[ath9k-devel] 2.6.27-rc5 + w1.fi patches = crash (No ProbeResp + WARNING: at kernel/softirq.c:136)

[ath9k-devel] 2.6.27-rc5 + w1.fi patches = crash (No ProbeResp + WARNING: at kernel/softirq.c:136)

[Mats Johannesson]

Good morning,

Plain kernel 2.6.27-rc5 (as well as -rc4 and -rc3) works very well, but
applying the http://w1.fi/wireless-testing/ patches dated 28-Aug-2008
05:09 as per the "series" file (only those marked as "Submitted for
inclusion; no known open issues") cause a disconnect after some minutes
and throws a kernel warning. After that, the link is dead.

Most of the patches applied without issues (mac80211_iwassocreqie.patch
FAILED because it already was in -rc5 and
mac80211_fix_debugfs_netdev.patch was successfully detected as being in
-rc5) and the two which applied with a slight fuzz I checked manually
afterwards.

I didn't have anything 'debug' enabled (and environment is tainted by
the nvidia binary blob) so the kernel messages probably have little
value. If you want me to conduct pure experiments with debug settings
and the 'clean' nv X driver please advice a viable course.

PCCard is a D-Link DWA-652 and the router D-Link DIR-655 (in 11n-only
mode with WPA2 Only, AES Cipher - Using Channel 1)

Here's an example of the - probably linewrapped - kernel log:

Aug 29 04:04:14 sleipner kernel: ath9k 0000:02:00.0: enabling device (0000 -> 0002)
Aug 29 04:04:14 sleipner kernel: ath9k 0000:02:00.0: PCI INT A -> GSI 17 (level, low) -> IRQ 17
Aug 29 04:04:14 sleipner kernel: phy0: Selected rate control algorithm 'ath9k_rate_control'
Aug 29 04:04:14 sleipner kernel: Registered led device: ath9k-phy0:radio
Aug 29 04:04:14 sleipner kernel: Registered led device: ath9k-phy0:assoc
Aug 29 04:04:14 sleipner kernel: Registered led device: ath9k-phy0:tx
Aug 29 04:04:14 sleipner kernel: Registered led device: ath9k-phy0:rx
Aug 29 04:04:14 sleipner kernel: phy0: Atheros 5416: mem=0xffffc20000100000, irq=17
[...]
Aug 29 04:04:19 sleipner kernel: ADDRCONF(NETDEV_UP): ath0: link is not ready
[...]
Aug 29 04:04:21 sleipner kernel: ADDRCONF(NETDEV_UP): ath0: link is not ready
Aug 29 04:04:21 sleipner kernel: warning: `dhclient' uses 32-bit capabilities (legacy support in use)
Aug 29 04:04:22 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 04:04:22 sleipner kernel: ath0: authenticated
Aug 29 04:04:22 sleipner kernel: ath0: associate with AP 00:1b:11:60:7a:3d
Aug 29 04:04:22 sleipner kernel: ath0: RX AssocResp from 00:1b:11:60:7a:3d (capab=0x431 status=0 aid=1)
Aug 29 04:04:22 sleipner kernel: ath0: associated
Aug 29 04:04:22 sleipner kernel: ADDRCONF(NETDEV_CHANGE): ath0: link becomes ready
Aug 29 04:04:22 sleipner kernel: Clocksource tsc unstable (delta = -83697879 ns)
Aug 29 04:04:32 sleipner kernel: ath0: no IPv6 routers present
Aug 29 04:07:28 sleipner kernel: ath0: No ProbeResp from current AP 00:1b:11:60:7a:3d - assume out of range
Aug 29 04:07:28 sleipner kernel: ------------[ cut here ]------------
Aug 29 04:07:28 sleipner kernel: WARNING: at kernel/softirq.c:136 ()
Aug 29 04:07:28 sleipner kernel: Modules linked in: aes_x86_64 aes_generic snd_rtctimer cpufreq_userspace cpufreq_stats powernow_k8 freq_table wacom fan dock sbp2 scsi_mod lp arc4 ecb crypto_blkcipher cryptomgr crypto_algapi ath9k mac80211 cfg80211 pcmcia snd_via82xx snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_page_alloc snd_mpu401_uart snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq k8temp ehci_hcd snd_timer nvidia(P) via_ircc snd_seq_device hwmon ohci1394 thermal yenta_socket irda snd r8169 ieee1394 uhci_hcd soundcore bitrev crc32 crc_ccitt usbcore rsrc_nonstatic agpgart pcmcia_core ac processor battery wmi button thermal_sys evdev
Aug 29 04:07:28 sleipner kernel: Pid: 1011, comm: ath9k Tainted: P          2.6.27-rc5-w1fi #1
Aug 29 04:07:28 sleipner kernel: 
Aug 29 04:07:28 sleipner kernel: Call Trace:
Aug 29 04:07:28 sleipner kernel:  [enqueue_hrtimer+215/228] 0xffffffff8023bb9b
Aug 29 04:07:28 sleipner kernel:  [warn_on_slowpath+65/101] 0xffffffff802279d4
Aug 29 04:07:28 sleipner kernel:  [check_preempt_wakeup+280/291] 0xffffffff80224d82
Aug 29 04:07:28 sleipner kernel:  [try_to_wake_up+180/196] 0xffffffff80223d8a
Aug 29 04:07:28 sleipner kernel:  [_end+539790570/2131057432] 0xffffffffa08731d2
Aug 29 04:07:28 sleipner kernel:  [local_bh_enable+60/171] 0xffffffff8022c369
Aug 29 04:07:28 sleipner kernel:  [_end+539771506/2131057432] 0xffffffffa086e75a
Aug 29 04:07:28 sleipner kernel:  [_end+539798936/2131057432] 0xffffffffa0875280
Aug 29 04:07:28 sleipner kernel:  [_end+539769783/2131057432] 0xffffffffa086e09f
Aug 29 04:07:28 sleipner kernel:  [queue_work+69/73] 0xffffffff802367d0
Aug 29 04:07:28 sleipner kernel:  [_end+539669908/2131057432] 0xffffffffa0855a7c
Aug 29 04:07:28 sleipner kernel:  [_end+539609138/2131057432] 0xffffffffa0846d1a
Aug 29 04:07:28 sleipner kernel:  [_end+539611305/2131057432] 0xffffffffa0847591
Aug 29 04:07:28 sleipner kernel:  [_end+539628307/2131057432] 0xffffffffa084b7fb
Aug 29 04:07:28 sleipner kernel:  [_end+539641110/2131057432] 0xffffffffa084e9fe
Aug 29 04:07:28 sleipner kernel:  [dequeue_task+87/98] 0xffffffff80221edc
Aug 29 04:07:28 sleipner kernel:  [thread_return+48/169] 0xffffffff80468a28
Aug 29 04:07:28 sleipner kernel:  [_end+539639816/2131057432] 0xffffffffa084e4f0
Aug 29 04:07:28 sleipner kernel:  [run_workqueue+177/363] 0xffffffff802363aa
Aug 29 04:07:28 sleipner kernel:  [worker_thread+208/219] 0xffffffff80236cc2
Aug 29 04:07:28 sleipner kernel:  [autoremove_wake_function+0/46] 0xffffffff80239727
Aug 29 04:07:28 sleipner kernel:  [worker_thread+0/219] 0xffffffff80236bf2
Aug 29 04:07:28 sleipner kernel:  [kthread+71/117] 0xffffffff80239622
Aug 29 04:07:28 sleipner kernel:  [schedule_tail+24/80] 0xffffffff80223201
Aug 29 04:07:28 sleipner kernel:  [child_rip+10/17] 0xffffffff8020bc19
Aug 29 04:07:28 sleipner kernel:  [kthread+0/117] 0xffffffff802395db
Aug 29 04:07:28 sleipner kernel:  [child_rip+0/17] 0xffffffff8020bc0f
Aug 29 04:07:28 sleipner kernel: 
Aug 29 04:07:28 sleipner kernel: ---[ end trace 2bb316cdf96c9873 ]---
Aug 29 04:07:28 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 04:07:29 sleipner last message repeated 2 times
Aug 29 04:07:29 sleipner kernel: ath0: authentication with AP 00:1b:11:60:7a:3d timed out
Aug 29 04:07:41 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 04:07:41 sleipner last message repeated 2 times
Aug 29 04:07:41 sleipner kernel: ath0: authentication with AP 00:1b:11:60:7a:3d timed out
Aug 29 04:07:52 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 04:07:52 sleipner last message repeated 2 times

