Ubuntu
linux package

Pairing wiimote leads to kernel null pointer derefence in hid_wiimote

Bug #1048605 reported by Maurus Cuelenaere on 2012-09-10

This bug affects 1 person

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Medium	Luis Henriques
Precise	Fix Released	Undecided	Luis Henriques
Quantal	Fix Released	Medium	Luis Henriques

Bug Description

Relevant dmesg lines:

[ 55.782981] wiimote 0005:057E:0306.0006: hidraw3: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
[ 55.783047] input: Nintendo Wii Remote Accelerometer as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0006/input/input15
[ 55.783187] input: Nintendo Wii Remote IR as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0006/input/input16
[ 55.783276] input: Nintendo Wii Remote as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0006/input/input17
[ 55.783390] BUG: unable to handle kernel NULL pointer dereference at 0000000000000040
[ 55.783431] IP: [<ffffffff811ee58c>] sysfs_do_create_link+0x3c/0x210
[ 55.783463] PGD 3a5106067 PUD 3a5108067 PMD 0
[ 55.783485] Oops: 0000 [#1] SMP
[ 55.783502] CPU 0
[ 55.783510] Modules linked in: hid_wiimote(+) ff_memless hidp pci_stub vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) kvm_intel kvm dm_crypt snd_hda_codec_hdmi snd_hda_codec_idt deflate zlib_deflate ctr twofish_generic twofish_x86_64_3way twofish_x86_64 twofish_common camellia serpent blowfish_generic blowfish_x86_64 blowfish_common cast5 des_generic xcbc rmd160 sha512_generic crypto_null rfcomm af_key parport_pc bnep ppdev nfsd binfmt_misc nfs lockd fscache auth_rpcgss nfs_acl sunrpc btusb bluetooth uvcvideo videodev v4l2_compat_ioctl32 hid_logitech_dj joydev hp_wmi sparse_keymap snd_hda_intel snd_hda_codec snd_hwdep snd_pcm snd_seq_midi snd_rawmidi arc4 snd_seq_midi_event snd_seq snd_timer snd_seq_device ath9k snd mac80211 psmouse ath9k_common ath9k_hw ath serio_raw cfg80211 jmb38x_ms memstick soundcore snd_page_alloc mei(C) hp_accel lis3lv02d input_polldev mac_hid coretemp lp parport uas usb_storage usbhid hid wmi r8169 i915 radeon sdhci_pci sdhci video ttm drm_kms_helper drm i2c_algo_bit [last unloaded: ipmi_msghandler]
[ 55.783981]
[ 55.783990] Pid: 3180, comm: modprobe Tainted: G C O 3.2.0-30-generic #48-Ubuntu Hewlett-Packard HP ProBook 4530s/167C
[ 55.784038] RIP: 0010:[<ffffffff811ee58c>] [<ffffffff811ee58c>] sysfs_do_create_link+0x3c/0x210
[ 55.784077] RSP: 0018:ffff8803a5103c58 EFLAGS: 00010202
[ 55.784098] RAX: 0000000000000000 RBX: ffffffff81a4d9cc RCX: 0000000000000001
[ 55.784127] RDX: ffffffff81a4d9cc RSI: ffff8803e650b8b0 RDI: 0000000000000010
[ 55.784155] RBP: ffff8803a5103cb8 R08: 0000000000000000 R09: ffffffff8130e3d5
[ 55.784183] R10: fffffffffffffd67 R11: 0000000000000000 R12: 0000000000000000
[ 55.784211] R13: ffff8803a4b00000 R14: ffff8803e650b8b0 R15: 0000000000000001
[ 55.784240] FS: 00007f960dee0700(0000) GS:ffff8803ffc00000(0000) knlGS:0000000000000000
[ 55.784273] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 55.784296] CR2: 0000000000000040 CR3: 00000003a4811000 CR4: 00000000000406f0
[ 55.784324] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 55.784352] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 55.784381] Process modprobe (pid: 3180, threadinfo ffff8803a5102000, task ffff8803a49a4500)
[ 55.784414] Stack:
[ 55.784423] 0000000000000282 ffffffff81c96ca0 ffff8803a5103ca8 ffffffff8104dea3
[ 55.784457] ffff8803a5103ca8 0000000000000000 ffff8803a5b1c800 ffff8803e650a000
[ 55.784489] 0000000000000000 ffff8803a4b00000 ffff8803a4b00040 ffff8803e650b8a0
[ 55.784522] Call Trace:
[ 55.784538] [<ffffffff8104dea3>] ? __wake_up+0x53/0x70
[ 55.784560] [<ffffffff811ee773>] sysfs_create_link+0x13/0x20
[ 55.784586] [<ffffffff814dc291>] power_supply_powers+0x21/0x30
[ 55.784612] [<ffffffffa07dc25d>] wiimote_hid_probe+0x1ed/0x304 [hid_wiimote]
[ 55.784647] [<ffffffffa021bba4>] hid_device_probe+0xb4/0x140 [hid]
[ 55.784674] [<ffffffff811ee773>] ? sysfs_create_link+0x13/0x20
[ 55.784699] [<ffffffff813f5a28>] really_probe+0x68/0x190
[ 55.784722] [<ffffffff813f5cb5>] driver_probe_device+0x45/0x70
[ 55.784747] [<ffffffff813f5d8b>] __driver_attach+0xab/0xb0
[ 55.784770] [<ffffffff813f5ce0>] ? driver_probe_device+0x70/0x70
[ 55.784795] [<ffffffff813f5ce0>] ? driver_probe_device+0x70/0x70
[ 55.786524] [<ffffffff813f4b1c>] bus_for_each_dev+0x5c/0x90
[ 55.788358] [<ffffffff813f57ee>] driver_attach+0x1e/0x20
[ 55.790670] [<ffffffff813f5440>] bus_add_driver+0x1a0/0x270
[ 55.792984] [<ffffffffa0071000>] ? 0xffffffffa0070fff
[ 55.794886] [<ffffffff813f62f6>] driver_register+0x76/0x140
[ 55.796586] [<ffffffffa0071000>] ? 0xffffffffa0070fff
[ 55.798276] [<ffffffffa021cb53>] __hid_register_driver+0x53/0x90 [hid]
[ 55.799946] [<ffffffffa0071021>] wiimote_init+0x21/0x1000 [hid_wiimote]
[ 55.802199] [<ffffffff81002040>] do_one_initcall+0x40/0x180
[ 55.804301] [<ffffffff810a83ee>] sys_init_module+0xbe/0x230
[ 55.805965] [<ffffffff81662a02>] system_call_fastpath+0x16/0x1b
[ 55.807622] Code: 89 6d e8 4c 89 75 f0 4c 89 7d f8 66 66 66 66 90 48 85 d2 49 89 f6 48 89 d3 41 89 cf 0f 84 bf 01 00 00 48 85 ff 0f 84 74 01 00 00 <4c> 8b 6f 30 b8 f2 ff ff ff 4d 85 ed 0f 84 ba 00 00 00 48 c7 c7
[ 55.809464] RIP [<ffffffff811ee58c>] sysfs_do_create_link+0x3c/0x210
[ 55.811298] RSP <ffff8803a5103c58>
[ 55.813514] CR2: 0000000000000040
[ 56.045155] ---[ end trace b1ebc7f8b069843a ]---

I can reproduce this consistently by pressing 1+2 on the wiimote and connecting to the device from gnome-bluetooth (I'm assuming I paired correctly, however I can't tell due to this being the problem in the first place).

ProblemType: Bug
DistroRelease: Ubuntu 12.04
Package: linux-image-3.2.0-30-generic 3.2.0-30.48
ProcVersionSignature: Ubuntu 3.2.0-30.48-generic 3.2.27
Uname: Linux 3.2.0-30-generic x86_64
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.24.
ApportVersion: 2.0.1-0ubuntu12
Architecture: amd64
ArecordDevices:
**** List of CAPTURE Hardware Devices ****
card 0: PCH [HDA Intel PCH], device 0: STAC92xx Analog [STAC92xx Analog]
   Subdevices: 1/1
   Subdevice #0: subdevice #0
AudioDevicesInUse:
USER PID ACCESS COMMAND
/dev/snd/controlC0: mcuelenaere 2724 F.... pulseaudio
/dev/snd/pcmC0D0p: mcuelenaere 2724 F...m pulseaudio
Card0.Amixer.info:
Card hw:0 'PCH'/'HDA Intel PCH at 0xd4a00000 irq 51'
   Mixer name : 'Intel CougarPoint HDMI'
   Components : 'HDA:111d76d1,103c167d,00100205 HDA:80862805,80860101,00100000'
   Controls : 23
   Simple ctrls : 11
Date: Mon Sep 10 13:48:46 2012
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111012)
MachineType: Hewlett-Packard HP ProBook 4530s
ProcEnviron:
TERM=xterm
PATH=(custom, user)
LANG=nl_BE.utf8
SHELL=/bin/bash
ProcFB:
0 radeondrmfb
1 inteldrmfb
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-3.2.0-30-generic root=/dev/mapper/vg_hp4530s-full--disk ro mem=16G quiet splash vt.handoff=7
RelatedPackageVersions:
linux-restricted-modules-3.2.0-30-generic N/A
linux-backports-modules-3.2.0-30-generic N/A
linux-firmware 1.79.1
SourcePackage: linux
StagingDrivers: mei
UpgradeStatus: Upgraded to precise on 2012-04-27 (135 days ago)
dmi.bios.date: 03/09/2012
dmi.bios.vendor: Hewlett-Packard
dmi.bios.version: 68SRR Ver. F.23
dmi.board.name: 167C
dmi.board.vendor: Hewlett-Packard
dmi.board.version: KBC Version 22.21
dmi.chassis.asset.tag: CNU1243SQW
dmi.chassis.type: 10
dmi.chassis.vendor: Hewlett-Packard
dmi.modalias: dmi:bvnHewlett-Packard:bvr68SRRVer.F.23:bd03/09/2012:svnHewlett-Packard:pnHPProBook4530s:pvrA0001D02:rvnHewlett-Packard:rn167C:rvrKBCVersion22.21:cvnHewlett-Packard:ct10:cvr:
dmi.product.name: HP ProBook 4530s
dmi.product.version: A0001D02
dmi.sys.vendor: Hewlett-Packard

Tags:

Related branches

lp:ubuntu/precise-proposed/linux-ti-omap4

lp:ubuntu/precise-proposed/linux-lowlatency

CVE References

2012-3520

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-10:

AcpiTables.txt Edit (735.7 KiB, text/plain; charset="utf-8")
AlsaDevices.txt Edit (490 bytes, text/plain; charset="utf-8")
AplayDevices.txt Edit (265 bytes, text/plain; charset="utf-8")
BootDmesg.txt Edit (68.0 KiB, text/plain; charset="utf-8")
CRDA.txt Edit (257 bytes, text/plain; charset="utf-8")
Card0.Amixer.values.txt Edit (2.1 KiB, text/plain; charset="utf-8")
Card0.Codecs.codec.0.txt Edit (7.6 KiB, text/plain; charset="utf-8")
Card0.Codecs.codec.3.txt Edit (3.0 KiB, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (6.6 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (2.0 KiB, text/plain; charset="utf-8")
IwConfig.txt Edit (251 bytes, text/plain; charset="utf-8")
Lspci.txt Edit (13.2 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (762 bytes, text/plain; charset="utf-8")
PciMultimedia.txt Edit (637 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (3.5 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (2.6 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (5.2 KiB, text/plain; charset="utf-8")
PulseList.txt Edit (20.9 KiB, text/plain; charset="utf-8")
RfKill.txt Edit (294 bytes, text/plain; charset="utf-8")
UdevDb.txt Edit (153.9 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (352.4 KiB, text/plain; charset="utf-8")
WifiSyslog.txt Edit (316.1 KiB, text/plain; charset="utf-8")

Brad Figg (brad-figg) on 2012-09-10

Changed in linux (Ubuntu):
status:	New → Confirmed

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-10:

This might be the fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux.git;a=commitdiff;h=217c8b2b1978aa4a02ce040a99c59ed3b6418fe5

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-10:

This doesn't make sense, the backtrace clearly states it visited power_supply_powers(), but it seems there's no trace of that function in the source?

apt-get source linux-image-`uname -r`
grep -R power_supply_powers linux-3.2.0/

yields nothing. Am I missing something?

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-10:

Using the kernel from http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.4-precise/ this works fine, so I presume 217c8b2b1978aa4a02ce040a99c59ed3b6418fe5 fixes the issue.

Maurus Cuelenaere (mcuelenaere) on 2012-09-10

tags:

added: kernel-fixed-upstream-v3.4

Joseph Salisbury (jsalisbury) on 2012-09-10

Changed in linux (Ubuntu):
importance:	Undecided → Medium
tags:	added: needs-upstream-testing
tags:	removed: needs-upstream-testing
tags:	added: needs-bisect

Revision history for this message

Luis Henriques (henrix) wrote on 2012-09-11:

Thank you for your report. The commit you refer to is applied already to the Precise kernel since 3.2.0-25.40. Unfortunately, it looks like the backport of this commit is incorrect and this is probably causing the issue you're hitting.

I've reverted this commit, re-applied it and uploaded a test kernel here:

http://people.canonical.com/~henrix/lp1048605/v1/amd64/

Could you please test this kernel and let me know if it solves this issue? Thanks.

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-11:

Yes, this kernel fixes the issue, thanks.

