From: Larry Finger <Larry.Finger@lwfinger.net>
To: Christopher Chavez <chrischavez@gmx.us>, linux-wireless@vger.kernel.org
Subject: Re: p54usb kernel panic on recent mainline kernels
Date: Thu, 25 Dec 2014 20:41:28 -0600 [thread overview]
Message-ID: <549CCAD8.70704@lwfinger.net> (raw)
In-Reply-To: <CAAFQ00kq-5+TFkH+i5fMXATxVCy-DeLP4G+D6+dxDSRo-fh6Xw@mail.gmail.com>
On 12/24/2014 10:39 PM, Christopher Chavez wrote:
> When a device using p54usb joins/connects/associates with an access
> point, a kernel panic occurs.
> The AP tested uses WPA2; have not tested whether the issue occurs for
> other security types or ad hoc connections. The specific devices
> tested are 2Wire 802.11g USB v1 (vendor 1630 device 0005). The
> firmware used is 2.13.1.0.lm86.arm (a.k.a. "isl3886usb" recommended on
> wireless.kernel.org). Tested on Ubuntu 14.10, 32-bit x86 (have not
> tested 64-bit or other architectures). Tested on machines with Intel
> and SiS USB chipsets. I can try collecting more info (e.g. dmesg
> output), and am currently bisecting the kernel somewhere around
> 3.17-rc1.
>
> Should this be reported as a kernel bug or with the driver?
It looks as if this is a bug in p54usb. I Think that I have duplicated the
problem. On my system, the crash doesn't happen when it associates, but crashes
when longer packets are transmitted.
I did not get the entire traceback, but I got a reference to p54_tx_80211+0x3de
from p54common.ko. Using gdb to disassemble this reference, the erring code is
as follows:
(gdb) l *p54_tx_80211+0x3de
0x3c9e is in p54_tx_80211 (drivers/net/wireless/p54/txrx.c:913).
908 memcpy(skb_put(skb, 8), &(info->control.hw_key->key
909 [NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY]), 8);
910 }
911 /* reserve some space for ICV */
912 len += info->control.hw_key->icv_len;
913 memset(skb_put(skb, info->control.hw_key->icv_len), 0,
914 info->control.hw_key->icv_len);
915 } else {
916 txhdr->key_type = 0;
917 txhdr->key_len = 0;
At present I do not know why there is a problem with skb_put() here. Perhaps
someone else will know before I find it.
In any case, file a bug report at bugzilla.kernel.org, mark it as a regression,
and post the bug number here. If you are able to finish the bisection, that
would be helpful.
Larry
next prev parent reply other threads:[~2014-12-26 2:41 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-25 4:39 p54usb kernel panic on recent mainline kernels Christopher Chavez
2014-12-25 22:27 ` Christian Lamparter
2014-12-26 2:41 ` Larry Finger [this message]
2014-12-26 4:23 ` Christopher Chavez
2014-12-26 14:35 ` Christian Lamparter
2014-12-26 19:05 ` Larry Finger
2014-12-27 0:15 ` Christopher Chavez
2014-12-27 10:10 ` Christian Lamparter
2014-12-27 11:57 ` Christian Lamparter
2014-12-27 18:38 ` Larry Finger
2015-01-01 6:52 ` Christopher Chavez
2015-01-05 9:33 ` Johannes Berg
2015-01-05 17:30 ` Larry Finger
2015-01-06 13:39 ` [PATCH] mac80211: Re-fix accounting of the tailroom-needed counter Ido Yariv
2015-01-07 13:39 ` Johannes Berg
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=549CCAD8.70704@lwfinger.net \
--to=larry.finger@lwfinger.net \
--cc=chrischavez@gmx.us \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).