Mvh
Mats Johannesson

[ath9k-devel] 2.6.27-rc5 + w1.fi patches = crash (No ProbeResp + WARNING: at kernel/softirq.c:136)

[Jouni Malinen]

On Aug 29, 2008, at 9:32 AM, Mats Johannesson wrote:

> Plain kernel 2.6.27-rc5 (as well as -rc4 and -rc3) works very well,  
> but
> applying the http://w1.fi/wireless-testing/ patches dated 28-Aug-2008
> 05:09 as per the "series" file (only those marked as "Submitted for
> inclusion; no known open issues") cause a disconnect after some  
> minutes
> and throws a kernel warning. After that, the link is dead.

One thing to keep in mind with those patches is that they are against  
wireless-testing tree, not Linus git tree. I haven't looked how  
different mac80211 and ath9k are between those trees, but there may  
be differences (more likely in mac80211) that can cause issues.

> Most of the patches applied without issues  
> (mac80211_iwassocreqie.patch
> FAILED because it already was in -rc5 and
> mac80211_fix_debugfs_netdev.patch was successfully detected as  
> being in
> -rc5) and the two which applied with a slight fuzz I checked manually
> afterwards.

wireless-testing has been a bit behind over the past weeks, but it  
was updated yesterday (to rc4 or somewhere between rc4 and rc5) and I  
updated the patch series based on that.

> I didn't have anything 'debug' enabled (and environment is tainted by
> the nvidia binary blob) so the kernel messages probably have little
> value. If you want me to conduct pure experiments with debug settings
> and the 'clean' nv X driver please advice a viable course.

Would you be able to easily test whether you'll get the same problem  
with wireless-testing plus the patches from w1.fi? I'm currently  
running that on my laptop and haven't been able to reproduce this  
issue so far. Did you do anything special with the connection when  
the issue showed up?

> Aug 29 04:07:28 sleipner kernel: WARNING: at kernel/softirq.c:136 ()

That's WARN_ON_ONCE(in_irq() || irqs_disabled()) in  
_local_bh_enable_ip(). The call trace did not show any clear ath9k  
functions, so I'm not sure where exactly this is triggered.

- Jouni

[ath9k-devel] 2.6.27-rc5 + w1.fi patches = crash (No ProbeResp + WARNING: at kernel/softirq.c:136)

[Mats Johannesson]

On Fri, 29 Aug 2008 10:49:43 +0300 Jouni Malinen wrote:
> On Aug 29, 2008, at 9:32 AM, Mats Johannesson wrote:
[...]
> > "Submitted for inclusion; no known open issues") cause a disconnect
> > after some minutes and throws a kernel warning. After that, the
> > link is dead.
> 
> One thing to keep in mind with those patches is that they are
> against wireless-testing tree, not Linus git tree. I haven't looked
> how different mac80211 and ath9k are between those trees, but there
> may be differences (more likely in mac80211) that can cause issues.

Yeah, I was a bit uneasy with the tree separation but felt it better
to shout an "early wolf" (in case the patches have some subtle issues)
than to git-bisect a massive tangle of 2.6.28-WIDE_MERGE_WINDOWS

> > Most of the patches applied without issues
> > (mac80211_iwassocreqie.patch FAILED because it already was in -rc5
> > and mac80211_fix_debugfs_netdev.patch was successfully detected as  
> > being in -rc5) and the two which applied with a slight fuzz I
> > checked manually afterwards.
> 
> wireless-testing has been a bit behind over the past weeks, but it  
> was updated yesterday (to rc4 or somewhere between rc4 and rc5) and
> I updated the patch series based on that.

Someone upstreams cherry-picked the two bad boys then... Not good...

[...] 
> Would you be able to easily test whether you'll get the same problem  
> with wireless-testing plus the patches from w1.fi? I'm currently  
> running that on my laptop and haven't been able to reproduce this  
> issue so far. Did you do anything special with the connection when  
> the issue showed up?

Didn't do more than the usual web-surfing. First disconnect came after
three minutes - rebooted - then disconnect after twelve minutes.

I've been out of the loop for a good while so will need a bit of time
to install git and pull the wireless-testing branch.

> > Aug 29 04:07:28 sleipner kernel: WARNING: at kernel/softirq.c:136 ()
> 
> That's WARN_ON_ONCE(in_irq() || irqs_disabled()) in  
> _local_bh_enable_ip(). The call trace did not show any clear ath9k  
> functions, so I'm not sure where exactly this is triggered.

I'll do my best to get a clean environment with more and better output.
Might as well do that with the -rc5+w1.fi also (though sometimes the
debug stuff hides/eradicates subtle bugs).

Will return,
Mats

[ath9k-devel] 2.6.27-rc5 + w1.fi patches = crash (No ProbeResp + WARNING: at kernel/softirq.c:136)

[Mats Johannesson]

On Fri, 29 Aug 2008 10:49:43 +0300 Jouni Malinen wrote:
> On Aug 29, 2008, at 9:32 AM, Mats Johannesson wrote:
[...]
> > [snip]
> Would you be able to easily test whether you'll get the same problem  
> with wireless-testing plus the patches from w1.fi? I'm currently  
> running that on my laptop and haven't been able to reproduce this  
> issue so far. Did you do anything special with the connection when  
> the issue showed up?

Built wireless-testing and applied w1.fi patches
(mac80211_iwassocreqie.patch and mac80211_fix_debugfs_netdev.patch were
in Linville's tree...)

Used the same .config as with the -rc5 kernel, but turned on
CONFIG_KALLSYMS

Switched to the nv X driver (gods such a slow piece of ... mumble ...)

As with the -rc5+w1.fi combo the wireless-testing+w1.fi show less
sensitivity than a plain -rc5 (I had to rescan with the Wicd Manager to
see my router, -rc5 detects it on boot).

Anyway, below is the result. One difference was that the driver managed
to rise from the dead - but it looked kind of flaky:

Aug 29 13:56:34 sleipner kernel: ADDRCONF(NETDEV_UP): ath0: link is not ready
Aug 29 13:56:34 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 13:56:34 sleipner kernel: ath0: authenticated
Aug 29 13:56:34 sleipner kernel: ath0: associate with AP 00:1b:11:60:7a:3d
Aug 29 13:56:34 sleipner kernel: ath0: RX AssocResp from 00:1b:11:60:7a:3d (capab=0x431 status=0 aid=2)
Aug 29 13:56:34 sleipner kernel: ath0: associated
Aug 29 13:56:34 sleipner kernel: ADDRCONF(NETDEV_CHANGE): ath0: link becomes ready
Aug 29 13:56:35 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 13:56:35 sleipner kernel: ath0: authenticated
Aug 29 13:56:35 sleipner kernel: ath0: associate with AP 00:1b:11:60:7a:3d
Aug 29 13:56:35 sleipner kernel: ath0: RX ReassocResp from 00:1b:11:60:7a:3d (capab=0x431 status=0 aid=2)
Aug 29 13:56:35 sleipner kernel: ath0: associated
Aug 29 13:56:35 sleipner kernel: warning: `dhclient' uses 32-bit capabilities (legacy support in use)
Aug 29 13:56:45 sleipner kernel: ath0: no IPv6 routers present
Aug 29 14:09:53 sleipner kernel: ath0: No ProbeResp from current AP 00:1b:11:60:7a:3d - assume out of range
Aug 29 14:09:53 sleipner kernel: ------------[ cut here ]------------
Aug 29 14:09:53 sleipner kernel: WARNING: at kernel/softirq.c:136 local_bh_enable+0x3c/0xab()
Aug 29 14:09:53 sleipner kernel: Modules linked in: aes_x86_64 aes_generic snd_rtctimer cpufreq_userspace cpufreq_stats powernow_k8 freq_table wacom fan dock sbp2 scsi_mod lp arc4 ecb crypto_blkcipher cryptomgr crypto_algapi ath9k mac80211 cfg80211 pcmcia snd_via82xx snd_ac97_codec ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm snd_page_alloc snd_mpu401_uart snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer snd_seq_device via_ircc k8temp ehci_hcd thermal ohci1394 r8169 snd uhci_hcd irda ieee1394 yenta_socket rsrc_nonstatic hwmon bitrev crc32 crc_ccitt soundcore usbcore pcmcia_core processor ac wmi battery button thermal_sys evdev
Aug 29 14:09:53 sleipner kernel: Pid: 1029, comm: ath9k Not tainted 2.6.27-rc4-wt-w1fi-wl #1
Aug 29 14:09:53 sleipner kernel: 
Aug 29 14:09:53 sleipner kernel: Call Trace:
Aug 29 14:09:53 sleipner kernel:  [<ffffffff802278d8>] warn_on_slowpath+0x51/0x77
Aug 29 14:09:53 sleipner kernel:  [<ffffffff80224c51>] check_preempt_wakeup+0xf3/0x123
Aug 29 14:09:53 sleipner kernel:  [<ffffffff80239658>] autoremove_wake_function+0x9/0x2e
Aug 29 14:09:53 sleipner kernel:  [<ffffffff8022c281>] local_bh_enable+0x3c/0xab
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa01ab75a>] ath_rx_node_cleanup+0x38/0x6e [ath9k]
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa01b2280>] ath_node_detach+0x3b/0xb6 [ath9k]
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa01ab09f>] ath9k_sta_notify+0x12b/0x165 [ath9k]
Aug 29 14:09:53 sleipner kernel:  [<ffffffff802366cf>] queue_work+0x1d/0x49
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa018c3fc>] add_todo+0x70/0x99 [mac80211]
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa017de76>] __sta_info_unlink+0x16b/0x19e [mac80211]
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa017e6ed>] sta_info_unlink+0x18/0x43 [mac80211]
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa0182732>] ieee80211_associated+0xaa/0x16d [mac80211]
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa0184a1a>] ieee80211_sta_work+0x4fb/0x6b4 [mac80211]
Aug 29 14:09:53 sleipner kernel:  [<ffffffff80469c58>] thread_return+0x30/0xa9
Aug 29 14:09:53 sleipner kernel:  [<ffffffffa018451f>] ieee80211_sta_work+0x0/0x6b4 [mac80211]
Aug 29 14:09:53 sleipner kernel:  [<ffffffff802362c2>] run_workqueue+0xb1/0x17a
Aug 29 14:09:53 sleipner kernel:  [<ffffffff80236be9>] worker_thread+0xd0/0xdb
Aug 29 14:09:53 sleipner kernel:  [<ffffffff8023964f>] autoremove_wake_function+0x0/0x2e
Aug 29 14:09:53 sleipner kernel:  [<ffffffff80236b19>] worker_thread+0x0/0xdb
Aug 29 14:09:53 sleipner kernel:  [<ffffffff8023954a>] kthread+0x47/0x75
Aug 29 14:09:53 sleipner kernel:  [<ffffffff80223121>] schedule_tail+0x18/0x50
Aug 29 14:09:53 sleipner kernel:  [<ffffffff8020bc49>] child_rip+0xa/0x11
Aug 29 14:09:53 sleipner kernel:  [<ffffffff80239503>] kthread+0x0/0x75
Aug 29 14:09:53 sleipner kernel:  [<ffffffff8020bc3f>] child_rip+0x0/0x11
Aug 29 14:09:53 sleipner kernel: 
Aug 29 14:09:53 sleipner kernel: ---[ end trace e9bb5da661055827 ]---
Aug 29 14:09:54 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 14:09:54 sleipner last message repeated 3 times
Aug 29 14:09:54 sleipner kernel: ath0: authentication with AP 00:1b:11:60:7a:3d timed out
Aug 29 14:10:06 sleipner kernel: ath0: direct probe to AP 00:1b:11:60:7a:3d try 1
Aug 29 14:10:06 sleipner kernel: ath0: direct probe to AP 00:1b:11:60:7a:3d try 2
Aug 29 14:10:06 sleipner kernel: ath0: direct probe to AP 00:1b:11:60:7a:3d try 3
Aug 29 14:10:06 sleipner kernel: ath0: direct probe to AP 00:1b:11:60:7a:3d timed out
Aug 29 14:10:17 sleipner kernel: ath0 direct probe responded
Aug 29 14:10:17 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 14:10:17 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 14:10:17 sleipner kernel: ath0: authenticated
Aug 29 14:10:17 sleipner kernel: ath0: associate with AP 00:1b:11:60:7a:3d
Aug 29 14:10:17 sleipner kernel: ath0: RX ReassocResp from 00:1b:11:60:7a:3d (capab=0x431 status=0 aid=2)
Aug 29 14:10:17 sleipner kernel: ath0: associated
Aug 29 14:10:18 sleipner kernel: ath0: authenticate with AP 00:1b:11:60:7a:3d
Aug 29 14:10:18 sleipner kernel: ath0: authenticated
Aug 29 14:10:18 sleipner kernel: ath0: associate with AP 00:1b:11:60:7a:3d
Aug 29 14:10:18 sleipner kernel: ath0: RX ReassocResp from 00:1b:11:60:7a:3d (capab=0x431 status=0 aid=2)
Aug 29 14:10:18 sleipner kernel: ath0: associated