Sep 11 13:27:07 hp4530s kernel: [ 121.758537] wiimote 0005:057E:0306.0006: hidraw3: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
Sep 11 13:27:07 hp4530s kernel: [ 121.758609] input: Nintendo Wii Remote Accelerometer as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0006/input/input15
Sep 11 13:27:07 hp4530s kernel: [ 121.758762] input: Nintendo Wii Remote IR as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0006/input/input16
Sep 11 13:27:07 hp4530s kernel: [ 121.758860] input: Nintendo Wii Remote as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0006/input/input17
Sep 11 13:27:08 hp4530s kernel: [ 122.755365] power_supply wiimote_battery: driver failed to report `capacity' property
Sep 11 13:27:08 hp4530s kernel: [ 122.755441] Registered led device: 0005:057E:0306.0006:blue:p0
Sep 11 13:27:08 hp4530s kernel: [ 122.755479] Registered led device: 0005:057E:0306.0006:blue:p1
Sep 11 13:27:08 hp4530s kernel: [ 122.755510] Registered led device: 0005:057E:0306.0006:blue:p2
Sep 11 13:27:08 hp4530s kernel: [ 122.755535] Registered led device: 0005:057E:0306.0006:blue:p3
Sep 11 13:27:08 hp4530s kernel: [ 122.755539] wiimote 0005:057E:0306.0006: New device registered

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-11:

Probably unrelated to this bug: it crashes when unplugging the USB bluetooth adapter (couldn't get a stack trace). I'll try to reproduce.

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-11:

Download full text (7.9 KiB)

This could be an upstream issue, had similar problems when testing the above mentioned 3.4 kernel.
Method of reproducing:

* plug USB bluetooth stick
* pair wiimote
* unplug USB bluetooth stick
* replug USB bluetooth stick

The actual problem (getting wiimote to work) is fixed though.

This could be an upstream issue, had similar problems when testing the above mentioned 3.4 kernel.
Method of reproducing:

* plug USB bluetooth stick
* pair wiimote
* unplug USB bluetooth stick
* replug USB bluetooth stick

The actual problem (getting wiimote to work) is fixed though.

