Weird oops in wiphy_update_regulatory after having loaded ath5k (on latest git)

Weird oops in wiphy_update_regulatory after having loaded ath5k (on latest git)

[Alan Jenkins]

Hi, while testing latest Git (i.e. 2.6.30-rc1 + a bit), I hit a bug 
which killed my keyboard.  SysRQ keys worked, but I couldn't type in X 
or on the console.  I've not been able to reproduce it so far.  After 
rebooting, I extracted the following from syslog:

[    4.513996] usual_tables: module license 'unspecified' taints kernel.
(this is a libusual bug - I am *not* using proprietary modules)

[  214.739245] cfg80211: Using static regulatory domain info
[  214.739255] cfg80211: Regulatory domain: US
[  214.739261]       (start_freq - end_freq @ bandwidth), 
(max_antenna_gain, max_eirp)
[  214.739272]       (2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 
2700 mBm)
[  214.739282]       (5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 
2300 mBm)
[  214.739292]       (5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 
2300 mBm)
[  214.739302]       (5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 
2300 mBm)
[  214.739312]       (5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 
2300 mBm)
[  214.739322]       (5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 
3000 mBm)
[  214.821571] ath5k 0000:01:00.0: enabling device (0000 -> 0002)
[  214.821598] ath5k 0000:01:00.0: PCI INT A -> GSI 18 (level, low) -> 
IRQ 18
[  214.821740] ath5k 0000:01:00.0: registered as 'phy0'
[  214.889455] *pdpt = 00000000120b3001 *pde = 0000000000000000
[  214.889485] Modules linked in: ath5k(+) mac80211 led_class cfg80211 
cpufreq_stats freq_table i915 drm i2c_algo_bit cfbcopyarea cfbimgblt 
cfbfillrect ipv6 rfkill_input joydev usual_tables(P) 
snd_hda_codec_realtek snd_hda_intel snd_hda_codec snd_hwdep uhci_hcd 
snd_pcm_oss snd_mixer_oss ehci_hcd i2c_i801 psmouse pcspkr snd_pcm 
intel_agp i2c_core serio_raw atl2 snd_timer agpgart usbcore 
snd_page_alloc video output eeepc_laptop backlight ac battery rfkill 
button processor evdev thermal fan ata_generic
[  214.889594]
[  214.889604] Pid: 2881, comm: modprobe Tainted: P           
(2.6.30-rc1eeepc #112) 701
[  214.889615] EIP: 0060:[<e01e9332>] EFLAGS: 00010246 CPU: 0
[  214.889641] EIP is at wiphy_update_regulatory+0x20f/0x295 [cfg80211]
[  214.889650] EAX: 00000000 EBX: d21d0000 ECX: 00000000 EDX: d21d0060
[  214.889660] ESI: 0000001a EDI: d21d0060 EBP: d2103d70 ESP: d2103d40
[  214.889669]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[  214.889692]  d2103d90 d21d0060 c04277e0 00000001 00000044 c04277e4 
d21d006000000002
[  214.890293] ---[ end trace 38a1eb1e36762638 ]---

This happened when ath5k was loaded dynamically, in response to my 
pressing the "wireless toggle" key.  (rfkill-input -> eeepc-laptop, 
which does weird acpi-driven PCI hotplug).

Can anyone at least explain where this weird backtrace comes from?  It 
doesn't look like a normal OOPS or BUG, and it doesn't even seem to have 
a proper backtrace.

Thanks!
Alan

BUG in wiphy_update_regulatory when loading ath5k (on latest git)

[Alan Jenkins]

Alan Jenkins wrote:
> Hi, while testing latest Git (i.e. 2.6.30-rc1 + a bit), I hit a bug 
> which killed my keyboard.  SysRQ keys worked, but I couldn't type in X 
> or on the console.

> This happened when ath5k was loaded dynamically, in response to my 
> pressing the "wireless toggle" key.  (rfkill-input -> eeepc-laptop, 
> which does weird acpi-driven PCI hotplug).
>
> Can anyone at least explain where this weird backtrace comes from?

