Bug 352513 – sys-kernel/gentoo-sources-2.6.37: bug in rt61pci module when removing pcmcia card

• Product: Gentoo Linux
• Status: RESOLVED TEST-REQUEST

[Description Marek Mrva 2011-01-23 17:05:35 UTC]

After removing my wireless network card (WMM-3000PCM) from the pcmcia slot, the kernel outputs the following. Afterwards, the card will not be detected, and the module hangs when being removed.
  The card uses the rt61pci module from the kernel. When issuing 'rmmod rt61pci' prior to removal, everything works just fine.

Tested also with
  2.6.34-r12 (built-in, works OK), 
  2.6.36-r5 (module, gives the same error)

Reproducible: Always

Steps to Reproduce:
1. Compile the kernel with rt61pci as a module
2. Remove the card from the slot
3.

Actual Results:  
Shows this error: 
[  165.614594] BUG: unable to handle kernel NULL pointer dereference at   (null)
[  165.614713] IP: [<f87d06ea>] rt61pci_config+0x14/0x229 [rt61pci]
[  165.614805] *pde = 00000000 
[  165.614848] Oops: 0000 [#1] PREEMPT 
...

Expected Results:  
No error message, module unloads.

> emerge --info
Portage 2.1.9.25 (default/linux/x86/10.0/desktop/kde, gcc-4.4.4, glibc-2.11.2-r3, 2.6.34-gentoo-r12 i686)
=================================================================
System uname: Linux-2.6.34-gentoo-r12-i686-Intel-R-_Celeron-R-_M_processor_1.30GHz-with-gentoo-1.12.14
Timestamp of tree: Sat, 22 Jan 2011 18:45:03 +0000
distcc 3.1 i686-pc-linux-gnu [disabled]
app-shells/bash:     4.1_p7
dev-java/java-config: 2.1.11-r1
dev-lang/python:     2.6.6-r1, 3.1.2-r4
dev-util/cmake:      2.8.1-r2
sys-apps/baselayout: 1.12.14-r1
sys-apps/sandbox:    2.4
sys-devel/autoconf:  2.13, 2.65-r1
sys-devel/automake:  1.9.6-r3, 1.10.3, 1.11.1
sys-devel/binutils:  2.20.1-r1                                                                                                                 
sys-devel/gcc:       4.3.4, 4.4.4-r2                                                                                                           
sys-devel/gcc-config: 1.4.1                                                                                                                    
sys-devel/libtool:   2.2.10                                                                                                                    
sys-devel/make:      3.81-r2                                                                                                                   
virtual/os-headers:  2.6.30-r1 (sys-kernel/linux-headers)                                                                                      
ACCEPT_KEYWORDS="x86"                                                                                                                          
ACCEPT_LICENSE="* -@EULA"                                                                                                                      
CBUILD="i686-pc-linux-gnu"                                                                                                                     
CFLAGS="-O2 -march=pentium-m -pipe"                                                                                                            
CHOST="i686-pc-linux-gnu"                                                                                                                      
CONFIG_PROTECT="/etc /usr/share/config"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/env.d/java/ /etc/fonts/fonts.conf /etc/gconf /etc/php/apache2-php5.3/ext-active/ /etc/php/cgi-php5.3/ext-active/ /etc/php/cli-php5.3/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-O2 -march=pentium-m -pipe"
DISTDIR="/usr/portage/distfiles"
FEATURES="assume-digests binpkg-logs distlocks fixlafiles fixpackages news parallel-fetch protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch"
GENTOO_MIRRORS="http://gentoo.ynet.sk/pub http://gentoo.wheel.sk http://ftp.fi.muni.cz/pub/linux/gentoo http://mirror.gentoo.se"
LANG="en_US.UTF-8"
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
LINGUAS="en sk"
PKGDIR="/usr/portage/packages"
PORTAGE_CONFIGROOT="/"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.europe.gentoo.org/gentoo-portage"
USE="7zip X a52 aac aalib acl acpi alsa apm berkdb bluetooth branding bzip2 cairo cdr cli consolekit cracklib crypt css cups cxx dbus directfb dri dts dvd dvdr emboss encode exif fam firefox flac fortran gdbm gdu gif gnutls gpm gtk iconv java jpeg jpeg2k kde kdehiddenvisibility lame lcms ldap libnotify mad mikmod mmx mng modules mp3 mp4 mpeg mudflap ncurses network nls nptl nptlonly ogg opengl openmp pam pango pcre pdf perl png policykit ppds pppd python qt3support qt4 quicktime readline samba sdl session spell sse sse2 ssl startup-notification svg sysfs tcpd tiff truetype udev unicode usb vorbis wav x264 x86 xcb xinerama xml xorg xulrunner xv xvid xvmc zlib" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1 emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mmap_emul mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ubx" INPUT_DEVICES="evdev keyboard mouse synaptics" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LINGUAS="en sk" PHP_TARGETS="php5-3" RUBY_TARGETS="ruby18" USERLAND="GNU" VIDEO_CARDS="intel" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" 
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, FFLAGS, INSTALL_MASK, LC_ALL, MAKEOPTS, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

[Comment 1 Marek Mrva 2011-01-23 17:08:12 UTC]

Created attachment 260547 [details]
dmesg output

[Comment 2 Mike Pagano 2011-03-21 22:45:28 UTC]

Please test with gentoo-sources-2.6.38 and post the results.

[Comment 3 Marek Mrva 2011-04-14 20:52:11 UTC]

(In reply to comment #2)
> Please test with gentoo-sources-2.6.38 and post the results.

Tested with the driver both as a module and built-in, showing basically the same results. I can post them here, if they would be of any help...

[Comment 4 Stratos Psomadakis (RETIRED) 2011-04-30 18:18:27 UTC]

Created attachment 271659 [details, diff]
use spinlock to unload the module

Hm, looks like a 'race condition' between the removal functions, and a pending irq on the device. Maybe a spinlock, which will be aquired during the irq, and when the driver is going to be unloaded could work. 

I saw they've changed the code a bit in 2.6.39, to use a spinlock, in order to protect the irq mask, so you can also try the latest -rc release, and see if that resolves your issue.

I attach a simple patch to use a spinlock(diff'ed against 2.6.38 clean sources), which could fix your problem. Probably it won't work, but if you want, give it a try (it builds cleanly, but I cannot test it myself unfortunately).