Sep 11 13:44:44 hp4530s kernel: [  819.512448] wiimote 0005:057E:0306.0007: hidraw3: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
Sep 11 13:44:44 hp4530s kernel: [  819.512650] input: Nintendo Wii Remote Accelerometer as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0007/input/input18
Sep 11 13:44:44 hp4530s kernel: [  819.512945] input: Nintendo Wii Remote IR as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0007/input/input19
Sep 11 13:44:44 hp4530s kernel: [  819.513236] input: Nintendo Wii Remote as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:39/0005:057E:0306.0007/input/input20
Sep 11 13:44:45 hp4530s kernel: [  820.512501] power_supply wiimote_battery: driver failed to report `capacity' property
Sep 11 13:44:45 hp4530s kernel: [  820.512665] Registered led device: 0005:057E:0306.0007:blue:p0
Sep 11 13:44:45 hp4530s kernel: [  820.512716] Registered led device: 0005:057E:0306.0007:blue:p1
Sep 11 13:44:45 hp4530s kernel: [  820.512759] Registered led device: 0005:057E:0306.0007:blue:p2
Sep 11 13:44:45 hp4530s kernel: [  820.512802] Registered led device: 0005:057E:0306.0007:blue:p3
Sep 11 13:44:45 hp4530s kernel: [  820.512808] wiimote 0005:057E:0306.0007: New device registered
Sep 11 13:44:53 hp4530s kernel: [  828.245140] show_signal_msg: 48 callbacks suppressed
Sep 11 13:44:53 hp4530s kernel: [  828.249114] pool[4964]: segfault at 100000007 ip 00007faca46a8882 sp 00007fac977decc0 error 4 in libc-2.15.so[7faca462a000+1b3000]
Sep 11 13:45:11 hp4530s bluetoothd[1168]: HCI dev 1 down
Sep 11 13:45:11 hp4530s bluetoothd[1168]: Adapter /org/bluez/1168/hci1 has been disabled
Sep 11 13:45:11 hp4530s kernel: [  846.298284] usb 2-1.1: USB disconnect, device number 12
Sep 11 13:45:11 hp4530s kernel: [  846.301945] Bluetooth: hci1 urb ffff8803e1b9cf00 submission failed
Sep 11 13:45:11 hp4530s kernel: [  846.301967] wiimote 0005:057E:0306.0007: Device removed
Sep 11 13:45:11 hp4530s bluetoothd[1168]: HCI dev 1 unregistered
Sep 11 13:45:11 hp4530s bluetoothd[1168]: Stopping hci1 event socket
Sep 11 13:45:11 hp4530s bluetoothd[1168]: Unregister path: /org/bluez/1168/hci1
Sep 11 13:45:12 hp4530s kernel: [  847.300846] power_supply wiimote_battery: driver failed to report `capacity' property
Sep 11 13:45:20 hp4530s kernel: [  855.700520] usb 2-1.1: new full-speed USB device number 13 using ehci_hcd
Sep 11 13:45:21 hp4530s bluetoothd[1168]: HCI dev 1 registered
Sep 11 13:45:21 hp4530s bluetoothd[1168]: Listening for HCI events on hci1
Sep 11 13:45:21 hp4530s bluetoothd[1168]: HCI dev 1 up
Sep 11 13:45:21 hp4530s bluetoothd[1168]: sap-dummy interface org.bluez.SimAccessTest init failed on path /org/bluez/test
Sep 11 13:45:21 hp4530s bluetoothd[1168]: Sap driver initialization failed.
Sep 11 13:45:21 hp4530s bluetoothd[1168]: sap-server: Operation not permitted (1)
Sep 11 13:45:21 hp4530s bluetoothd[1168]: input-headset driver probe failed for device FC:A1:3E:21:F4:43
Sep 11 13:45:21 hp4530s bluetoothd[1168]: Adapter /org/bluez/1168/hci1 has been enabled
Sep 11 13:45:21 hp4530s kernel: [  856.287987] ------------[ cut here ]------------
Sep 11 13:45:21 hp4530s kernel: [  856.291707] WARNING: at /home/henrix/src/precise/ubuntu-precise/kernel/workqueue.c:997 __queue_work+0x306/0x320()
Sep 11 13:45:21 hp4530s kernel: [  856.295554] Hardware name: HP ProBook 4530s
Sep 11 13:45:21 hp4530s kernel: [  856.299347] Modules linked in: hid_wiimote ff_memless hidp pci_stub vboxpci(O) vboxnetadp(O) vboxnetflt(O) vboxdrv(O) kvm_intel kvm dm_crypt snd_hda_codec_hdmi snd_hda_codec_idt deflate zlib_deflate ctr twofish_generic twofish_x86_64_3way twofish_x86_64 twofish_common camellia serpent blowfish_generic blowfish_x86_64 blowfish_common cast5 des_generic xcbc rmd160 sha512_generic crypto_null af_key bnep rfcomm nfsd parport_pc ppdev nfs lockd fscache auth_rpcgss binfmt_misc nfs_acl sunrpc joydev hp_wmi sparse_keymap uvcvideo snd_hda_intel videodev v4l2_compat_ioctl32 ath3k snd_hda_codec btusb snd_hwdep bluetooth hid_logitech_dj snd_pcm snd_seq_midi arc4 snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device ath9k mac80211 snd ath9k_common ath9k_hw ath psmouse serio_raw cfg80211 soundcore jmb38x_ms snd_page_alloc memstick mei(C) hp_accel lis3lv02d input_polldev mac_hid coretemp lp parport usb_storage uas usbhid hid radeon sdhci_pci sdhci r8169 i915 wmi ttm drm_kms_helper drm
Sep 11 13:45:21 hp4530s kernel: i2c_algo_bit video [last unloaded: ipmi_msghandler]
Sep 11 13:45:21 hp4530s kernel: [  856.321470] Pid: 5032, comm: khidpd_057e0306 Tainted: G         C O 3.2.0-31-generic #50~lp1048605v1
Sep 11 13:45:21 hp4530s kernel: [  856.324625] Call Trace:
Sep 11 13:45:21 hp4530s kernel: [  856.329298]  [<ffffffff81066d7f>] warn_slowpath_common+0x7f/0xc0
Sep 11 13:45:21 hp4530s kernel: [  856.333983]  [<ffffffff81066dda>] warn_slowpath_null+0x1a/0x20
Sep 11 13:45:21 hp4530s kernel: [  856.338642]  [<ffffffff81082c56>] __queue_work+0x306/0x320
Sep 11 13:45:21 hp4530s kernel: [  856.340919]  [<ffffffff811974c0>] ? mntput_no_expire+0x30/0xf0
Sep 11 13:45:21 hp4530s kernel: [  856.342714]  [<ffffffff81082cd5>] queue_work_on+0x25/0x30
Sep 11 13:45:21 hp4530s kernel: [  856.344470]  [<ffffffff81082d1f>] queue_work+0x1f/0x30
Sep 11 13:45:21 hp4530s kernel: [  856.346483]  [<ffffffffa046dc53>] hci_conn_del_sysfs+0x23/0x30 [bluetooth]
Sep 11 13:45:21 hp4530s kernel: [  856.348252]  [<ffffffffa04603c5>] hci_conn_put_device+0x25/0x30 [bluetooth]
Sep 11 13:45:21 hp4530s kernel: [  856.350044]  [<ffffffffa078f15e>] hidp_session+0x3fe/0x510 [hidp]
Sep 11 13:45:21 hp4530s kernel: [  856.352002]  [<ffffffff8105f5d0>] ? try_to_wake_up+0x200/0x200
Sep 11 13:45:21 hp4530s kernel: [  856.354508]  [<ffffffff8105f5d0>] ? try_to_wake_up+0x200/0x200
Sep 11 13:45:21 hp4530s kernel: [  856.356271]  [<ffffffffa078ed60>] ? hidp_recv_ctrl_frame+0xf0/0xf0 [hidp]
Sep 11 13:45:21 hp4530s kernel: [  856.358080]  [<ffffffff8108a03c>] kthread+0x8c/0xa0
Sep 11 13:45:21 hp4530s kernel: [  856.359851]  [<ffffffff81664c74>] kernel_thread_helper+0x4/0x10
Sep 11 13:45:21 hp4530s kernel: [  856.361667]  [<ffffffff81089fb0>] ? flush_kthread_worker+0xa0/0xa0
Sep 11 13:45:21 hp4530s kernel: [  856.363452]  [<ffffffff81664c70>] ? gs_change+0x13/0x13
Sep 11 13:45:21 hp4530s kernel: [  856.365263] ---[ end trace 3d57b41153419411 ]---
Sep 11 13:45:22 hp4530s kernel: [  857.788059] wiimote 0005:057E:0306.0008: hidraw3: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
Sep 11 13:45:22 hp4530s kernel: [  857.791862] input: Nintendo Wii Remote Accelerometer as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:38/0005:057E:0306.0008/input/input21
Sep 11 13:45:22 hp4530s kernel: [  857.795150] input: Nintendo Wii Remote IR as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:38/0005:057E:0306.0008/input/input22
Sep 11 13:45:22 hp4530s kernel: [  857.798286] input: Nintendo Wii Remote as /devices/pci0000:00/0000:00:1d.0/usb2/2-1/2-1.1/2-1.1:1.0/bluetooth/hci1/hci1:38/0005:057E:0306.0008/input/input23
Sep 11 13:45:23 hp4530s kernel: [  858.799808] power_supply wiimote_battery: driver failed to report `capacity' property
Sep 11 13:45:23 hp4530s kernel: [  858.805046] Registered led device: 0005:057E:0306.0008:blue:p0
Sep 11 13:45:23 hp4530s kernel: [  858.805118] Registered led device: 0005:057E:0306.0008:blue:p1
Sep 11 13:45:23 hp4530s kernel: [  858.805184] Registered led device: 0005:057E:0306.0008:blue:p2
Sep 11 13:45:23 hp4530s kernel: [  858.805252] Registered led device: 0005:057E:0306.0008:blue:p3
Sep 11 13:45:23 hp4530s kernel: [  858.805260] wiimote 0005:057E:0306.0008: New device registered

Revision history for this message

Luis Henriques (henrix) wrote on 2012-09-11:

Thank you for testing. This new issue seems to be unrelated with the initial problem. It looks like the driver fails to cleanly unregister when the BT is unplugged and then it isn't able to reattach. This new issue may also not be related with the wiimote driver itself, but with the BT stack. Anyway, could you please report this in a new bug?

Luis Henriques (henrix) on 2012-09-11

Changed in linux (Ubuntu):
status:	Confirmed → In Progress
assignee:	nobody → Luis Henriques (henrix)

Tim Gardner (timg-tpi) on 2012-09-11

Changed in linux (Ubuntu Precise):
assignee:	nobody → Luis Henriques (henrix)
status:	New → Fix Committed
Changed in linux (Ubuntu Quantal):
status:	In Progress → Fix Released

Revision history for this message

Luis Henriques (henrix) wrote on 2012-09-28:

#10

This bug is awaiting verification that the kernel for Precise in -proposed solves the problem (3.2.0-32.51). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-precise' to 'verification-done-precise'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-precise

Revision history for this message

Maurus Cuelenaere (mcuelenaere) wrote on 2012-09-29:

#11

Verified working.

