sys-usb vm kernel pancis when trying to pass bluetooth to a different vm

[joyfulmantis]

Qubes OS version (e.g., R3.2):

R3.2

Affected TemplateVMs (e.g., fedora-23, if applicable):

debian-9

---

Expected behavior:

The usb bluetooth device to be successfully passed to the target vm

Actual behavior:

sys-usb (the usb vm) kernel panics

Steps to reproduce the behavior:

Try to pass a bluetooth usb device to a vm using qvm-usb

General notes:

qvm-usb -l
sys-usb:2-1.2 13d3:3315 Broadcom_Corp_Bluetooth_module_74F06DEF963D

sys-usb relevant portion of log:
[494976.832111] usbip-host 2-1.2: usbip-host: register new device (bus 2 dev 3)
[494976.844866] usbip-host 2-1.2: stub up
[494977.166654] usbip-host 2-1.2: endpoint 0 is stalled
[494977.168237] usbip-host 2-1.2: endpoint 0 is stalled
[494977.169301] usbip-host 2-1.2: endpoint 0 is stalled
[494980.274048] usbip-host 2-1.2: unlink urb ffff880014524b40
[494980.276225] usbip-host 2-1.2: unlinked by a call to usb_unlink_urb()
[494980.277036] usbip-host 2-1.2: unlink urb ffff880014524a80
[494980.277503] usbip-host 2-1.2: unlinked by a call to usb_unlink_urb()
[494980.278200] usbip-host 2-1.2: unlink urb ffff880014524480
[494980.278676] usbip-host 2-1.2: unlinked by a call to usb_unlink_urb()
[494981.844300] BUG: unable to handle kernel paging request at 000002910101046c
[494981.844331] IP: [] __kmalloc_node_track_caller+0x1ca/0x310
[494981.844357] PGD 0
[494981.844371] Oops: 0000 [#1] SMP
[494981.844385] Modules linked in: xhci_pci xhci_hcd ehci_pci ehci_hcd btusb hidp uas usb_storage usbip_host usbip_core bnep xt_REDIRECT nf_nat_redirect xt_nat xen_netback ip6table_filter ip6_tables xt_conntrack ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack btrtl btbcm btintel bluetooth rfkill intel_rapl iosf_mbi x86_pkg_temp_thermal coretemp snd_pcm snd_timer crct10dif_pclmul crc32_pclmul crc32c_intel snd soundcore pcspkr xen_pcifront dummy_hcd udc_core u2mfn(O) xen_blkback parport_pc ppdev lp parport xenfs sunrpc xen_privcmd xen_blkfront [last unloaded: xhci_hcd]
[494981.844577] CPU: 0 PID: 1 Comm: systemd Tainted: G O 4.4.38-11.pvops.qubes.x86_64 #1
[494981.844602] task: ffff88001d998000 ti: ffff88001da10000 task.ti: ffff88001da10000
[494981.844625] RIP: e030:[] [] __kmalloc_node_track_caller+0x1ca/0x310
[494981.844655] RSP: e02b:ffff88001da13a90 EFLAGS: 00010246
[494981.844671] RAX: 000002910101046c RBX: 00000000024106c0 RCX: ffffffff8162b5d7
[494981.844691] RDX: 000000000002f518 RSI: 0000000000000000 RDI: 000000000001a1e0
[494981.844711] RBP: ffff88001da13ae0 R08: ffff88001f81a1e0 R09: ffff88001d801400
[494981.844732] R10: ffff88001d801400 R11: 000002910101046c R12: 00000000024106c0
[494981.844754] R13: 0000000000000540 R14: 00000000ffffffff R15: 00000000ffffffff
[494981.844785] FS: 00007f731cb6c940(0000) GS:ffff88001f800000(0000) knlGS:0000000000000000
[494981.844808] CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[494981.844823] CR2: 000002910101046c CR3: 000000000260e000 CR4: 0000000000042660
[494981.844847] Stack:
[494981.844858] ffffea0000320240 00000000024004c0 00000000ffffffff ffff88001d801400
[494981.844887] ffffffff8162b5d7 ffff88000c935400 ffff88001da13b3f 00000000024004c0
[494981.844915] 0000000000000540 00000000ffffffff ffff88001da13b20 ffffffff8162a601
[494981.844943] Call Trace:
[494981.844963] [] ? __alloc_skb+0x87/0x1f0
[494981.844981] [] __kmalloc_reserve.isra.32+0x31/0x90
[494981.845005] [] ? __alloc_skb+0x5b/0x1f0
[494981.845011] [] __alloc_skb+0x87/0x1f0
[494981.845011] [] alloc_skb_with_frags+0x5a/0x1e0
[494981.845011] [] sock_alloc_send_pskb+0x1e2/0x210
[494981.845011] [] ? _raw_spin_unlock_irqrestore+0x1a/0x20
[494981.845011] [] ? __wake_up_sync_key+0x50/0x60
[494981.845011] [] ? wait_for_unix_gc+0x36/0xb0
[494981.845011] [] unix_stream_sendmsg+0x28c/0x3e0
[494981.845011] [] sock_sendmsg+0x38/0x50
[494981.845011] [] ___sys_sendmsg+0x281/0x290
[494981.845011] [] ? call_rcu_sched+0x1d/0x20
[494981.845011] [] ? release_task+0x36b/0x460
[494981.845011] [] ? __raw_callee_save___pv_queued_spin_unlock+0x11/0x20
[494981.845011] [] ? _raw_spin_unlock_irqrestore+0x1a/0x20
[494981.845011] [] ? remove_wait_queue+0x30/0x40
[494981.845011] [] ? do_wait+0x116/0x240
[494981.845011] [] __sys_sendmsg+0x51/0x90
[494981.845011] [] SyS_sendmsg+0x12/0x20
[494981.845011] [] entry_SYSCALL_64_fastpath+0x12/0x71
[494981.845011] Code: 48 89 da 48 8b 75 d0 41 ff d2 4d 8b 17 4d 85 d2 75 d8 e9 2c ff ff ff 49 63 42 20 49 8b 3a 4c 01 d8 40 f6 c7 0f 0f 85 33 01 00 00 <48> 8b 18 48 8d 4a 01 4c 89 d8 65 48 0f c7 0f 0f 94 c0 84 c0 0f
[494981.845378] RIP [] __kmalloc_node_track_caller+0x1ca/0x310
[494981.845378] RSP
[494981.845378] CR2: 000002910101046c
[494981.845621] ---[ end trace e0046dc5aebfea70 ]---
[494981.849248] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
[494981.849248]
[494981.849292] Kernel Offset: disabled

---

Related issues:

[meskio]

I also have this issue, both using fedora-23 and debian-8 templates. I did try to unload all bluetooth related modules and kill bluetoothd but I got the same Kernel panic.

[meskio]

I also have this issue, both using fedora-23 and debian-8 templates. I did try to unload all bluetooth related modules and kill bluetoothd but I got the same Kernel panic.