Bug 7617 - null pointer dereference when disabling bluetooth
Summary: null pointer dereference when disabling bluetooth
Status: RESOLVED OLD
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 2
Hardware: x86_64 Linux
Priority: Normal critical
Target Milestone: ---
Assignee: Thomas Backlund
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-09-28 16:52 CEST by Götz Waschk
Modified: 2013-11-23 16:16 CET (History)
0 users

See Also:
Source RPM: kernel-desktop-3.3.8-2.mga2-1-1.mga2
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Götz Waschk 2012-09-28 16:52:58 CEST 
I am using GNOME and I have coupled my bluetooth mouse. When I click the bluetooth disable button in the gnome bluetooth menu, I'll  get this:
Sep 28 16:36:56 localhost bluetoothd[638]: Endpoint unregistered: sender=:1.35 path=/MediaEndpoint/HFPAG
Sep 28 16:36:56 localhost bluetoothd[638]: Endpoint unregistered: sender=:1.35 path=/MediaEndpoint/HFPHS
Sep 28 16:36:56 localhost bluetoothd[638]: Endpoint unregistered: sender=:1.35 path=/MediaEndpoint/A2DPSource
Sep 28 16:37:05 localhost kernel: [   68.903145] generic-bluetooth 0005:046D:B009.0004: unknown main item tag 0x0
Sep 28 16:37:05 localhost kernel: [   68.903384] input: Logitech Bluetooth Mouse M555b as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:12/input16
Sep 28 16:37:05 localhost kernel: [   68.905137] generic-bluetooth 0005:046D:B009.0004: input,hidraw1: BLUETOOTH HID v4.19 Mouse [Logitech Bluetooth Mouse M555b] on 00:23:4E:D1:40:D2
Sep 28 16:37:29 localhost kernel: [   93.225361] generic-bluetooth 0005:046D:B009.0005: unknown main item tag 0x0
Sep 28 16:37:29 localhost kernel: [   93.225601] input: Logitech Bluetooth Mouse M555b as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:11/input17
Sep 28 16:37:29 localhost kernel: [   93.226995] generic-bluetooth 0005:046D:B009.0005: input,hidraw1: BLUETOOTH HID v4.19 Mouse [Logitech Bluetooth Mouse M555b
] on 00:23:4E:D1:40:D2
Sep 28 16:37:47 localhost kernel: [  111.146205] generic-bluetooth 0005:046D:B009.0006: unknown main item tag 0x0
Sep 28 16:37:47 localhost kernel: [  111.146443] input: Logitech Bluetooth Mouse M555b as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:12/input18
Sep 28 16:37:47 localhost kernel: [  111.147366] generic-bluetooth 0005:046D:B009.0006: input,hidraw1: BLUETOOTH HID v4.19 Mouse [Logitech Bluetooth Mouse M555b] on 00:23:4E:D1:40:D2
Sep 28 16:37:51 localhost kernel: [  114.512608] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
Sep 28 16:37:51 localhost kernel: [  114.513214] IP: [<ffffffffa0632015>] hci_chan_del+0x15/0x80 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.514199] PGD a0ff4067 PUD a0ff3067 PMD 0 
Sep 28 16:37:51 localhost kernel: [  114.514199] Oops: 0000 [#1] SMP 
Sep 28 16:37:51 localhost kernel: [  114.514199] CPU 0 
Sep 28 16:37:51 localhost kernel: [  114.514199] Modules linked in: parport_pc ppdev parport hidp cls_flow cls_fw cls_u32 sch_tbf sch_prio sch_htb sch_hfsc sch_ingress sch_sfq bridge stp xt_time xt_connlimit xt_realm xt_addrtype ip_set_hash_ip iptable_raw xt_comment xt_recent xt_policy ipt_ULOG ipt_REJECT ipt_REDIRECT ipt_NETMAP ipt_MASQUERADE ipt_ECN ipt_CLUSTERIP ipt_ah xt_set ip_set nf_nat_tftp nf_nat_snmp_basic nf_conntrack_snmp nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda ts_kmp nf_conntrack_amanda nf_conntrack_sane nf_conntrack_tftp nf_conntrack_sip nf_conntrack_proto_sctp nf_conntrack_pptp nf_conntrack_proto_gre nf_conntrack_netlink nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_irc nf_conntrack_h323 nf_conntrack_ftp xt_TPROXY nf_defrag_ipv6 nf_tproxy_core ip6_tables xt_tcpmss xt_pkttype xt_physdev xt_owner xt_NFQUEUE xt_NFLOG nfnetlink_log xt_multiport xt_mark xt_mac xt_limit xt_length xt_iprange xt_helper xt_hashlimit xt_DSCP xt_dscp xt_dccp xt_conntr
Sep 28 16:37:51 localhost kernel: ack xt_connmark xt_CLASSIFY xt_AUDIT ipt_LOG xt_tcpudp xt_state iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_conntrack iptable_mangle nfnetlink iptable_filter ip_tables x_tables aes_x86_64 cryptd aes_generic af_packet rfcomm bnep binfmt_misc btusb bluetooth dm_mod snd_hda_codec_hdmi snd_hda_codec_idt usbhid hid snd_hda_intel arc4 snd_hda_codec iwlwifi dell_wmi sparse_keymap fuse snd_hwdep mac80211 snd_pcm dell_laptop dcdbas cfg80211 snd_page_alloc snd_timer joydev snd i2c_i801 e1000e iTCO_wdt iTCO_vendor_support rfkill soundcore wmi thermal battery cpufreq_ondemand cpufreq_conservative cpufreq_powersave acpi_cpufreq mperf freq_table nvram i8k evdev ac processor ipv6 autofs4 ext4 crc16 jbd2 mmc_block sdhci_pci sdhci sd_mod firewire_ohci mmc_core crc_t10dif ehci_hcd firewire_core crc_itu_t uhci_hcd usbcore usb_common i915 video button i2c_algo_bit drm_kms_helper drm i2c_core ata_piix ahci libahci libata mpt2sas raid_class scsi_transport_sas scsi_mod [last unloaded: microcode]
Sep 28 16:37:51 localhost kernel: [  114.514199] 
Sep 28 16:37:51 localhost kernel: [  114.514199] Pid: 3538, comm: gnome-shell Not tainted 3.3.8-desktop-2.mga2 #1 Dell Inc. Latitude E4200                  /      
Sep 28 16:37:51 localhost kernel: [  114.514199] RIP: 0010:[<ffffffffa0632015>]  [<ffffffffa0632015>] hci_chan_del+0x15/0x80 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.514199] RSP: 0018:ffff8800a0f8ddb8  EFLAGS: 00010246
Sep 28 16:37:51 localhost kernel: [  114.514199] RAX: 0000000000000000 RBX: ffff880098533070 RCX: 0000000000000002
Sep 28 16:37:51 localhost kernel: [  114.514199] RDX: 0000000000000037 RSI: 0000000000000040 RDI: 0000000000000000
Sep 28 16:37:51 localhost kernel: [  114.514199] RBP: ffff8800a0f8ddc8 R08: ffffffff81a9b340 R09: 0000000000000040
Sep 28 16:37:51 localhost kernel: [  114.514199] R10: ffffffff812370c5 R11: 0000000000000000 R12: 0000000000000000
Sep 28 16:37:51 localhost kernel: [  114.514199] R13: 0000000000000000 R14: ffff88009c73ec00 R15: 0000000000000001
Sep 28 16:37:51 localhost kernel: [  114.514199] FS:  00007f48058308e0(0000) GS:ffff8800bce00000(0000) knlGS:0000000000000000
Sep 28 16:37:51 localhost kernel: [  114.514199] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Sep 28 16:37:51 localhost kernel: [  114.514199] CR2: 0000000000000010 CR3: 00000000a0ff1000 CR4: 00000000000006f0
Sep 28 16:37:51 localhost kernel: [  114.514199] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
Sep 28 16:37:51 localhost kernel: [  114.514199] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Sep 28 16:37:51 localhost kernel: [  114.580199] Process gnome-shell (pid: 3538, threadinfo ffff8800a0f8c000, task ffff8800a0f0ad20)
Sep 28 16:37:51 localhost kernel: [  114.580199] Stack:
Sep 28 16:37:51 localhost kernel: [  114.580199]  ffff8800a0f8dde8 ffff880098533070 ffff8800a0f8ddf8 ffffffffa06320c0
Sep 28 16:37:51 localhost kernel: [  114.580199]  ffff8800a26c0000 0000000000000000 ffff880098533000 ffff8800a26c0000
Sep 28 16:37:51 localhost kernel: [  114.580199]  ffff8800a0f8de28 ffffffffa06321f2 ffff880098533000 ffff8800adb99638
Sep 28 16:37:51 localhost kernel: [  114.580199] Call Trace:
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffffa06320c0>] hci_chan_list_flush+0x40/0x80 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffffa06321f2>] hci_conn_del+0xf2/0x270 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffffa06323f0>] hci_conn_hash_flush+0x80/0xf0 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffffa062cc2b>] hci_dev_do_close+0xbb/0x310 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffffa062ceaf>] hci_rfkill_set_block+0x2f/0x60 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffffa03bae27>] rfkill_set_block+0x87/0x120 [rfkill]
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffffa03bb1bb>] rfkill_fop_write+0xeb/0x170 [rfkill]
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffff8115d753>] vfs_write+0xb3/0x180
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffff8115da7a>] sys_write+0x4a/0x90
Sep 28 16:37:51 localhost kernel: [  114.580199]  [<ffffffff81458e79>] system_call_fastpath+0x16/0x1b
Sep 28 16:37:51 localhost kernel: [  114.580199] Code: 65 a0 31 c0 e8 fd f6 c1 e0 e9 79 ff ff ff 0f 1f 84 00 00 00 00 00 55 48 89 e5 53 48 83 ec 08 66 66 66 66 90 80 3d 3f 8a 02 00 00 <48> 8b 4f 10 48 89 fb 48 8b 91 20 04 00 00 75 3b 48 8b 13 48 8b 
Sep 28 16:37:51 localhost kernel: [  114.580199] RIP  [<ffffffffa0632015>] hci_chan_del+0x15/0x80 [bluetooth]
Sep 28 16:37:51 localhost kernel: [  114.580199]  RSP <ffff8800a0f8ddb8>
Sep 28 16:37:51 localhost kernel: [  114.580199] CR2: 0000000000000010
Sep 28 16:37:51 localhost kernel: [  115.337493] usb 1-1: USB disconnect, device number 2
Sep 28 16:37:51 localhost kernel: [  115.357941] usb 1-1.1: USB disconnect, device number 3
Sep 28 16:37:51 localhost kernel: [  115.397302] usb 1-1.2: USB disconnect, device number 4
Sep 28 16:37:51 localhost kernel: [  115.435767] usb 1-1.3: USB disconnect, device number 5
Sep 28 16:37:51 localhost kernel: [  115.605260] ---[ end trace ab83c479d92c08b7 ]---


