[hsflinux] BUG under kernel 2.6.23

[Rob Carruthers]

Hello,

Firstly let me wish you a happy and successful 2008!

I have a problem with the current driver and 2.6.23 kernels. I run
Gentoo and have tried both the Gentoo-patched kernel sources and the
"vanilla" sources. Both give me the same problem: when the connection is
terminated by the other end of the line (for example, when the time
limit of 2 hours on my connection has passed) or when the line is
physically disconnected from the modem during a connection (which is how
I reproduced this bug), I encounter a crash that I cannot recover from,
which yields this message in dmesg:

--

BUG: unable to handle kernel NULL pointer dereference at virtual address
0000003c
printing eip:
b0425521
*pde = 00000000
Oops: 0002 [#1]
PREEMPT SMP
Modules linked in: ppp_deflate ppp_async ppp_generic slhc snd_hda_codec
hsfusbcd2 hsfmc97sis hsfmc97ati hsfmc97ali hsfmc97via hsfmc97ich
hsfpcibasic3                    hsfpcibasic2 hsfserial hsfengine(P)
hsfosspec hsfsoar snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss
wm8775 cx25840 tuner ivtv snd_hda_intel i2c_alg                   o_bit
cx2341x snd_pcm tveeprom snd_timer videodev intel_agp v4l2_common snd
i2c_i801 agpgart v4l1_compat i2c_core snd_page_alloc
CPU:    1
EIP:    0060:[<b0425521>]    Tainted: P        VLI
EFLAGS: 00010046   (2.6.23-gentoo-r5 #1)
EIP is at _spin_lock_irqsave+0x15/0x5d
eax: 00000000   ebx: 0000003c   ecx: 00000001   edx: 00000202
esi: e2152000   edi: 00000001   ebp: e2153eb4   esp: e2153e8c
ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
Process khsfd/modem (pid: 4933, ti=e2152000 task=e39c7540 task.ti=e2152000)
Stack: 0000003c 00000000 b0119dfb e2153eac b0423f5d 00000001 00000126
00000000
       00000126 00000000 00000020 f1347af0 00000000 000b0001 e647980c
f134bc00
       00000000 e647980c e2153f04 e4cd7708 ee1f4d84 e647981c e2153f04
f1e11e07
Call Trace:
[<b0119dfb>] __wake_up+0x18/0x43
[<b0423f5d>] preempt_schedule+0x40/0x56
[<f1347af0>] cnxt_event_handler+0x1bb/0x2db [hsfserial]
[<f1e11e07>] cnxthsf_ComCtrl_Write+0x367/0x620 [hsfengine]
[<f1e3b283>] hsfengine1972_+0x7b3/0x800 [hsfengine]
[<f1e39630>] hsfengine1787_+0x470/0xdc0 [hsfengine]
[<f13e1150>] cnxthsf_OsLockUnlock+0x31/0x41 [hsfosspec]
[<f1e39414>] hsfengine1787_+0x254/0xdc0 [hsfengine]
[<f13e1edf>] TimerThreadFunction+0x27/0x5b [hsfosspec]
[<f13e1be4>] cnxt_thread+0x16c/0x1c3 [hsfosspec]
[<b011b388>] default_wake_function+0x0/0xc
[<f13e1a78>] cnxt_thread+0x0/0x1c3 [hsfosspec]
[<b01034fb>] kernel_thread_helper+0x7/0x1c
=======================
Code: 8b 0b 85 c9 7e f1 eb b5 66 90 e8 18 ea ff ff eb d6 e9 9b ff ff ff
56 53 89 c3 89 e6 81 e6 00 e0 ff ff 83 46 14 01 9c 5a fa 31 c0 <86> 03
84 c0 7                   e 0c c7 43 04 00 00 00 00 89 d0 5b 5e c3 52 9d 83
EIP: [<b0425521>] _spin_lock_irqsave+0x15/0x5d SS:ESP 0068:e2153e8c
note: khsfd/modem[4933] exited with preempt_count 1

--

I am not a kernel hacker so I can't make much sense of this trace, and
several searches later I still can't see what the problem is. Do you
have any ideas?

Hope this helps, thanks in advance.

Rob