mcuelenaere@hp4530s:~$ uname -a
Linux hp4530s 3.2.0-32-generic #51-Ubuntu SMP Wed Sep 26 21:33:09 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
mcuelenaere@hp4530s:~$ tail -n 15 /var/log/syslog
Sep 29 11:58:13 hp4530s bluetoothd[946]: Endpoint unregistered: sender=:1.33 path=/MediaEndpoint/A2DPSource
Sep 29 11:58:13 hp4530s bluetoothd[946]: Endpoint unregistered: sender=:1.33 path=/MediaEndpoint/A2DPSink
Sep 29 11:58:18 hp4530s kernel: [ 36.321661] wiimote 0005:057E:0306.0004: hidraw1: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
Sep 29 11:58:18 hp4530s kernel: [ 36.321712] input: Nintendo Wii Remote Accelerometer as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0004/input/input13
Sep 29 11:58:18 hp4530s kernel: [ 36.321805] input: Nintendo Wii Remote IR as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0004/input/input14
Sep 29 11:58:18 hp4530s kernel: [ 36.321891] input: Nintendo Wii Remote as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0004/input/input15
Sep 29 11:58:19 hp4530s kernel: [ 37.319813] power_supply wiimote_battery: driver failed to report `capacity' property
Sep 29 11:58:19 hp4530s kernel: [ 37.319893] Registered led device: 0005:057E:0306.0004:blue:p0
Sep 29 11:58:19 hp4530s kernel: [ 37.319926] Registered led device: 0005:057E:0306.0004:blue:p1
Sep 29 11:58:19 hp4530s kernel: [ 37.319954] Registered led device: 0005:057E:0306.0004:blue:p2
Sep 29 11:58:19 hp4530s kernel: [ 37.319983] Registered led device: 0005:057E:0306.0004:blue:p3
Sep 29 11:58:19 hp4530s kernel: [ 37.319987] wiimote 0005:057E:0306.0004: New device registered
Sep 29 11:58:25 hp4530s blueman-mechanism: Exiting
Sep 29 11:58:57 hp4530s dbus[895]: [system] Activating service name='com.ubuntu.SystemService' (using servicehelper)
Sep 29 11:58:57 hp4530s dbus[895]: [system] Successfully activated service 'com.ubuntu.SystemService'

Verified working.

mcuelenaere@hp4530s:~$ uname -a
Linux hp4530s 3.2.0-32-generic #51-Ubuntu SMP Wed Sep 26 21:33:09 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux
mcuelenaere@hp4530s:~$ tail -n 15 /var/log/syslog
Sep 29 11:58:13 hp4530s bluetoothd[946]: Endpoint unregistered: sender=:1.33 path=/MediaEndpoint/A2DPSource
Sep 29 11:58:13 hp4530s bluetoothd[946]: Endpoint unregistered: sender=:1.33 path=/MediaEndpoint/A2DPSink
Sep 29 11:58:18 hp4530s kernel: [   36.321661] wiimote 0005:057E:0306.0004: hidraw1: BLUETOOTH HID v3a.1c Gamepad [Nintendo RVL-CNT-01] on 00:15:83:C7:39:BC
Sep 29 11:58:18 hp4530s kernel: [   36.321712] input: Nintendo Wii Remote Accelerometer as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0004/input/input13
Sep 29 11:58:18 hp4530s kernel: [   36.321805] input: Nintendo Wii Remote IR as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0004/input/input14
Sep 29 11:58:18 hp4530s kernel: [   36.321891] input: Nintendo Wii Remote as /devices/pci0000:00/0000:00:1a.0/usb1/1-1/1-1.3/1-1.3:1.0/bluetooth/hci0/hci0:38/0005:057E:0306.0004/input/input15
Sep 29 11:58:19 hp4530s kernel: [   37.319813] power_supply wiimote_battery: driver failed to report `capacity' property
Sep 29 11:58:19 hp4530s kernel: [   37.319893] Registered led device: 0005:057E:0306.0004:blue:p0
Sep 29 11:58:19 hp4530s kernel: [   37.319926] Registered led device: 0005:057E:0306.0004:blue:p1
Sep 29 11:58:19 hp4530s kernel: [   37.319954] Registered led device: 0005:057E:0306.0004:blue:p2
Sep 29 11:58:19 hp4530s kernel: [   37.319983] Registered led device: 0005:057E:0306.0004:blue:p3
Sep 29 11:58:19 hp4530s kernel: [   37.319987] wiimote 0005:057E:0306.0004: New device registered
Sep 29 11:58:25 hp4530s blueman-mechanism: Exiting 
Sep 29 11:58:57 hp4530s dbus[895]: [system] Activating service name='com.ubuntu.SystemService' (using servicehelper)
Sep 29 11:58:57 hp4530s dbus[895]: [system] Successfully activated service 'com.ubuntu.SystemService'

tags:

added: verification-done-precise
removed: verification-needed-precise

Revision history for this message

Adam Conrad (adconrad) wrote on 2012-10-09: Update Released

#12

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-10-12:

#13

Download full text (18.4 KiB)

This bug was fixed in the package linux - 3.2.0-32.51

---------------
linux (3.2.0-32.51) precise-proposed; urgency=low

[Luis Henriques]

* Release Tracking Bug
- LP: #1056036

[ Keng-Yu Lin ]

* SAUCE: Intel xhci: Only switch the switchable ports
- LP: #1034814

[ Kyle Fazzari ]

* SAUCE: input: Cypress PS/2 Trackpad fix disabling tap-to-click
- LP: #1048816

[ Seth Forshee ]

  * SAUCE: Input: synaptics - Adjust threshold for treating position values
    as negative
    - LP: #1046512

[ Stefan Bader ]

* Revert "SAUCE: Force xsave off on older Xen hypervisors"
- LP: #1044550

[ Upstream Kernel Changes ]

This bug was fixed in the package linux - 3.2.0-32.51

---------------
linux (3.2.0-32.51) precise-proposed; urgency=low

[Luis Henriques]

* Release Tracking Bug
    - LP: #1056036

[ Keng-Yu Lin ]

* SAUCE: Intel xhci: Only switch the switchable ports
    - LP: #1034814

[ Kyle Fazzari ]

* SAUCE: input: Cypress PS/2 Trackpad fix disabling tap-to-click
    - LP: #1048816

[ Seth Forshee ]

* SAUCE: Input: synaptics - Adjust threshold for treating position values
    as negative
    - LP: #1046512

[ Stefan Bader ]

* Revert "SAUCE: Force xsave off on older Xen hypervisors"
    - LP: #1044550

[ Upstream Kernel Changes ]

