From: Max Schulze <max.schulze@online.de>
To: Johannes Berg <johannes@sipsolutions.net>,
linux-wireless@vger.kernel.org
Subject: Re: [RFC PATCH v2 6.1] wifi: cfg80211: fix cqm_config access race
Date: Wed, 16 Aug 2023 13:24:33 +0200 [thread overview]
Message-ID: <afaf7b61-3883-3ffd-6dec-d9b68150293d@online.de> (raw)
In-Reply-To: <dd3c90b687a933f3b2d467a0e3a2f918c26201f4.camel@sipsolutions.net>
You are right, I have no clear proof.
However, here is a second trace from the same system.
Another system has crashed, I have not recovered the trace yet.
The context, that there is a RSSI notification just beforehand, is exactly the same (as the initial bug report).
You have a clue?
Aug 16 11:03:32 h63 wpa_supplicant[389]: wlan0: Associated with
xx:xx:xx:xx:00:91
Aug 16 11:03:32 h63 wpa_supplicant[389]: wlan0: CTRL-EVENT-CONNECTED -
Connection to xx:xx:xx:xx:00:91 completed [id=0 id_str=]
Aug 16 11:03:32 h63 wpa_supplicant[389]: wlan0:
CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
Aug 16 11:03:32 h63 NetworkManager[373]: <info> [1692176612.2898]
device (wlan0): supplicant interface state: associating -> completed
Aug 16 11:03:32 h63 NetworkManager[373]: <info> [1692176612.2933]
device (p2p-dev-wlan0): supplicant management interface state:
associating -> completed
Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI
-63 dBm
Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_rx_event Enter: mmc1:0001:1:
rxp=00000000b1aa24a9
Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_fweh_event_worker event RSSI
(56) ifidx 0 bsscfg 0 addr 00:00:00:ab:c0:c1
Aug 16 11:03:32 h63 kernel: brcmfmac: brcmf_fweh_event_worker version
2 flags 0 status 0 reason 0
Aug 16 11:03:32 h63 kernel: brcmutil: event payload, len=12
Aug 16 11:03:32 h63 kernel: 00000000: ff ff ff c1 00 00 00 00 ff ff ff
a5 ............
Aug 16 11:03:35 h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI
-63 dBm
Aug 16 11:03:40 h63 kernel: Unable to handle kernel NULL pointer
dereference at virtual address 00000000000000cc
Aug 16 11:03:40 h63 kernel: Mem abort info:
Aug 16 11:03:41 h63 kernel: ESR = 0x0000000096000005
Aug 16 11:03:41 h63 kernel: EC = 0x25: DABT (current EL), IL = 32 bits
Aug 16 11:03:41 h63 kernel: SET = 0, FnV = 0
Aug 16 11:03:41 h63 kernel: EA = 0, S1PTW = 0
Aug 16 11:03:41 h63 kernel: FSC = 0x05: level 1 translation fault
Aug 16 11:03:41 h63 kernel: Data abort info:
Aug 16 11:03:41 h63 kernel: ISV = 0, ISS = 0x00000005
Aug 16 11:03:41 h63 kernel: CM = 0, WnR = 0
Aug 16 11:03:41 h63 kernel: user pgtable: 4k pages, 39-bit VAs,
pgdp=0000000049427000
Aug 16 11:03:41 h63 kernel: [00000000000000cc] pgd=0000000000000000,
p4d=0000000000000000, pud=0000000000000000
Aug 16 11:03:41 h63 kernel: Internal error: Oops: 0000000096000005 [#1]
PREEMPT SMP
Aug 16 11:03:41 h63 kernel: Modules linked in: rtc_pcf85063 ov9281
regmap_i2c brcmfmac vc4 brcmutil cfg80211 snd_soc_hdmi_codec
drm_display_helper cec drm_dma_helper drm_kms_helper v3d gpu_sched
binfmt_mis>
Aug 16 11:03:41 h63 kernel: CPU: 2 PID: 491 Comm: Xorg Tainted: G
C 6.1.45-v8-gdc69f9d60872 #3
Aug 16 11:03:41 h63 kernel: Hardware name: Raspberry Pi Compute Module 4
Rev 1.0 (DT)
Aug 16 11:03:41 h63 kernel: pstate: 80000005 (Nzcv daif -PAN -UAO -TCO
-DIT -SSBS BTYPE=--)
Aug 16 11:03:41 h63 kernel: pc : drm_ioctl+0x284/0x440 [drm]
Aug 16 11:03:41 h63 kernel: lr : drm_ioctl+0xac/0x440 [drm]
Aug 16 11:03:41 h63 kernel: sp : ffffffc00935bca0
Aug 16 11:03:41 h63 kernel: x29: ffffffc00935bcb0 x28: ffffff8045499f00
