rt61pci: oops in rt2x00lib_txdone(), entry->skb is NULL

rt61pci: oops in rt2x00lib_txdone(), entry->skb is NULL

[Pavel Roskin]

Hello!

wireless-testing.git as of yesterday has a problem with rt61pci.  After
a minute of web browsing, the kernel reports an oops in
rt2x00lib_txdone() and no more traffic goes through.  That system used
to run a month old wireless-testing.git identified as 2.6.35-rc6-wl, and
it didn't have that problem.

The oops happens on this line:
enum data_queue_qid qid = skb_get_queue_mapping(entry->skb);

When it happens, entry->skb is NULL.  I cannot reproduce the problem by
ping, even by flood ping, but using a web browser on a moderately
complex site (e.g. cnn.com) triggers the oops reliably within a minute
or so.

The architecture is x86_64, it's a multicore system, SMP is enabled in
the kernel.

If there are no good ideas what it might be, I'll try to find time to
bisect the bug.

-- 
Regards,
Pavel Roskin

Re: rt61pci: oops in rt2x00lib_txdone(), entry->skb is NULL

[Helmut Schaa]

Hi Pavel,

Am Mittwoch 08 September 2010 schrieb Pavel Roskin:
> wireless-testing.git as of yesterday has a problem with rt61pci.  After
> a minute of web browsing, the kernel reports an oops in
> rt2x00lib_txdone() and no more traffic goes through.  That system used
> to run a month old wireless-testing.git identified as 2.6.35-rc6-wl, and
> it didn't have that problem.
> 
> The oops happens on this line:
> enum data_queue_qid qid = skb_get_queue_mapping(entry->skb);
> 
> When it happens, entry->skb is NULL.  I cannot reproduce the problem by
> ping, even by flood ping, but using a web browser on a moderately
> complex site (e.g. cnn.com) triggers the oops reliably within a minute
> or so.
> 
> The architecture is x86_64, it's a multicore system, SMP is enabled in
> the kernel.
> 
> If there are no good ideas what it might be, I'll try to find time to
> bisect the bug.

Seems like this was introduced by "rt2x00: Add helper function for
reporting tx status". At least the last hunk looks suspicious.

Pavel, could you please try this patch?

Thanks,
Helmut

diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 8b67cfd..80f80a0 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -2106,7 +2106,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
 				"TX status report missed for entry %d\n",
 				entry_done->entry_idx);
 
-			rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
+			rt2x00lib_txdone_noinfo(entry_done, TXDONE_UNKNOWN);
 			entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
 		}
 

Re: rt61pci: oops in rt2x00lib_txdone(), entry->skb is NULL

[Ivo Van Doorn]

Hi,

> Am Mittwoch 08 September 2010 schrieb Pavel Roskin:
>> wireless-testing.git as of yesterday has a problem with rt61pci.  After
>> a minute of web browsing, the kernel reports an oops in
>> rt2x00lib_txdone() and no more traffic goes through.  That system used
>> to run a month old wireless-testing.git identified as 2.6.35-rc6-wl, and
>> it didn't have that problem.
>>
>> The oops happens on this line:
>> enum data_queue_qid qid = skb_get_queue_mapping(entry->skb);
>>
>> When it happens, entry->skb is NULL.  I cannot reproduce the problem by
>> ping, even by flood ping, but using a web browser on a moderately
>> complex site (e.g. cnn.com) triggers the oops reliably within a minute
>> or so.
>>
>> The architecture is x86_64, it's a multicore system, SMP is enabled in
>> the kernel.
>>
>> If there are no good ideas what it might be, I'll try to find time to
>> bisect the bug.
>
> Seems like this was introduced by "rt2x00: Add helper function for
> reporting tx status". At least the last hunk looks suspicious.
>
> Pavel, could you please try this patch?
>
> Thanks,
> Helmut
>
> diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
> index 8b67cfd..80f80a0 100644
> --- a/drivers/net/wireless/rt2x00/rt61pci.c
> +++ b/drivers/net/wireless/rt2x00/rt61pci.c
> @@ -2106,7 +2106,7 @@ static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
>                                "TX status report missed for entry %d\n",
>                                entry_done->entry_idx);
>
> -                       rt2x00lib_txdone_noinfo(entry, TXDONE_UNKNOWN);
> +                       rt2x00lib_txdone_noinfo(entry_done, TXDONE_UNKNOWN);
>                        entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
>                }
>

Nice catch, this is indeed an obvious bug :S

Ivo

Re: rt61pci: oops in rt2x00lib_txdone(), entry->skb is NULL

[Pavel Roskin]

Quoting Ivo Van Doorn <ivdoorn@gmail.com>:

> Nice catch, this is indeed an obvious bug :S

The patch is working for me.  Thanks!

-- 
Regards,
Pavel Roskin

Re: rt61pci: oops in rt2x00lib_txdone(), entry->skb is NULL

[Helmut Schaa]

Am Mittwoch 08 September 2010 schrieb Pavel Roskin:
> Quoting Ivo Van Doorn <ivdoorn@gmail.com>:
> 
> > Nice catch, this is indeed an obvious bug :S
> 
> The patch is working for me.  Thanks!

Great, thanks for testing ...