On Sat, 14 Oct 2017, Hendrik Langer wrote: > Dear developer/maintainers, > > there seems to be a problem with the Lenovo X1 Tablet (Skylake) keyboard > cover and the hid-rmi kernel module causing random crashes. [ ... snip ... ] > [ 117.501718] BUG: unable to handle kernel NULL pointer dereference at > (null) > [ 117.501730] IP: device_del+0x17/0x320 > [ 117.501732] PGD 0 P4D 0 > [ 117.501736] Oops: 0000 [#1] SMP > [ 117.501739] Modules linked in: psmouse hid_rmi rmi_core fuse rfcomm > acpi_call(O) ctr ccm cmac bnep nls_ascii nls_cp437 vfat fat qcserial > usb_wwan btusb btrtl btbcm btintel bluetooth drbg ansi_cprng > ecdh_generic cdc_mbim cdc_wdm cdc_ncm usbnet mii usbserial joydev wacom > usbhid snd_hda_codec_hdmi snd_hda_codec_realtek snd_hda_codec_generic > msr spi_pxa2xx_platform arc4 i2c_designware_platform i2c_designware_core > wmi_bmof intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp > kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul > ghash_clmulni_intel snd_soc_skl intel_cstate intel_uncore > intel_rapl_perf snd_soc_skl_ipc snd_soc_sst_ipc efi_pstore > snd_soc_sst_dsp iwlmvm snd_hda_ext_core snd_soc_sst_match snd_soc_core > snd_compress mac80211 pcspkr evdev serio_raw efivars snd_hda_intel > snd_hda_codec iTCO_wdt > [ 117.501823] iTCO_vendor_support snd_hda_core iwlwifi snd_hwdep > snd_pcm snd_timer cfg80211 rtsx_pci_ms memstick shpchp sg mei_me mei > hid_sensor_magn_3d hid_sensor_accel_3d hid_sensor_als hid_sensor_gyro_3d > hid_sensor_trigger hid_sensor_iio_common industrialio_triggered_buffer > i915 kfifo_buf industrialio drm_kms_helper idma64 drm thinkpad_acpi > processor_thermal_device intel_lpss_pci nvram snd soundcore i2c_algo_bit > intel_soc_dts_iosf wmi tpm_crb battery ac rfkill soc_button_array > intel_vbtn int3403_thermal intel_hid video sparse_keymap intel_lpss_acpi > intel_lpss int3400_thermal int3402_thermal int340x_thermal_zone button > acpi_thermal_rel parport_pc ppdev lp parport efivarfs ip_tables x_tables > autofs4 ext4 crc16 mbcache jbd2 crc32c_generic fscrypto ecb sd_mod > hid_sensor_custom hid_sensor_hub intel_ishtp_hid > [ 117.501875] rtsx_pci_sdmmc mmc_core crc32c_intel aesni_intel > aes_x86_64 crypto_simd cryptd glue_helper i2c_i801 ahci libahci libata > xhci_pci rtsx_pci mfd_core xhci_hcd scsi_mod usbcore intel_ish_ipc > usb_common intel_ishtp thermal i2c_hid hid > [ 117.501897] CPU: 3 PID: 302 Comm: kworker/3:3 Tainted: G O > 4.14.0-rc3-amd64 #1 Debian 4.14~rc3-1~exp1 > [ 117.501899] Hardware name: LENOVO 20GG002CGE/20GG002CGE, BIOS > N1LET63W (1.63 ) 02/17/2017 > [ 117.501915] Workqueue: usb_hub_wq hub_event [usbcore] > [ 117.501918] task: ffff92b50983c000 task.stack: ffffa27381da8000 > [ 117.501923] RIP: 0010:device_del+0x17/0x320 > [ 117.501925] RSP: 0018:ffffa27381daba38 EFLAGS: 00010292 > [ 117.501928] RAX: ffffffffaf042400 RBX: 0000000000000000 RCX: > 0000000000000000 > [ 117.501930] RDX: 0000000080000000 RSI: 000000007fffffff RDI: > 0000000000000000 > [ 117.501931] RBP: ffffa27381daba70 R08: 0000000000000000 R09: > ffff92b4b7a45538 > [ 117.501933] R10: 0000000000000032 R11: ffff92b4b7a45559 R12: > 0000000000000000 > [ 117.501935] R13: 0000000000000000 R14: ffff92b4d17a78b8 R15: > 0000000000000060 > [ 117.501937] FS: 0000000000000000(0000) GS:ffff92b521580000(0000) > knlGS:0000000000000000 > [ 117.501939] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > [ 117.501941] CR2: 0000000000000000 CR3: 000000040d58d001 CR4: > 00000000003606e0 > [ 117.501943] DR0: 0000000000000000 DR1: 0000000000000000 DR2: > 0000000000000000 > [ 117.501945] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: > 0000000000000400 > [ 117.501946] Call Trace: > [ 117.501953] ? kernfs_name_hash+0x17/0x80 > [ 117.501960] rmi_unregister_transport_device+0x16/0x30 [rmi_core] > [ 117.501964] rmi_remove+0x33/0x40 [hid_rmi] > [ 117.501969] hid_device_remove+0x52/0xb0 [hid] > [ 117.501974] device_release_driver_internal+0x155/0x220 > [ 117.501977] device_release_driver+0x12/0x20 > [ 117.501979] bus_remove_device+0xe9/0x160 > [ 117.501983] device_del+0x1e2/0x320 > [ 117.501988] hid_destroy_device+0x27/0x60 [hid] > [ 117.501993] usbhid_disconnect+0x51/0x70 [usbhid] > [ 117.502006] usb_unbind_interface+0x72/0x260 [usbcore] > [ 117.502010] device_release_driver_internal+0x155/0x220 > [ 117.502012] device_release_driver+0x12/0x20 > [ 117.502015] bus_remove_device+0xe9/0x160 > [ 117.502018] device_del+0x1e2/0x320 > [ 117.502029] ? usb_remove_ep_devs+0x1f/0x30 [usbcore] > [ 117.502040] usb_disable_device+0x9e/0x270 [usbcore] > [ 117.502052] usb_disconnect+0x92/0x270 [usbcore] > [ 117.502066] hub_event+0x968/0x1580 [usbcore] > [ 117.502072] ? dequeue_task_fair+0x51b/0x680 > [ 117.502077] process_one_work+0x191/0x380 > [ 117.502081] worker_thread+0x4e/0x3c0 > [ 117.502086] kthread+0x109/0x140 > [ 117.502089] ? process_one_work+0x380/0x380 > [ 117.502094] ? kthread_create_on_node+0x70/0x70 > [ 117.502099] ret_from_fork+0x25/0x30 Andrew, this looks like rmi_unregister_transport_device() is being called for device for which rmi_register_transport_device() never happened. Could this be because ->input_configured() callback has been skipped for this particular device for some reason in hidinput_connect()? -- Jiri Kosina SUSE Labs -- To unsubscribe from this list: send the line "unsubscribe linux-input" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
