Simple Scan crashes USB hub in Ubuntu 16.10

Bug #1641052 reported by Gary Houston
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Simple Scan
New
Undecided
Unassigned

Bug Description

I'm scanning with an old HP Deskjet F380 printer/scanner, which has worked fine for years, and still works fine when scanning with scanimage or xsane or with simple-scan in Ubuntu 16.04. However in Ubuntu 16.10 it fails every time when scanning a page of text. It starts scanning and displaying the scan on the screen but at some random point locks up. lsusb shows that the scanner is no longer present, and in fact the USB driver for that hub has crashed.

dmesg gives the following:

when finding the device:
[ 2.398527] usb 4-1: New USB device found, idVendor=03f0, idProduct=5511
[ 2.398529] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 2.398530] usb 4-1: Product: Deskjet F300 series
[ 2.398531] usb 4-1: Manufacturer: HP
[ 2.398531] usb 4-1: SerialNumber: CN6C7GM0JF04KH

When scanning starts:
[ 381.010913] Did not find alt setting 1 for intf 0, config 1
[ 381.012390] Did not find alt setting 1 for intf 0, config 1

When it locks up:

[ 391.537875] ohci-pci 0000:00:12.1: HcDoneHead not written back; disabled
[ 391.537887] ohci-pci 0000:00:12.1: HC died; cleaning up
[ 391.538010] usb 4-1: USB disconnect, device number 2

Attempting to rebind the hub driver fails with "write error: No such device" and dmesg prints "hub: probe of 4-0:1.0 failed with error -22". That's -EINVAL. It can only be restarted by rebooting the machine.

I tried running it in a QEMU virtual machine (the scanner didn't seem to work at all in VirtualBox.) Scanning was very slow, but it eventually crashed near the end of the page. dmesg in the guest OS said:

usb 1-1: USB disconnect, device number 2

while dmesg in the host said:

[ 3650.175052] ohci-pci 0000:00:12.1: frame counter not updating; disabled
[ 3650.175058] ohci-pci 0000:00:12.1: HC died; cleaning up
[ 3650.175138] usb 4-1: USB disconnect, device number 3

I've attached a scan log, which goes bad at:

[+20.38s] DEBUG: scanner.vala:1314: sane_read (14881) -> (SANE_STATUS_GOOD, 1488
0)
[+20.41s] DEBUG: scanner.vala:1314: sane_read (14881) -> (SANE_STATUS_GOOD, 1488
0)
[+20.41s] DEBUG: simple-scan.vala:302: Unable to find colord device hpaio:/usb/D
eskjet_F300_series?serial=CN6C7GM0JF04KH: property match 'Serial'='sane:hpaio:/u
sb/Deskjet_F300_series?serial=CN6C7GM0JF04KH' does not exist
[+20.43s] DEBUG: scanner.vala:1514: Requesting redetection of scan devices
[+20.43s] DEBUG: 4:2 does not exist

Revision history for this message
Gary Houston (ghouston) wrote :
Revision history for this message
Gary Houston (ghouston) wrote :

If I start with Ubuntu 16.04, and upgrade the kernel to 4.7.1 from http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.7.1/, then simple-scan still works. But if I upgrade the kernel to 4.8-rc1 from http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.8-rc1/ then it locks up.

Revision history for this message
Gary Houston (ghouston) wrote :

Actually 4.7.10 from http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.7.10/ works too. It's this 4.8 upgrade that breaks something, but only for simple-scan and not xsane.

Revision history for this message
Gary Houston (ghouston) wrote :

The problem doesn't occur with a stock 4.8 kernel built with "make defconfig". It does occur if the timer frequency is changed to 250 from the default of 1000. The Ubuntu config uses 250, but that's nothing new.

The setting can be changed in menuconfig under "Processor type and features", the fields in .config are CONFIG_HZ_250=y and CONFIG_HZ=250 vs CONFIG_HZ_1000=y and CONFIG_HZ=1000.

A stock 4.7-rc7 kernel with the same change doesn't exhibit the problem.

Revision history for this message
Gary Houston (ghouston) wrote :

It was fixed in the 4.9.0-rc2 mainline kernel, with this commit:

commit a8006bd915095c40098bfcb684cc2bdfb414dc0d
Merge: 965c4b7 6bad6bc
Author: Linus Torvalds <email address hidden>
Date: Fri Oct 28 11:26:01 2016 -0700

    Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

    Pull timer fixes from Ingo Molnar:
     "Fix four timer locking races: two were noticed by Linus while
      reviewing the code while chasing for a corruption bug, and two
      from fixing spurious USB timeouts"

    * 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
      timers: Prevent base clock corruption when forwarding
      timers: Prevent base clock rewind when forwarding clock
      timers: Lock base for same bucket optimization
      timers: Plug locking race vs. timer migration

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.