* Revert "HID: wiimote: fix invalid power_supply_powers call"
    - LP: #1048605
  * Revert "drm/radeon: fix bo creation retry path"
    - LP: #1049899
  * HID: wiimote: fix invalid power_supply_powers call
    - LP: #1048605
  * HID: add ASUS AIO keyboard model AK1D
    - LP: #1027789, #1049899
  * nfs: tear down caches in nfs_init_writepagecache when allocation fails
    - LP: #1049899
  * NFS: Use kcalloc() when allocating arrays
    - LP: #1049899
  * NFSv4.1 fix page number calculation bug for filelayout decode buffers
    - LP: #1049899
  * fix page number calculation bug for block layout decode buffer
    - LP: #1049899
  * pnfs: defer release of pages in layoutget
    - LP: #1049899
  * ext4: avoid kmemcheck complaint from reading uninitialized memory
    - LP: #1049899
  * fuse: verify all ioctl retry iov elements
    - LP: #1049899
  * Bluetooth: Fix legacy pairing with some devices
    - LP: #1049899
  * xhci: Increase reset timeout for Renesas 720201 host.
    - LP: #1049899
  * xhci: Add Etron XHCI_TRUST_TX_LENGTH quirk.
    - LP: #1049899
  * USB: ftdi_sio: Add VID/PID for Kondo Serial USB
    - LP: #1049899
  * USB: option: Add Vodafone/Huawei K5005 support
    - LP: #1049899
  * USB: add USB_VENDOR_AND_INTERFACE_INFO() macro
    - LP: #1049899
  * USB: support the new interfaces of Huawei Data Card devices in option
    driver
    - LP: #1049899
  * usb: serial: mos7840: Fixup mos7840_chars_in_buffer()
    - LP: #1049899
  * usb: gadget: u_ether: fix kworker 100% CPU issue with still used
    interfaces in eth_stop
    - LP: #1049899
  * ARM: 7483/1: vfp: only advertise VFPv4 in hwcaps if CONFIG_VFPv3 is
    enabled
    - LP: #1049899
  * ARM: 7488/1: mm: use 5 bits for swapfile type encoding
    - LP: #1049899
  * ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
    - LP: #1049899
  * drm/i915: ignore eDP bpc settings from vbt
    - LP: #1049899
  * ALSA: hda - fix Copyright debug message
    - LP: #1049899
  * sched: fix divide by zero at {thread_group,task}_times
    - LP: #1049899
  * ath9k: fix decrypt_error initialization in ath_rx_tasklet()
    - LP: #1049899
  * drm/nvd0/disp: mask off high 16 bit of negative cursor x-coordinate
    - LP: #1049899
  * drm/i915: reorder edp disabling to fix ivb MacBook Air
    - LP: #1049899
  * audit: don't free_chunk() after fsnotify_add_mark()
    - LP: #1049899
  * audit: fix refcounting in audit-tree
    - LP: #1049899
  * vfs: canonicalize create mode in build_open_flags()
    - LP: #1049899
  * PCI: EHCI: Fix crash during hibernation on ASUS computers
    - LP: #1049899
  * IB/srp: Fix a race condition
    - LP: #1049899
  * dccp: check ccid before dereferencing
    - LP: #1049899
  * md: Don't truncate size at 4TB for RAID0 and Linear
    - LP: #1049899
  * NFS: Alias the nfs module to nfs4
    - LP: #1049899
  * target: fix NULL pointer dereference bug alloc_page() fails to get
    memory
    - LP: #1049899
  * ext4: fix long mount times on very big file systems
    - LP: #1049899
  * PM / Runtime: Fix rpm_resume() return value for power.no_callbacks set
    - LP: #1049899
  * PM / Runtime: Clear power.deferred_resume on success in rpm_suspend()
    - LP: #1049899
  * ASoC: wm9712: Fix microphone source selection
    - LP: #1049899
  * USB: smsusb: remove __devinit* from the struct usb_device_id table
    - LP: #1049899
  * USB: spca506: remove __devinit* from the struct usb_device_id table
    - LP: #1049899
  * USB: p54usb: remove __devinit* from the struct usb_device_id table
    - LP: #1049899
  * USB: rtl8187: remove __devinit* from the struct usb_device_id table
    - LP: #1049899
  * USB: vt6656: remove __devinit* from the struct usb_device_id table
    - LP: #1049899
  * USB: winbond: remove __devinit* from the struct usb_device_id table
    - LP: #1049899
  * USB: emi62: remove __devinit* from the struct usb_device_id table
    - LP: #1049899
  * USB: CDC ACM: Fix NULL pointer dereference
    - LP: #1049899
  * alpha: Don't export SOCK_NONBLOCK to user space.
    - LP: #1049899
  * Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
    - LP: #1049899
  * ALSA: hda - don't create dysfunctional mixer controls for ca0132
    - LP: #1038651, #1049899
  * netconsole: remove a redundant netconsole_target_put()
    - LP: #1049899
  * drm/radeon/kms: upstream atombios.h updates
    - LP: #1049899
  * drm/radeon/kms: extend the Fujitsu D3003-S2 board connector quirk to
    cover later silicon stepping
    - LP: #1049899
  * drm/radeon: implement ACPI VFCT vbios fetch (v3)
    - LP: #1049899
  * ACPI: export symbol acpi_get_table_with_size
    - LP: #1049899
  * drm/radeon: convert radeon vfct code to use acpi_get_table_with_size
    - LP: #1049899
  * drm/radeon: fix invalid memory access in radeon_atrm_get_bios()
    - LP: #1049899
  * drm/radeon: finish getting bios earlier
    - LP: #1049899
  * drm/radeon: fix use after free in ATRM bios reading code.
    - LP: #1049899
  * drm/radeon: split ATRM support out from the ATPX handler (v3)
    - LP: #1049899
  * NFSv3: Ensure that do_proc_get_root() reports errors correctly
    - LP: #1049899
  * vfs: missed source of ->f_pos races
    - LP: #1049899
  * svcrpc: fix BUG() in svc_tcp_clear_pages
    - LP: #1049899
  * svcrpc: sends on closed socket should stop immediately
    - LP: #1049899
  * svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping
    - LP: #1049899
  * fbcon: fix race condition between console lock and cursor timer (v1.1)
    - LP: #1049899
  * cciss: fix incorrect scsi status reporting
    - LP: #1049899
  * mm: hugetlbfs: correctly populate shared pmd
    - LP: #1049899
  * drivers/misc/sgi-xp/xpc_uv.c: SGI XPC fails to load when cpu 0 is out
    of IRQ resources
    - LP: #1049899
  * drivers/rtc/rtc-rs5c348.c: fix hour decoding in 12-hour mode
    - LP: #1049899
  * rapidio/tsi721: fix inbound doorbell interrupt handling
    - LP: #1049899
  * rapidio/tsi721: fix unused variable compiler warning
    - LP: #1049899
  * fs/buffer.c: remove BUG() in possible but rare condition
    - LP: #1049899
  * block: replace __getblk_slow misfix by grow_dev_page fix
    - LP: #1049899
  * Bluetooth: Fix using uninitialized option in RFCMode
    - LP: #1049899
  * drivers/char/random.c: fix boot id uniqueness race
    - LP: #1049899
  * MAINTAINERS: Theodore Ts'o is taking over the random driver
    - LP: #1049899
  * random: Add comment to random_initialize()
    - LP: #1049899
  * dmi: Feed DMI table to /dev/random driver
    - LP: #1049899
  * virtio_blk: fix config handler race
    - LP: #1049899
  * virtio_blk: Drop unused request tracking list
    - LP: #1049899
  * virtio-blk: Fix hot-unplug race in remove method
    - LP: #1049899
  * virtio-blk: Call del_gendisk() before disable guest kick
    - LP: #1049899
  * virtio-blk: Reset device after blk_cleanup_queue()
    - LP: #1049899
  * HID: add support for Cypress barcode scanner 04B4:ED81
    - LP: #1049899
  * pmac_zilog,kdb: Fix console poll hook to return instead of loop
    - LP: #1049899
  * Staging: speakup: fix an improperly-declared variable.
    - LP: #1049899
  * NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate
    - LP: #1049899
  * Squashfs: fix mount time sanity check for corrupted superblock
    - LP: #1049899
  * mm: avoid swapping out with swappiness==0
    - LP: #1049899
  * Linux 3.2.29
    - LP: #1049899
  * Input: elantech - add support for elantech fast command
    - LP: #1033568
  * Input: elantech - add resolution query support for v4 hardware
    - LP: #1033568
  * Input: elantech - v4 is a clickpad, with only one button
    - LP: #1033568
  * eCryptfs: Copy up attributes of the lower target inode after rename
    - LP: #561129
  * eCryptfs: Write out all dirty pages just before releasing the lower
    file
    - LP: #1047261
  * eCryptfs: Call lower ->flush() from ecryptfs_flush()
    - LP: #1047261
  * af_netlink: force credentials passing [CVE-2012-3520]
    - LP: #1052097
    - CVE-2012-3520
  * Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
    - LP: #1053039
  * ARM: S3C24XX: Fix s3c2410_dma_enqueue parameters
    - LP: #1053039
  * ARM: OMAP2+: Fix dmtimer set source clock failure
    - LP: #1053039
  * ARM: Orion: Set eth packet size csum offload limit
    - LP: #1053039
  * iwlwifi: fix flow handler debug code
    - LP: #1053039
  * iwlwifi: protect SRAM debugfs
    - LP: #1053039
  * Input: i8042 - add Gigabyte T1005 series netbooks to noloop table
    - LP: #1053039
  * mpt2sas: Fix for Driver oops, when loading driver with max_queue_depth
    command line option to a very small value
    - LP: #1053039
  * megaraid_sas: Move poll_aen_lock initializer
    - LP: #1053039
  * Fix 'Device not ready' issue on mpt2sas
    - LP: #1053039
  * hwmon: (asus_atk0110) Add quirk for Asus M5A78L
    - LP: #1053039
  * drm/i915: Fix assert_pch_hdmi_disabled to mention HDMI (not DP)
    - LP: #1053039
  * drm/i915: fix wrong order of parameters in port checking functions
    - LP: #1053039
  * OMAPFB: fix framebuffer console colors
    - LP: #1053039
  * ARM: imx6: spin the cpu until hardware takes it down
    - LP: #1053039
  * ARM: dts: imx51-babbage: fix esdhc cd/wp properties
    - LP: #1053039
  * xen/setup: Fix one-off error when adding for-balloon PFNs to the P2M.
    - LP: #1053039
  * ARM: imx: select CPU_FREQ_TABLE when needed
    - LP: #1053039
  * drm: remove some potentially dangerous DRM_ERRORs
    - LP: #1053039
  * drm: Check for invalid cursor flags
    - LP: #1053039
  * HID: multitouch: support PixArt optical touch screen
    - LP: #1053039
  * HID: add NOGET quirk for Eaton Ellipse MAX UPS
    - LP: #1053039
  * drm/radeon: don't disable plls that are in use by other crtcs
    - LP: #1053039
  * drm/radeon/atom: rework DIG modesetting on DCE3+
    - LP: #1053039
  * drm/radeon: force dma32 to fix regression rs4xx,rs6xx,rs740
    - LP: #1053039
  * drm/edid/quirks: ViewSonic VA2026w
    - LP: #1053039
  * drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S
    - LP: #1053039
  * e1000e: DoS while TSO enabled caused by link partner with small MSS
    - LP: #1053039
  * ext3: Fix fdatasync() for files with only i_size changes
    - LP: #1053039
  * UBI: fix a horrible memory deallocation bug
    - LP: #1053039
  * fuse: fix retrieve length
    - LP: #1053039
  * mmc: mxs-mmc: fix deadlock in SDIO IRQ case
    - LP: #1053039
  * mmc: mxs-mmc: fix deadlock caused by recursion loop
    - LP: #1053039
  * mmc: sdhci-esdhc: break out early if clock is 0
    - LP: #1053039
  * mmc: card: Skip secure erase on MoviNAND; causes unrecoverable
    corruption.
    - LP: #1053039
  * powerpc: Update DSCR on all CPUs when writing sysfs dscr_default
    - LP: #1053039
  * powerpc: Keep thread.dscr and thread.dscr_inherit in sync
    - LP: #1053039
  * powerpc: Fix DSCR inheritance in copy_thread()
    - LP: #1053039
  * powerpc: Restore correct DSCR in context switch
    - LP: #1053039
  * powerpc/xics: Harden xics hypervisor backend
    - LP: #1053039
  * powerpc: Make sure IPI handlers see data written by IPI senders
    - LP: #1053039
  * udf: Fix data corruption for files in ICB
    - LP: #1053039
  * xen: Use correct masking in xen_swiotlb_alloc_coherent.
    - LP: #1053039
  * Remove user-triggerable BUG from mpol_to_str
    - LP: #1053039
  * CIFS: Fix error handling in cifs_push_mandatory_locks
    - LP: #1053039
  * i2c-designware: Fix build error if CONFIG_I2C_DESIGNWARE_PLATFORM=y &&
    CONFIG_I2C_DESIGNWARE_PCI=y
    - LP: #1053039
  * net_sched: gact: Fix potential panic in tcf_gact().
    - LP: #1053039
  * isdnloop: fix and simplify isdnloop_init()
    - LP: #1053039
  * pptp: lookup route with the proper net namespace
    - LP: #1053039
  * net/core: Fix potential memory leak in dev_set_alias()
    - LP: #1053039
  * af_packet: remove BUG statement in tpacket_destruct_skb
    - LP: #1053039
  * ipv6: addrconf: Avoid calling netdevice notifiers with RCU read-side
    lock
    - LP: #1053039
  * atm: fix info leak in getsockopt(SO_ATMPVC)
    - LP: #1053039
  * atm: fix info leak via getsockname()
    - LP: #1053039
  * Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER)
    - LP: #1053039
  * Bluetooth: HCI - Fix info leak via getsockname()
    - LP: #1053039
  * Bluetooth: RFCOMM - Fix info leak in getsockopt(BT_SECURITY)
