Hi, On Tue, Apr 09, 2013 at 02:36:51AM +0000, Paul Zimmerman wrote: > I'm getting a crash when I rmmod the dwc3-pci driver in latest Linus, and > also in 3.8.6 and 3.8.0. > > Screenshot (two parts) are here: > http://ompldr.org/vaTFibQ/IMG1.jpg > http://ompldr.org/vaTFicA/IMG2.jpg > > Unfortunately the very first part of the crash has scrolled off the > screen. > > I've decoded the crash a bit. The call chain descends through > platform_device_unregister(glue->dwc3) in dwc3_pci_remove(). It hits the > warning in kobject_put(): > > void kobject_put(struct kobject *kobj) > { > if (kobj) { > if (!kobj->state_initialized) > WARN(1, KERN_WARNING "kobject: '%s' (%p): is not " > "initialized, yet kobject_put() is being " > "called.\n", kobject_name(kobj), kobj); > kref_put(&kobj->kref, kobject_release); > } > } > > and crashes when it tries to print the string, presumably because the > kobj->name field is either NULL or poisoned. So probably the kobject has > already been freed, or is in the process of being freed? > > Any ideas? Any debugging hints? looks like the PHY is being unregistered too early. I believe that's because PHY's dev is just a pointer to the real dev and maybe that's what's wrong. Here's what happens: devm_usb_get_phy() will find the PHY and issue a get_device(phy->dev). phy->dev is initialized to (in your case) nop_xceiv's &pdev->dev. When you remove dwc3.ko, due to devm_usb_phy_get(), devm_usb_phy_release() will get called which will issue a put_device(phy->dev), and that will trigger nop_xceiv's platform_device release, once you remove dwc3-pci.ko, you see the trigger. I'm adding Kishon to the loop to help out figuring out what the best fix would be. -- balbi
Attachment:
signature.asc
Description: Digital signature