After that, bluetooth is off and the screen of the gnome shell is frozen. This is with kernel 3.3.8-desktop-2.mga2
Götz Waschk 2012-09-28 16:53:46 CEST

Source RPM: (none) => kernel-desktop-3.3.8-2.mga2-1-1.mga2

Manuel Hiebel 2012-09-28 22:33:36 CEST

Assignee: bugsquad => tmb

Comment 1 Manuel Hiebel 2013-10-22 12:20:39 CEST 
This message is a reminder that Mageia 2 is nearing its end of life.
Approximately one month from now Mageia will stop maintaining and issuing updates for Mageia 2. At that time this bug will be closed as WONTFIX (EOL) if it remains open with a Mageia 'version' of '2'.

Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Mageia version prior to Mageia 2's end of life.

Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Mageia 2 is end of life.  If you would still like to see this bug fixed and are able to reproduce it against a later version of Mageia, you are encouraged to click on "Version" and change it against that version of Mageia.

Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Mageia release includes newer upstream software that fixes bugs or makes them obsolete.

-- 
The Mageia Bugsquad
Comment 2 Manuel Hiebel 2013-11-23 16:16:15 CET 
Mageia 2 changed to end-of-life (EOL) status on ''22 November''. Mageia 2 is no
longer maintained, which means that it will not receive any further security or
bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of Mageia
please feel free to click on "Version" change it against that version of Mageia
and reopen this bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

--
The Mageia Bugsquad

Status: NEW => RESOLVED
Resolution: (none) => OLD
Note You need to log in before you can comment on or make changes to this bug.