ftdi_open() of ftdi_sio v1.4.3 crash at _spin_lock_irqsave

Question

i'm working on an sms related program using a ftdichip modem in gentoo-2.6.30 with ftdi_sio driver v1.4.3. But i'm running into a weird situation now: when OS starts up, my program will try to open /dev/ttyUSB0 infinitely without sleep until it succeeds(due to not considered properly when coding), and then i plugin my USB serial modem, a bug message will show up immediately with dmesg, and if i unplug modem, the system will have no response.

the BUG message is :

[   43.769794] BUG: unable to handle kernel NULL pointer dereference at 00000074
[   43.775687] IP: [<405829ba>] _spin_lock_irqsave+0x8/0x1a
[   43.775687] *pdpt = 000000009ad51001 <6>usb 2-2: Detected FT232BM
[   43.785760] usb 2-2: FTDI USB Serial Device converter now attached to ttyUSB0
[   43.785840] drivers/usb/core/inode.c: creating file '002'
[   43.785686] *pde = 0000000000000000
[   43.785686] Oops: 0002 [#1] SMP
[   43.785686] last sysfs file:
[   43.785686] Modules linked in: ixgbe igb dca e1000e e1000
[   43.785686]
[   43.785686] Pid: 1059, comm: smssp.orig Not tainted (2.6.30-gentoo-r8 #24) AM5400B
[   43.785686] EIP: 0060:[<405829ba>] EFLAGS: 00010046 CPU: 1
[   43.785686] EIP is at _spin_lock_irqsave+0x8/0x1a
[   43.785686] EAX: 00000074 EBX: 00000074 ECX: 00000246 EDX: 00000100
[   43.785686] ESI: dade8400 EDI: 00000000 EBP: d903ba00 ESP: da43be28
[   43.785686]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
[   43.785686] Process smssp.orig (pid: 1059, ti=da43a000 task=dad6f710 task.ti=da43a000)
[   43.785686] Stack:
[   43.785686]  4047d5c8 da5f3000 4045bbb5 4073d460 d903ba00 d9001340 dade8400 404799fd
[   43.785686]  d88bfb40 d9001378 d903bad0 d903ba58 d903ba04 da652300 dade8400 d88bfb40
[   43.785686]  dade8400 4035d144 da8e48a8 00000000 00000902 00000100 0bc00000 00000000
[   43.785686] Call Trace:
[   43.785686]  [<4047d5c8>] ? ftdi_open+0x42/0x1a1
[   43.785686]  [<4045bbb5>] ? usb_autopm_do_interface+0x9a/0xa1
[   43.785686]  [<404799fd>] ? serial_open+0x112/0x189
[   43.785686]  [<4035d144>] ? tty_open+0x27b/0x3a9
[   43.785686]  [<40293524>] ? chrdev_open+0x128/0x152
[   43.785686]  [<402a198c>] ? mntput_no_expire+0x12/0xe0
[   43.785686]  [<402933fc>] ? chrdev_open+0x0/0x152
[   43.785686]  [<4028f5dd>] ? __dentry_open+0x113/0x1e9
[   43.785686]  [<40290413>] ? nameidata_to_filp+0x29/0x3c
[   43.785686]  [<40299ac4>] ? do_filp_open+0x3ab/0x689
[   43.785686]  [<4025d5bb>] ? __rcu_process_callbacks+0x57/0x159
[   43.785686]  [<40236d6a>] ? autoremove_wake_function+0x0/0x2d
[   43.785686]  [<402a05ff>] ? alloc_fd+0x5e/0xd0
[   43.785686]  [<4028f3ea>] ? do_sys_open+0x44/0xb4
[   43.785686]  [<4028f49e>] ? sys_open+0x1e/0x23
[   43.785686]  [<40202964>] ? sysenter_do_call+0x12/0x22
[   43.785686] Code: 74 05 e8 3e fe ff ff c3 fa f0 83 28 01 79 05 e8 4d fe ff ff c3 f0 81 00 00 00 00 01 fb c3 f0 ff 00 fb c3 9c 59 fa ba 00 01 00 00 <f0> 66 0f c1 10 38 f2 74 06 f3 90 8a 10 eb f6 89 c8 c3 9c 5a fa
[   43.785686] EIP: [<405829ba>] _spin_lock_irqsave+0x8/0x1a SS:ESP 0068:da43be28
[   43.785686] CR2: 0000000000000074
[   43.785686] ---[ end trace b68e6189f2a3d267 ]---
[   45.882827] hub 1-0:1.0: hub_suspend
[   45.886552] usb usb1: bus auto-suspend
[   45.890434] ehci_hcd 0000:00:1d.7: suspend root hub

here is my equivalent reproduce test program:

/*
 * =====================================================================================
 *   compile:
 *      gcc -g usb.c -o usb_sleep.exe -DSLEEP -D_GNU_SOURCE
 *      gcc -g usb.c -o usb.exe -D_GNU_SOURCE
 *
 * =====================================================================================
 */
#include <stdlib.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <unistd.h>
#include <errno.h>

int
main()
{
    char *dev = "/dev/ttyUSB0";

    //int fd = open(dev, O_RDONLY|O_LARGEFILE/* O_RDWR | O_NOCTTY | O_NONBLOCK */);
    //int fd = open(dev, O_RDWR | O_NOCTTY | O_NONBLOCK);
    int fd = open(dev, O_RDWR | O_NOCTTY | O_NDELAY);
    while(fd < 0)
    {
        //fd = open(dev, O_RDONLY|O_LARGEFILE/* O_RDWR | O_NOCTTY | O_NONBLOCK */);
        //fd = open(dev, O_RDWR | O_NOCTTY | O_NONBLOCK);
        fd = open(dev, O_RDWR | O_NOCTTY | O_NDELAY);
#ifdef SLEEP
        sleep(1);
#endif
    }
    printf("open tty ok!\n");
    char buf[1024];
    printf(buf, "at");
    int ret = write(fd, buf, strlen(buf));
    if(ret < 0){
        printf("write error:%s\n", strerror(errno));
    }
    ret = read(fd, buf, sizeof(buf) - 1);
    if(ret < 0){
        printf("read error:%s\n", strerror(errno));
    }
    close(fd);
}

reproduce procedure: 1.insmod usbserial.ko ftdi_sio.ko 2.#./usb.exe to run my test program 3.plug USB modem in and the dmesg about ftdi_sio stack info above shows up

what's weird is that if i use the other usb_sleep.exe to test, the stack info cannot occur, and opens ttyUSB0 fine

i've tested in another box with kernel 2.4.30, which has ftdi_sio version 1.3.5, and nothing strange happens.

i've googled and tried to figured it out for a few day, nothing valuable found. here is a link i found in google groups:http://groups.google.com/group/linux.kernel/browse_thread/thread/2c0c32a649006cf5/de263399cb0c38c9?show_docid=de263399cb0c38c9# ,with title "USB: ftdi_sio: fix regression in 2.6.31 and clean up", but i really don't know if it helps or not cause i'm definitely new to kernel or driver.

btw, i try to replace ftdi_sio driver with a newer version 1.5.0 from kernel 2.6.32.58, but failed to compilation, error message is listed as following:

drivers/usb/serial/ftdi_sio.o
drivers/usb/serial/ftdi_sio.c:931: warning: initialization from incompatible pointer type
drivers/usb/serial/ftdi_sio.c:932: warning: initialization from incompatible pointer type
drivers/usb/serial/ftdi_sio.c:933: error: unknown field ‘dtr_rts’ specified in initializer
drivers/usb/serial/ftdi_sio.c:933: warning: initialization from incompatible pointer type
drivers/usb/serial/ftdi_sio.c: In function ‘ftdi_process_packet’:
drivers/usb/serial/ftdi_sio.c:2219: error: implicit declaration of function ‘usb_serial_handle_break’
drivers/usb/serial/ftdi_sio.c:2235: error: ‘struct usb_serial_port’ has no member named ‘sysrq’
drivers/usb/serial/ftdi_sio.c:2239: error: implicit declaration of function ‘usb_serial_handle_sysrq_char’
make[3]: *** [drivers/usb/serial/ftdi_sio.o] Error 1
make[2]: *** [drivers/usb/serial] Error 2
make[1]: *** [drivers/usb] Error 2
make: *** [drivers] Error 2

i'm really frustrated, are there any others came across this problem? is something wrong with the driver?

any helpful reply will be appreciated.

P.S.i posted this thread in linux.kernel Google Groups, but i didn't find my post after posted, so i posted here again.:( sincerely ken

Answer 1

finally, i posted this bug to [email protected] mailing list, and Johan Hovold kindly
provided a patch to fixed it.

Here is the patch detail:

drivers/usb/serial/usb-serial.c |    7 +++++++
 1 files changed, 7 insertions(+), 0 deletions(-)

diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index cc274fd..cb08235 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -1059,6 +1059,12 @@ int usb_serial_probe(struct usb_interface *interface,
               serial->attached = 1;
       }

+       /* Avoid race with tty_open and serial_install by setting the
+        * disconnected flag and not clearing it until all ports are
+        * registered and the serial struct is fully initialised.
+        */
+       serial->disconnected = 1;
+
       if (get_free_serial(serial, num_ports, &minor) == NULL) {
               dev_err(&interface->dev, "No more free serial devices\n");
               goto probe_error;
@@ -1088,6 +1094,7 @@ int usb_serial_probe(struct usb_interface *interface,
 exit:
       /* success */
       usb_set_intfdata(interface, serial);
+       serial->disconnected = 0;
       module_put(type->driver.owner);
       return 0;