> > If that is occuring then the bug is elsewhere. The hang up sequence > > reconnects the user space to the hung up tty ops and no longer references > > the hardware. > > I got something similar with a pl2303 device, though not a crash. I > plugged in the device, opened /dev/ttyUSB0, unplugged the device, then > tried to read from the open file descriptor. The read provoked this: That looks like it occurs after the read, however that trace shows the close() method being called off sys_close() which in turn means a hang up didn't occur when it was unplugged. > This is only a lockdep warning, and I don't understand its > significance. Even worse, when I plugged in a USB flash drive > afterward this appeared: Looks like something freed the resources but didn't hang up when the disconnect occurred > So it looks like something really is wrong, some sort of > use-after-free. Maybe a refcounting imbalance. A tty getting destructed before it should have been would perhaps do some of it but it doesn't explain how the close path got where it did. What should be occurring is USB disconnect usb_serial_disconnect(interface) tty_hangup(tty) [this is buggy and commented as such in the USB code as it should do it synchronously] tty_hangup() do_tty_hangup() file->f_ops = &hung_up_tty_ops; (so the USB close will never be called) ldisc hangup tty->ops->hangup (no-op on USB serial) so the trace to me implies that the usb_serial_disconnect is not happening. That in turn leads the close method to be called on a disconnected port which in turn crashes stuff. (and it also explains why Daniel's change although bogus stops the crash) -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