Scratch that.  I was able to reproduce it once and get a proper dmesg.  
My logs were just dropping all the useful bits.  Here it is (taint is 
due to a libusual bug, note usual-tables(P) in list of modules, no 
binary crap here, honest).

[   64.995032] ath5k 0000:01:00.0: registered as 'phy0'
[   65.062652] BUG: unable to handle kernel NULL pointer dereference at 
00000004
[   65.062665] IP: [<e0171332>] wiphy_update_regulatory+0x20f/0x295 
[cfg80211]
[   65.062705] *pdpt = 0000000008bf1001 *pde = 0000000000000000
[   65.062717] Oops: 0000 [#1]
[   65.062724] last sysfs file: /sys/class/backlight/eeepc/brightness
[   65.062734] Modules linked in: ath5k(+) mac80211 led_class cfg80211 
i915 drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect ipv6 
rfkill_input joydev usual_tables(P) snd_hda_codec_realtek snd_hda_intel 
snd_hda_codec snd_hwdep uhci_hcd snd_pcm_oss snd_mixer_oss i2c_i801 
ehci_hcd psmouse serio_raw i2c_core pcspkr atl2 snd_pcm intel_agp 
snd_timer usbcore agpgart eeepc_laptop snd_page_alloc ac video backlight 
output battery rfkill button processor evdev thermal fan ata_generic
[   65.062839]
[   65.062849] Pid: 2909, comm: modprobe Tainted: P           
(2.6.30-rc1eeepc #112) 701
[   65.062860] EIP: 0060:[<e0171332>] EFLAGS: 00010246 CPU: 0
[   65.062885] EIP is at wiphy_update_regulatory+0x20f/0x295 [cfg80211]
[   65.062894] EAX: 00000000 EBX: c5da0000 ECX: 00000000 EDX: c5da0060
[   65.062904] ESI: 0000001a EDI: c5da0060 EBP: df3bdd70 ESP: df3bdd40
[   65.062913]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
[   65.062923] Process modprobe (pid: 2909, ti=df3bc000 task=c5d03000 
task.ti=df3bc000)
[   65.062930] Stack:
[   65.062935]  df3bdd90 c5da0060 c04277e0 00000001 00000044 c04277e4 
c5da0060 00000002
[   65.062953]  00000002 c5da0000 0000001a c5da0060 df3bdda8 e01706a2 
00000002 00000002
[   65.062971]  00000282 000080d0 00000068 c5d53500 00000080 00000282 
00000080 c5da0140
[   65.062991] Call Trace:
[   65.062999]  [<e01706a2>] ? wiphy_register+0x122/0x1b7 [cfg80211]
[   65.063028]  [<e0328e02>] ? ieee80211_register_hw+0xd8/0x346 [mac80211]
[   65.063069]  [<e06a7c9f>] ? ath5k_hw_set_bssid_mask+0x71/0x78 [ath5k]
[   65.063099]  [<e06b0c52>] ? ath5k_pci_probe+0xa5c/0xd0a [ath5k]
[   65.063126]  [<c01a6037>] ? sysfs_find_dirent+0x16/0x27
[   65.063146]  [<c01fec95>] ? local_pci_probe+0xe/0x10
[   65.063162]  [<c01ff526>] ? pci_device_probe+0x48/0x66
[   65.063176]  [<c024c9fd>] ? driver_probe_device+0x7f/0xf2
[   65.063193]  [<c024cab3>] ? __driver_attach+0x43/0x5f
[   65.063205]  [<c024c0af>] ? bus_for_each_dev+0x39/0x5a
[   65.063217]  [<c024c8d0>] ? driver_attach+0x14/0x16
[   65.063228]  [<c024ca70>] ? __driver_attach+0x0/0x5f
[   65.063240]  [<c024c5b3>] ? bus_add_driver+0xd7/0x1e7
[   65.063252]  [<c024ccb9>] ? driver_register+0x7b/0xd7
[   65.063272]  [<c01ff827>] ? __pci_register_driver+0x32/0x85
[   65.063286]  [<e00a8018>] ? init_ath5k_pci+0x18/0x30 [ath5k]
[   65.063309]  [<c0101131>] ? _stext+0x49/0x10b
[   65.063322]  [<e00a8000>] ? init_ath5k_pci+0x0/0x30 [ath5k]
[   65.063330]  [<c012f452>] ? __blocking_notifier_call_chain+0x40/0x4c
[   65.063330]  [<c013a714>] ? sys_init_module+0x87/0x18b
[   65.063330]  [<c0102804>] ? sysenter_do_call+0x12/0x22
[   65.063330] Code: b8 da 17 e0 83 c0 04 e8 92 f9 ff ff 84 c0 75 2a 8b 
55 d4 8b 42 28 85 c0 74 0c 83 c0 04 e8 7c f9 ff ff 84 c0 75 14 a1 bc da 
17 e0 <83> 78 04 03 74 66 8b 4d d4 80 79 08 00 74 5d a1 e0 d2 17 e0 48
[   65.063330] EIP: [<e0171332>] wiphy_update_regulatory+0x20f/0x295 
[cfg80211] SS:ESP 0068:df3bdd40
[   65.063330] CR2: 0000000000000004
[   65.063543] ---[ end trace 830f2dd2a95fd1a8 ]---

