Bug 405546

Summary: btusb has problems, hci_usb works ok
Product: [openSUSE] openSUSE 11.0 Reporter: Juergen Weigert <jw>
Component: KernelAssignee: Oliver Neukum <oneukum>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Minor    
Priority: P4 - Low CC: behlert
Version: Final   
Target Milestone: ---   
Hardware: x86   
OS: openSUSE 11.0   
Whiteboard: maint:released:11.0:21569
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Bug Depends on:    
Bug Blocks: 357354    
Attachments: from /var/log/messages
oops excerpt from /var/log/messages

Description Juergen Weigert 2008-07-01 22:04:59 UTC
This is a lenovo X60, running SUSElinux 11.0
Linux linux-xuvg 2.6.25.4-10-pae #1 SMP 2008-05-28 16:25:04 +0200 i686 i686 i386 GNU/Linux

The machine is connected to the network via ppp dialin. 
The modem is a cellphone connected via bluetooth.

Due to the nature of this connection, I expect stalls, tcp-timeouts, latency buildup, and similar. Tonight the link was exceptionally bad and I had something new, that worries me:

Established a tunnel via novell-vpn, 
logged into the suse network via ssh. 
After typing a few commands, my laptop froze.
I repeated this 3 times and captured a relevant portion from /var/log/messages.
Comment 1 Juergen Weigert 2008-07-01 22:11:59 UTC
Created attachment 225435 [details]
from /var/log/messages

Attempt to release TCP socket in state 1 f699f080
l2cap_recv_acldata: Unexpected start frame (len 224)
l2cap_recv_acldata: Unexpected start frame (len 9)
WARNING: at include/net/dst.h:170 skb_release_all+0x23/0xbc()
...
Pid: 1554, comm: krfcommd Tainted: G        N 2.6.25.4-10-pae #1
 [<c01071d9>] dump_trace+0x63/0x227
...
Comment 2 Juergen Weigert 2008-07-09 18:25:08 UTC
It keeps freezing. 
Had it twice today while on the train.

kernel-debug installed.
sysrq enabled.

I'll try to get proper crashdump/process listings
next time it freezes.
Is there a way to get to a text console after it freezes?

Comment 3 Juergen Weigert 2008-07-16 18:28:49 UTC
Seife,
looks like this freeze happens while using btusb.

$ lsmod | grep usb
hci_usb                31900  0 
btusb                  23956  3 
bluetooth              74212  9 bnep,rfcomm,l2cap,hci_usb,btusb
usbcore               164812  5 hci_usb,btusb,ehci_hcd,uhci_hcd

$ rpm -q btusb-kmp-pae
btusb-kmp-pae-0.1_2.6.25.4_10-3

I did a flood ping and moved the phone 5, 10, 15, 20m away, until the ping no longer got through I get 'No buffer space available', which is fully recoverable by moving the phone closer. pings just resume fine.

Switching off the phone while transfer is in progress, gives 'Network is unreachable' and a dropped connection. Just as it should.

I cannot reproduce any freezes today.
Comment 4 Forgotten User ZhJd0F0L3x 2008-07-17 14:01:13 UTC
So while using btusb it did not freeze.
It might well be that after the next reboot, you'll be using hci_usb again.

Please configure that via modprobe.conf, retry with hci_usb only and with btusb only.

I'd guess that the freezes happen with hci_usb only.

That both modules are loaded is a bug in the btusb-kmp package, i will fix that, but I think it is "mostly harmless" - it is just not possible to predict which module will be actually used.

Adding Pavel to CC, since he has already experienced similar problems.
Comment 5 Juergen Weigert 2008-07-17 20:01:20 UTC
Switching modules, rebooting using hci_usb.
Tried my series of tricks, no crash either.

Comment 6 Pavel Machek 2008-08-04 08:11:14 UTC
Hmm, so btusb has problems and hci_usb works... bad :-(.

Comment 7 Oliver Neukum 2008-08-04 12:37:28 UTC
How do you draw that conclusion? It seems to me that the crash is not reproducible and might have happened with btusb or hci_usb and we don't know which because both modules were loaded.
Comment 8 Juergen Weigert 2008-08-05 08:18:08 UTC
May be related to 414206
Comment 9 Oliver Neukum 2008-08-05 10:50:55 UTC
So you think this is a network bug and bluetooth merely triggers it?
Comment 10 Oliver Neukum 2008-08-06 14:32:20 UTC
I can replicate a hang with btusb hanging in btusb_intr_complete()
I can semireliably trigger it compiling with CONFIG_BT_HCIBTUSB_DEBUG and doing obex transfers of large files.
Comment 11 Juergen Weigert 2008-10-29 10:08:24 UTC
Created attachment 248540 [details]
oops excerpt from /var/log/messages

another freeze today ca 1 minute after resume from ram.
I was able to start bluetooth modem connection, google a bit, then sudden death.

I have

usbcore               164812  4 hci_usb,uhci_hcd,ehci_hcd

but no btusb.
Comment 12 Oliver Neukum 2008-10-29 10:20:40 UTC
This may well be the double free issue fixed in 2.6.27
Comment 13 Karsten Keil 2008-12-01 14:53:01 UTC
Maybe you can backport this fix ?
Comment 14 Oliver Neukum 2008-12-08 11:37:53 UTC
The fix has been backported and applied. Please reopen if it happens after the next kernel update.
Comment 15 Swamp Workflow Management 2009-01-20 11:58:02 UTC
Update released for: kernel-debug, kernel-default, kernel-docs, kernel-kdump, kernel-pae, kernel-ppc64, kernel-ps3, kernel-rt, kernel-rt_debug, kernel-source, kernel-syms, kernel-vanilla, kernel-xen
Products:
openSUSE 11.0 (debug, i386, ppc, x86_64)