfcomm_tty_chars_in_buffer+0x8/0x20 SS:ESP 0068:da73bb54
 


-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Attachment: delme.bz2
Description: Binary data