    - LP: #1053039
  * Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST)
    - LP: #1053039
  * Bluetooth: RFCOMM - Fix info leak via getsockname()
    - LP: #1053039
  * Bluetooth: L2CAP - Fix info leak via getsockname()
    - LP: #1053039
  * llc: fix info leak via getsockname()
    - LP: #1053039
  * dccp: fix info leak via getsockopt(DCCP_SOCKOPT_CCID_TX_INFO)
    - LP: #1053039
  * ipvs: fix info leak in getsockopt(IP_VS_SO_GET_TIMEOUT)
    - LP: #1053039
  * net: fix info leak in compat dev_ifconf()
    - LP: #1053039
  * af_packet: don't emit packet on orig fanout group
    - LP: #1053039
  * netlink: fix possible spoofing from non-root processes
    - LP: #1053039
  * gianfar: fix default tx vlan offload feature flag
    - LP: #1053039
  * l2tp: avoid to use synchronize_rcu in tunnel free function
    - LP: #1053039
  * net: ipv4: ipmr_expire_timer causes crash when removing net namespace
    - LP: #1053039
  * bnx2x: fix 57840_MF pci id
    - LP: #1053039
  * workqueue: UNBOUND -> REBIND morphing in rebind_workers() should be
    atomic
    - LP: #1053039
  * fixing dmi match for hp t5745 and hp st5747 thin client
    - LP: #1053039
  * time: Improve sanity checking of timekeeping inputs
    - LP: #1053039
  * time: Avoid making adjustments if we haven't accumulated anything
    - LP: #1053039
  * time: Move ktime_t overflow checking into timespec_valid_strict
    - LP: #1053039
  * drm/i915: Wait for all pending operations to the fb before disabling
    the pipe
    - LP: #1053039
  * xhci: Fix bug after deq ptr set to link TRB.
    - LP: #1053039
  * ARM: 7487/1: mm: avoid setting nG bit for user mappings that aren't
    present
    - LP: #1053039
  * i2c-i801: Add Device IDs for Intel Lynx Point-LP PCH
    - LP: #1053039
  * USB: option: add ZTE K5006-Z
    - LP: #1053039
  * USB: option: replace ZTE K5006-Z entry with vendor class rule
    - LP: #1053039
  * ARM: 7496/1: hw_breakpoint: don't rely on dfsr to show watchpoint
    access type
    - LP: #1053039
  * drm/i915: SDVO hotplug have different interrupt status bits for
    i915/i965/g4x
    - LP: #1053039
  * drm/i915: only enable sdvo hotplug irq if needed
    - LP: #1053039
  * can: mcp251x: avoid repeated frame bug
    - LP: #1053039
  * perf_event: Switch to internal refcount, fix race with close()
    - LP: #1053039
  * NFS: Fix the initialisation of the readdir 'cookieverf' array
    - LP: #1053039
  * NFS: Fix a problem with the legacy binary mount code
    - LP: #1053039
  * staging: comedi: das08: Correct AI encoding for das08jr-16-ao
    - LP: #1053039
  * staging: comedi: das08: Correct AO output for das08jr-16-ao
    - LP: #1053039
  * staging: vt6656: [BUG] - Failed connection, incorrect endian.
    - LP: #1053039
  * xhci: Recognize USB 3.0 devices as superspeed at powerup
    - LP: #1000424, #1053039
  * rt2x00: Identify ASUS USB-N53 device.
    - LP: #1053039
  * rt2x00: Fix word size of rt2500usb MAC_CSR19 register.
    - LP: #1053039
  * rt2x00: Fix rfkill polling prior to interface start.
    - LP: #1053039
  * rt2800usb: Added rx packet length validity check
    - LP: #1053039
  * staging: zcache: fix cleancache race condition with shrinker
    - LP: #1053039
  * xhci: Switch PPT ports to EHCI on shutdown.
    - LP: #1053039
  * xhci: Fix a logical vs bitwise AND bug
    - LP: #1053039
  * xhci: Make handover code more robust
    - LP: #1053039
  * usb: host: xhci: Fix Compliance Mode on SN65LVPE502CP Hardware
    - LP: #1053039
  * usb: host: xhci: fix compilation error for non-PCI based stacks
    - LP: #1053039
  * tty: serial: imx: console write routing is unsafe on SMP
    - LP: #1053039
  * tty: serial: imx: don't reinit clock in imx_setup_ufcr()
    - LP: #1053039
  * ibmveth: Fix alignment of rx queue bug
    - LP: #1053039
  * USB: ftdi-sio: add support for more Physik Instrumente devices
    - LP: #1053039
  * USB: ftdi_sio: PID for NZR SEM 16+ USB
    - LP: #1053039
  * USB: add device quirk for Joss Optical touchboard
    - LP: #1053039
  * kobject: fix oops with "input0: bad kobj_uevent_env content in
    show_uevent()"
    - LP: #1053039
  * NFS: return error from decode_getfh in decode open
    - LP: #1053039
  * SUNRPC: Fix a UDP transport regression
    - LP: #1053039
  * ARM: 7513/1: Make sure dtc is built before running it
    - LP: #1053039
  * ARM: 7526/1: traps: send SIGILL if get_user fails on undef handling
    path
    - LP: #1053039
  * ALSA: hda - Fix Oops at codec reset/reconfig
    - LP: #1053039
  * USB: ftdi_sio: do not claim CDC ACM function
    - LP: #1053039
  * staging: r8712u: fix bug in r8712_recv_indicatepkt()
    - LP: #1053039
  * EHCI: Update qTD next pointer in QH overlay region during unlink
    - LP: #1053039
  * hwmon: (twl4030-madc-hwmon) Initialize uninitialized structure elements
    - LP: #1053039
  * ALSA: ice1724: Use linear scale for AK4396 volume control.
    - LP: #1053039
  * vmwgfx: add dumb ioctl support
    - LP: #1053039
  * ahci: Add alternate identifier for the 88SE9172
    - LP: #1053039
  * drm/radeon: fix up pll selection on DCE5/6
    - LP: #1053039
  * drm/radeon: fix ordering in pll picking on dce4+
    - LP: #1053039
  * drm/radeon: rework pll selection (v3)
    - LP: #1053039
  * drm/nouveau: fix booting with plymouth + dumb support
    - LP: #1053039
  * VFS: make vfs_fstat() use f[get|put]_light()
    - LP: #1053039
  * vfs: make O_PATH file descriptors usable for 'fstat()'
    - LP: #1053039
  * Linux 3.2.30
    - LP: #1053039
  * drm/i915: HDMI - Clear Audio Enable bit for Hot Plug
    - LP: #1056729
  * UBUNTU SAUCE: apparmor: fix IRQ stack overflow
    - LP: #1056078

[ Wen-chien Jesse Sung ]

* SAUCE: drm/i915: Explicitly disable RC6 for certain models
    - LP: #1002170, #1008867
 -- Luis Henriques <luis.henriques@canonical.com>   Wed, 26 Sep 2012 17:26:35 +0100

Changed in linux (Ubuntu Precise):
status:	Fix Committed → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux package

Pairing wiimote leads to kernel null pointer derefence in hid_wiimote

Bug Description

Related branches

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
linux package