Bug 959016

Summary: USB system dies when USB device appears/disappears
Product: [Fedora] Fedora Reporter: Ben Boeckel <fedora>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: fhrbata, gansalmon, itamar, jonathan, kernel-maint, madhu.chinakonda
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-05-07 08:56:04 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Ben Boeckel 2013-05-03 02:09:52 UTC 
Description of problem:
Recently, when plugging my phone into the hub built into my keyboard (plugged directly into a motherboard port), all USB devices would stop working. The occurred today when I was received a call while the phone was plugged in. It has also happened when first plugging in the phone and with a USB flash drive.

dmesg log after pluging in the device:

[89644.719086] usb 3-1.2: USB disconnect, device number 6
[89644.897233] usb 3-1.2: new high-speed USB device number 7 using xhci_hcd
[89649.893285] xhci_hcd 0000:07:00.0: Timeout while waiting for address device command
[89660.895171] usb 3-1.2: Device not responding to set address.
[89661.096023] usb 3-1.2: device not accepting address 7, error -71
[89666.092323] xhci_hcd 0000:07:00.0: Timeout while waiting for a slot
[89679.687307] xhci_hcd 0000:07:00.0: Stopped the command ring failed, maybe the host is dead
[89679.687325] xhci_hcd 0000:07:00.0: Abort command ring failed
[89679.687876] xhci_hcd 0000:07:00.0: HC died; cleaning up
[89679.687975] hub 3-1:1.0: cannot reset port 2 (err = -19)
[89679.687978] hub 3-1:1.0: cannot disable port 2 (err = -19)
[89679.687988] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
[89679.689256] IP: [<ffffffff8148b500>] xhci_free_dev+0x60/0x140
[89679.690524] PGD 0
[89679.691683] Oops: 0002 [#1] SMP
[89679.692622] Modules linked in: eeepc_wmi asus_wmi sparse_keymap rfkill acpi_cpufreq mperf coretemp iTCO_wdt iTCO_vendor_support kvm_intel ppdev snd_hda_codec_hdmi kvm crc32_pclmul snd_hda_codec_realtek crc32c_intel ghash_clmulni_intel usb_storage snd_hda_intel microcode snd_hda_codec i2c_i801 snd_hwdep snd_seq snd_
seq_device snd_pcm lpc_ich r8169 mfd_core mii snd_page_alloc parport_pc snd_timer parport snd mei soundcore wmi binfmt_misc i915 i2c_algo_bit drm_kms_helper drm i2c_core video
[89679.695700] CPU 1
[89679.695705] Pid: 54, comm: khubd Not tainted 3.9.0-0.rc8.git0.2.fc20.x86_64 #1 System manufacturer System Product Name/P8Z68-M PRO
[89679.697743] RIP: 0010:[<ffffffff8148b500>]  [<ffffffff8148b500>] xhci_free_dev+0x60/0x140
[89679.698776] RSP: 0018:ffff88040842fd88  EFLAGS: 00010202
[89679.699777] RAX: 0000000000000000 RBX: 0000000000000070 RCX: 0000000000000000
[89679.700748] RDX: ffff880408911000 RSI: ffff8803e6bf4000 RDI: ffff8804068a5c00
[89679.701733] RBP: ffff88040842fdb0 R08: 0000000000000001 R09: ffffffff818774bb
[89679.702725] R10: 0000000000000000 R11: ffff88040842f916 R12: 000000000000001f
[89679.703728] R13: ffff8803e6bf4000 R14: ffff880408911000 R15: ffff8804068a5c00
[89679.704735] FS:  0000000000000000(0000) GS:ffff88041f240000(0000) knlGS:0000000000000000
[89679.705748] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[89679.706752] CR2: 0000000000000040 CR3: 0000000001c0c000 CR4: 00000000001407e0
[89679.707748] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[89679.708726] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[89679.709715] Process khubd (pid: 54, threadinfo ffff88040842e000, task ffff880408b3aee0)
[89679.710687] Stack:
[89679.711663]  ffff88040852d800 ffff8803e6bf4000 ffff880406b77c58 0000000000000001
[89679.712642]  00000000ffffff00 ffff88040842fec8 ffffffff81459ede 0000000200000000
[89679.713607]  0000000000000000 ffff880408b3aee0 0000000000000010 ffff880406b77d08
[89679.714565] Call Trace:
[89679.715523]  [<ffffffff81459ede>] hub_thread+0x7ce/0x1710
[89679.716470]  [<ffffffff81081130>] ? wake_up_bit+0x30/0x30
[89679.717409]  [<ffffffff81459710>] ? hub_port_debounce+0x130/0x130
[89679.718350]  [<ffffffff81080380>] kthread+0xc0/0xd0
[89679.719286]  [<ffffffff810802c0>] ? insert_kthread_work+0x40/0x40
[89679.720223]  [<ffffffff8164d66c>] ret_from_fork+0x7c/0xb0
[89679.721131]  [<ffffffff810802c0>] ? insert_kthread_work+0x40/0x40
[89679.722109] Code: 83 f8 ed 0f 85 d2 00 00 00 49 63 85 a8 04 00 00 41 bc 1f 00 00 00 49 8b 9c c6 10 01 00 00 48 83 c3 70 66 0f 1f 84 00 00 00 00 00 <83> 63 d0 fb 48 89 df 48 81 c3 e8 00 00 00 e8 bd 1b be ff 41 83
[89679.723253] RIP  [<ffffffff8148b500>] xhci_free_dev+0x60/0x140
[89679.724325]  RSP <ffff88040842fd88>
[89679.725414] CR2: 0000000000000040
[89679.731054] ---[ end trace 76fbbb760331844d ]---

Version-Release number of selected component (if applicable):
kernel-3.9.0-0.rc8.git0.2.fc20.x86_64 (nodebug repo)

How reproducible:
Occasionally.

Actual results:
USB systems stop working.

Expected results:
USB systems keep working.
Comment 1 Ben Boeckel 2013-05-03 02:11:11 UTC 
Oh, and only a reboot has been able to get it back. I guess modprobe'ing some module might be able to do fix it, but I haven't tried that.
Comment 2 Frantisek Hrbata 2013-05-07 08:49:40 UTC 
Code: 83 f8 ed 0f 85 d2 00 00 00 49 63 85 a8 04 00 00 41 bc 1f 00 00 00 49 8b 9c c6 10 01 00 00 48 83 c3 70 66 0f 1f 84 00 00 00 00 00 <83> 63 d0 fb 48 89 df 48 81 c3 e8 00 00 00 e8 bd 1b be
All code
========
   0:   83 f8 ed                cmp    $0xffffffed,%eax
   3:   0f 85 d2 00 00 00       jne    0xdb
   9:   49 63 85 a8 04 00 00    movslq 0x4a8(%r13),%rax
  10:   41 bc 1f 00 00 00       mov    $0x1f,%r12d
  16:   49 8b 9c c6 10 01 00    mov    0x110(%r14,%rax,8),%rbx
  1d:   00
  1e:   48 83 c3 70             add    $0x70,%rbx
  22:   66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)
  29:   00 00
  2b:*  83 63 d0 fb             andl   $0xfffffffb,-0x30(%rbx)          <-- trapping instruction
  2f:   48 89 df                mov    %rbx,%rdi
  32:   48 81 c3 e8 00 00 00    add    $0xe8,%rbx
  39:   e8                      .byte 0xe8
  3a:   bd                      .byte 0xbd
  3b:   1b                      .byte 0x1b
  3c:   be                      .byte 0xbe

Code starting with the faulting instruction
===========================================
   0:   83 63 d0 fb             andl   $0xfffffffb,-0x30(%rbx)
   4:   48 89 df                mov    %rbx,%rdi
   7:   48 81 c3 e8 00 00 00    add    $0xe8,%rbx
   e:   e8                      .byte 0xe8
   f:   bd                      .byte 0xbd
  10:   1b                      .byte 0x1b
  11:   be                      .byte 0xbe

virt_dev is NULL

More detailed info is here, but the problem is the same

https://bugzilla.redhat.com/show_bug.cgi?id=957500#c2
Comment 3 Frantisek Hrbata 2013-05-07 08:56:04 UTC 

*** This bug has been marked as a duplicate of bug 957500 ***