I had a look on kerneloops and found a recent bug in the same function, 
I wonder if it is related (bugzilla.kernel.org/show_bug.cgi?id=12456).

It's _probably_ a regression; I've been using the wireless-toggle button 
quite a bit previouslly, on 2.6.29-rc8.

Thanks in advance
Alan

--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: BUG in wiphy_update_regulatory when loading ath5k (on latest git)

[Luis R. Rodriguez]

On Fri, Apr 10, 2009 at 09:18:23AM -0700, Alan Jenkins wrote:
> Alan Jenkins wrote:
> > Hi, while testing latest Git (i.e. 2.6.30-rc1 + a bit), I hit a bug
> > which killed my keyboard.  SysRQ keys worked, but I couldn't type in X
> > or on the console.
> 
> > This happened when ath5k was loaded dynamically, in response to my
> > pressing the "wireless toggle" key.  (rfkill-input -> eeepc-laptop,
> > which does weird acpi-driven PCI hotplug).
> >
> > Can anyone at least explain where this weird backtrace comes from?
> 
> Scratch that.  I was able to reproduce it once and get a proper dmesg.
> My logs were just dropping all the useful bits.  Here it is (taint is
> due to a libusual bug, note usual-tables(P) in list of modules, no
> binary crap here, honest).
> 
> [   64.995032] ath5k 0000:01:00.0: registered as 'phy0'
> [   65.062652] BUG: unable to handle kernel NULL pointer dereference at
> 00000004
> [   65.062665] IP: [<e0171332>] wiphy_update_regulatory+0x20f/0x295
> [cfg80211]
> [   65.062705] *pdpt = 0000000008bf1001 *pde = 0000000000000000
> [   65.062717] Oops: 0000 [#1]
> [   65.062724] last sysfs file: /sys/class/backlight/eeepc/brightness
> [   65.062734] Modules linked in: ath5k(+) mac80211 led_class cfg80211
> i915 drm i2c_algo_bit cfbcopyarea cfbimgblt cfbfillrect ipv6
> rfkill_input joydev usual_tables(P) snd_hda_codec_realtek snd_hda_intel
> snd_hda_codec snd_hwdep uhci_hcd snd_pcm_oss snd_mixer_oss i2c_i801
> ehci_hcd psmouse serio_raw i2c_core pcspkr atl2 snd_pcm intel_agp
> snd_timer usbcore agpgart eeepc_laptop snd_page_alloc ac video backlight
> output battery rfkill button processor evdev thermal fan ata_generic
> [   65.062839]
> [   65.062849] Pid: 2909, comm: modprobe Tainted: P
> (2.6.30-rc1eeepc #112) 701
> [   65.062860] EIP: 0060:[<e0171332>] EFLAGS: 00010246 CPU: 0
> [   65.062885] EIP is at wiphy_update_regulatory+0x20f/0x295 [cfg80211]
> [   65.062894] EAX: 00000000 EBX: c5da0000 ECX: 00000000 EDX: c5da0060