Mvh
Mats

[ath9k-devel] 2.6.27-rc5 + w1.fi patches = crash (No ProbeResp + WARNING: at kernel/softirq.c:136)

[Jouni Malinen]

On Aug 29, 2008, at 3:54 PM, Mats Johannesson wrote:

> Built wireless-testing and applied w1.fi patches
> (mac80211_iwassocreqie.patch and mac80211_fix_debugfs_netdev.patch  
> were
> in Linville's tree...)

> As with the -rc5+w1.fi combo the wireless-testing+w1.fi show less
> sensitivity than a plain -rc5 (I had to rescan with the Wicd  
> Manager to
> see my router, -rc5 detects it on boot).

Interesting.. I did not expect there to be changes that would affect  
this type of functionality.

> Anyway, below is the result. One difference was that the driver  
> managed
> to rise from the dead - but it looked kind of flaky:

> Aug 29 14:09:53 sleipner kernel: ath0: No ProbeResp from current AP  
> 00:1b:11:60:7a:3d - assume out of range
> Aug 29 14:09:53 sleipner kernel: ------------[ cut here ]------------
> Aug 29 14:09:53 sleipner kernel: WARNING: at kernel/softirq.c:136  
> local_bh_enable+0x3c/0xab()

> Aug 29 14:09:53 sleipner kernel: Call Trace:
> Aug 29 14:09:53 sleipner kernel:  [<ffffffff802278d8>]  
> warn_on_slowpath+0x51/0x77
> Aug 29 14:09:53 sleipner kernel:  [<ffffffff80224c51>]  
> check_preempt_wakeup+0xf3/0x123
> Aug 29 14:09:53 sleipner kernel:  [<ffffffff80239658>]  
> autoremove_wake_function+0x9/0x2e
> Aug 29 14:09:53 sleipner kernel:  [<ffffffff8022c281>]  
> local_bh_enable+0x3c/0xab
> Aug 29 14:09:53 sleipner kernel:  [<ffffffffa01ab75a>]  
> ath_rx_node_cleanup+0x38/0x6e [ath9k]

Thanks! I believe we were able to reproduce this and found the  
problem. We are working on a suitable fix for it.

- Jouni