From: Ben Greear <greearb@candelatech.com>
To: "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
Subject: Crash in cfg80211_unlink_bss
Date: Wed, 06 Oct 2010 10:28:49 -0700 [thread overview]
Message-ID: <4CACB1D1.7090900@candelatech.com> (raw)
This test scenario has 72 stations on ath5k trying to connect to a cisco AP
that supposedly only supports 63 stations.
The 72 STA were created without ssid's configured, then we re-configured all
72 'at once' to give them the proper SSID (ifdown, ifup, iwconfig to set values).
The system crashed and rebooted.
Kernel is wireless-testing as of later yesterday, with a few additional
patches mostly dealing with counters in /proc/net/wireless and some lockdep
fixes pulled in from lkml etc.
We have seen this before, but this is the first good stacktrace we got.
Likely we can reproduce this if extra information is needed.
------------[ cut here ]------------
WARNING: at /home/greearb/git/linux.wireless-testing/lib/list_debug.c:48 list_del+0x24/0xab()
Hardware name: PDSM4+
list_del corruption, next is LIST_POISON1 (00100100)
Modules linked in: xt_CT iptable_raw ipt_addrtype xt_DSCP xt_dscp xt_string xt_owner xt_NFQUEUE xt_multiport xt_mark xt_ipra]
Pid: 27077, comm: kworker/u:1 Not tainted 2.6.36-rc6-wl+ #6
Call Trace:
[<c04345cb>] warn_slowpath_common+0x65/0x7a
[<c058f3c8>] ? list_del+0x24/0xab
[<c0434644>] warn_slowpath_fmt+0x26/0x2a
[<c058f3c8>] list_del+0x24/0xab
[<fac52fed>] cfg80211_unlink_bss+0x4e/0x7d [cfg80211]
[<fb8aa464>] ieee80211_work_work+0x562/0xcfa [mac80211]
[<c0443cea>] ? process_one_work+0x145/0x295
[<c0443d34>] process_one_work+0x18f/0x295
[<c0443cea>] ? process_one_work+0x145/0x295
[<fb8a9f02>] ? ieee80211_work_work+0x0/0xcfa [mac80211]
[<c044535d>] worker_thread+0xf9/0x1b8
[<c0445264>] ? worker_thread+0x0/0x1b8
[<c0447ca7>] kthread+0x62/0x67
[<c0447c45>] ? kthread+0x0/0x67
[<c0403506>] kernel_thread_helper+0x6/0x1a
---[ end trace 378943e5dc829f28 ]---
BUG: unable to handle kernel paging request at 00200200
IP: [<c058f3f8>] list_del+0x54/0xab
*pde = 00000000
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
last sysfs file: /sys/devices/pci0000:00/0000:00:01.0/0000:01:00.2/0000:03:01.0/ieee80211/phy0/macaddress
Modules linked in: xt_CT iptable_raw ipt_addrtype xt_DSCP xt_dscp xt_string xt_owner xt_NFQUEUE xt_multiport xt_mark xt_ipra]
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
next reply other threads:[~2010-10-06 17:28 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-10-06 17:28 Ben Greear [this message]
2010-10-06 18:04 ` Crash in cfg80211_unlink_bss Johannes Berg
2010-10-06 18:08 ` Ben Greear
2010-10-06 18:16 ` Johannes Berg
2010-10-06 18:20 ` Ben Greear
2010-10-06 19:14 ` Ben Greear
2010-10-06 19:19 ` Johannes Berg
2010-10-06 18:11 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4CACB1D1.7090900@candelatech.com \
--to=greearb@candelatech.com \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).