panic unloading bluetooth module

Peter Jeremy
Sat, 23 Sep 2006 14:12:41 -0000

On Sat, 2006-Sep-23 21:56:45 +1000, Callum Gibson wrote:
>I just experienced a panic after playing around with bluetooth. After a
>fresh boot I decided to try and unload the ng_ubt module and noted all
>the dependencies. So I tried to unload all of them in turn a few times.
>Some seemed to unload but kldstat showed many of them still and it seemed
>like I wasn't going to be able to unload them all. Then I pressed
>the wlan/bluetooth toggle button and had the panic.

I'm running the same laptop (HP nx6125) with RELENG_6/amd64 from 21st
September and can mostly reproduce the problem - my laptop hasn't
panic'd yet but I suspect that's only because I haven't generated an
irq19.

When I kldload ng_ubt, it pulls in
 7    1 0xffffffffa3f63000 5025     ng_ubt.ko
 8    5 0xffffffffa3f69000 89b2     netgraph.ko
 9    4 0xffffffffa3f72000 86d      ng_bluetooth.ko
10    1 0xffffffffa3f73000 9535     ng_hci.ko
11    1 0xffffffffa3f7d000 bee6     ng_l2cap.ko
12    1 0xffffffffa3f89000 13461    ng_btsocket.ko
13    1 0xffffffffa3f9d000 1d0d     ng_socket.ko
Bluetooth (ubt0) then attaches/detaches as expected.

With bluetooth off, I can only unload ng_ubt.ko, ng_hci.ko and ng_l2cap.ko.
The remaining modules report:
  kldunload: can't unload file: Device busy
and I also get two "attempt to unload file that was loaded by the
kernel"
but I'm not sure which modules they are associated with.

Toggling bluetooth then attaches/detaches ugen1 - as expected.

I then tried:
a) Turn off bluetooth
b) kldload ng_ubt
   ng_ubt.ko, ng_hci.ko and ng_l2cap.ko are laoded.
c) Turn bluetooth on
   ubt0 attachs
d) kldunload all the netgraph modules
   ng_hci.ko and ng_l2cap.ko unload
   ng_ubt.ko reports:
     kldunload: can't unload file: No such file or directory
   The remaining modules report "device busy"
e) Turn off bluetooth
   I get the same disconnect message as Callum:
     (null): at uhub0 port 2 (addr 2) disconnected

At this point "kldload ng_ubt.ko" consistently reports "File
exists" whilst
"kldunload ng_ubt.ko" consistently reports "No such file or
directory".

Callum's panic is a dereference to a null structure pointer in the
irq19 handler.  It looks to me like attempting to kldunload ng_ubt.ko
has freed the ubt0 structures and the next irq 19 (USB) causes things
to go pear-shaped.

Can anyone suggest how/why ng_ubt.ko would get into a "you can see me
but I'm not here" state?

The other anomoly I see (which is possibly related) is that if ng_ubt
is not loaded, I get a single "ugen1 attached" message.  If ng_ubt is
loaded, I get two identical messages:
 ubt0: Broadcom HP integrated Bluetooth module, rev 1.10/0.17, addr 2
though the rest of the probe/attach looks sane.

--
Peter Jeremy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available