> [   65.062904] ESI: 0000001a EDI: c5da0060 EBP: df3bdd70 ESP: df3bdd40
> [   65.062913]  DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
> [   65.062923] Process modprobe (pid: 2909, ti=df3bc000 task=c5d03000
> task.ti=df3bc000)
> [   65.062930] Stack:
> [   65.062935]  df3bdd90 c5da0060 c04277e0 00000001 00000044 c04277e4
> c5da0060 00000002
> [   65.062953]  00000002 c5da0000 0000001a c5da0060 df3bdda8 e01706a2
> 00000002 00000002
> [   65.062971]  00000282 000080d0 00000068 c5d53500 00000080 00000282
> 00000080 c5da0140
> [   65.062991] Call Trace:
> [   65.062999]  [<e01706a2>] ? wiphy_register+0x122/0x1b7 [cfg80211]
> [   65.063028]  [<e0328e02>] ? ieee80211_register_hw+0xd8/0x346 [mac80211]
> [   65.063069]  [<e06a7c9f>] ? ath5k_hw_set_bssid_mask+0x71/0x78 [ath5k]
> [   65.063099]  [<e06b0c52>] ? ath5k_pci_probe+0xa5c/0xd0a [ath5k]
> [   65.063126]  [<c01a6037>] ? sysfs_find_dirent+0x16/0x27
> [   65.063146]  [<c01fec95>] ? local_pci_probe+0xe/0x10
> [   65.063162]  [<c01ff526>] ? pci_device_probe+0x48/0x66
> [   65.063176]  [<c024c9fd>] ? driver_probe_device+0x7f/0xf2
> [   65.063193]  [<c024cab3>] ? __driver_attach+0x43/0x5f
> [   65.063205]  [<c024c0af>] ? bus_for_each_dev+0x39/0x5a
> [   65.063217]  [<c024c8d0>] ? driver_attach+0x14/0x16
> [   65.063228]  [<c024ca70>] ? __driver_attach+0x0/0x5f
> [   65.063240]  [<c024c5b3>] ? bus_add_driver+0xd7/0x1e7
> [   65.063252]  [<c024ccb9>] ? driver_register+0x7b/0xd7
> [   65.063272]  [<c01ff827>] ? __pci_register_driver+0x32/0x85
> [   65.063286]  [<e00a8018>] ? init_ath5k_pci+0x18/0x30 [ath5k]
> [   65.063309]  [<c0101131>] ? _stext+0x49/0x10b
> [   65.063322]  [<e00a8000>] ? init_ath5k_pci+0x0/0x30 [ath5k]
> [   65.063330]  [<c012f452>] ? __blocking_notifier_call_chain+0x40/0x4c
> [   65.063330]  [<c013a714>] ? sys_init_module+0x87/0x18b
> [   65.063330]  [<c0102804>] ? sysenter_do_call+0x12/0x22
> [   65.063330] Code: b8 da 17 e0 83 c0 04 e8 92 f9 ff ff 84 c0 75 2a 8b
> 55 d4 8b 42 28 85 c0 74 0c 83 c0 04 e8 7c f9 ff ff 84 c0 75 14 a1 bc da
> 17 e0 <83> 78 04 03 74 66 8b 4d d4 80 79 08 00 74 5d a1 e0 d2 17 e0 48
> [   65.063330] EIP: [<e0171332>] wiphy_update_regulatory+0x20f/0x295


What do you mean by you 2.6.30-rc1 + a bit. Are you using an unmodified
wireless-testing or are you applying patches on top?

Whip out gdb as follows:

gdb net/wireless/cfg80211.ko

Then do:

l *(wiphy_update_regulatory+0x20f)

That should show you the culprit line.

  Luis