x27: 0000000000000000
Aug 16 11:03:41 h63 kernel: x26: 0000000000000000 x25: ffffff804806a800
x24: 0000000000000041
Aug 16 11:03:41 h63 kernel: x23: ffffff804946d900 x22: 00000000c0106441
x21: 0000007fc2a766f8
Aug 16 11:03:41 h63 kernel: x20: ffffff8040370000 x19: 0000000000000001
x18: 0000000000000000
Aug 16 11:03:41 h63 kernel: x17: 0000000000000000 x16: ffffffe34ff1a2d0
x15: 0000000000000000
Aug 16 11:03:41 h63 kernel: x14: 0000000000000000 x13: 0000000000000000
x12: 0000000000000000
Aug 16 11:03:41 h63 kernel: x11: 0000000000000000 x10: 0000000000000000
x9 : ffffffe315a9eed0
Aug 16 11:03:41 h63 kernel: x8 : 0000000000000000 x7 : 0000000000000000
x6 : 0000000000159ba4
Aug 16 11:03:41 h63 kernel: x5 : 0000000000159ba5 x4 : 0000000000000000
x3 : 0000000000000001
Aug 16 11:03:41 h63 kernel: x2 : ffffff8045499f00 x1 : ffffff9d2eca5000
x0 : 0000000000000004
Aug 16 11:03:41 h63 kernel: Call trace:
Aug 16 11:03:41 h63 kernel: drm_ioctl+0x284/0x440 [drm]
Aug 16 11:03:41 h63 kernel: __arm64_sys_ioctl+0xb0/0xf4
Aug 16 11:03:41 h63 kernel: invoke_syscall+0x50/0x120
Aug 16 11:03:41 h63 kernel: el0_svc_common.constprop.0+0x68/0x124
Aug 16 11:03:41 h63 kernel: do_el0_svc+0x34/0xd0
Aug 16 11:03:41 h63 kernel: el0_svc+0x30/0x94
Aug 16 11:03:41 h63 kernel: el0t_64_sync_handler+0xb8/0xbc
Aug 16 11:03:41 h63 kernel: el0t_64_sync+0x18c/0x190
Aug 16 11:03:41 h63 kernel: Code: 35000455 a94673fb 17ffff7b f9401a80
(b940c800)
Aug 16 11:03:41 h63 kernel: ---[ end trace 0000000000000000 ]---
Aug 16 11:03:41 h63 kernel: brcmfmac: brcmf_cfg80211_get_station RSSI
-67 dBm
Aug 16 11:03:45 h63 kernel: brcmfmac: brcmf_netdev_start_xmit wlan0:
insufficient headroom (0)
Aug 16 11:03:45 h63 kernel: brcmfmac: brcmf_netdev_start_xmit wlan0:
insufficient headroom (0)
next prev parent reply other threads:[~2023-08-16 11:25 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-09 14:11 BCM43455: brcmf_notify_rssi / cfg80211_cqm_rssi_notify : Unable to handle kernel NULL pointer dereference Max Schulze
2023-08-10 8:34 ` BCM43455: brcmf_notify_rssi / cfg80211_cqm_rssi_notify : Unable to handle kernel NULL pointer dereference (RSSI notification after station disconnect?) Max Schulze
2023-08-11 7:30 ` [PATCH] wifi: nl80211: avoid NULL-ptr deref after cfg80211_cqm_rssi_update Max Schulze
2023-08-11 9:54 ` Johannes Berg
2023-08-12 9:35 ` Max Schulze
2023-08-12 9:23 ` BCM43455: brcmf_notify_rssi / cfg80211_cqm_rssi_notify : Unable to handle kernel NULL pointer dereference (RSSI notification after station disconnect?) Max Schulze
2023-08-13 13:18 ` [RFC PATCH] wifi: cfg80211: fix cqm_config access race Johannes Berg
2023-08-15 10:56 ` Max Schulze
2023-08-15 11:02 ` Johannes Berg
2023-08-15 11:42 ` [RFC PATCH v2] " Johannes Berg
2023-08-15 13:24 ` Max Schulze
2023-08-15 13:25 ` Johannes Berg
2023-08-15 13:37 ` [RFC PATCH v2 6.1] " Johannes Berg
2023-08-16 7:23 ` Max Schulze
2023-08-16 7:30 ` Johannes Berg
2023-08-16 11:24 ` Max Schulze [this message]
2023-08-16 13:08 ` Max Schulze
2023-08-16 13:17 ` Johannes Berg
2023-08-16 13:33 ` Max Schulze
2023-08-16 13:27 ` Johannes Berg
2023-08-16 13:32 ` [RFC PATCH v3 " Johannes Berg
2023-08-16 13:36 ` Johannes Berg
2023-08-16 13:38 ` [RFC PATCH v4 " Johannes Berg
2023-09-11 13:16 ` Max Schulze
2023-09-11 16:23 ` Max Schulze
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=afaf7b61-3883-3ffd-6dec-d9b68150293d@online.de \
--to=max.schulze@online.de \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox