Bug 12383 - Crash during shutdown in __stop_machine
Summary: Crash during shutdown in __stop_machine
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Networking
Classification: Unclassified
Component: Wireless (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: networking_wireless@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-01-07 17:10 UTC by Alex Riesen
Modified: 2009-06-16 15:35 UTC (History)
2 users (show)

See Also:
Kernel Version: 2.6.28-6859-gede6f5a
Subsystem:
Regression: No
Bisected commit-id:


Attachments
Still image of the crash on display (228.78 KB, image/jpeg)
2009-01-07 17:11 UTC, Alex Riesen
Details
Dmesg of that run before the crash (I think). (132.40 KB, text/plain)
2009-01-07 17:18 UTC, Alex Riesen
Details

Description Alex Riesen 2009-01-07 17:10:16 UTC
Latest working kernel version: 2.6.28
Earliest failing kernel version: v2.6.28-6859-gede6f5a
Distribution: Ubuntu 8.10
Hardware Environment: Dell XPS M1330
Software Environment:
 v2.6.28-6859-gede6f5a + this patch (otherwise the iwlwifi driver crashes):

diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index d645808..15f5655 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -745,7 +745,7 @@ static int iwl3945_send_cmd_sync(struct iwl3945_priv *priv, struct iwl3945_host_
 		IWL_ERROR("Error: Response NULL in '%s'\n",
 			  get_cmd_string(cmd->id));
 		ret = -EIO;
-		goto out;
+		goto cancel;
 	}
 
 	ret = 0;

Problem Description:
The system was unresponsive after crash, so the chunk of the crash dump
was taken by a camera and typed off the picture (attached). No part of
the trace was saved in the logs.

 00000000fffffff4 0000000000000010 ffff88007b4d3df8 ffffffff80571c7f
 2222222222222222 2222222222222222 0000000000000010 0000000000000001
Call Trace:
 [<ffffffff80267066>] __stop_machine+0xee/0x15d
 [<ffffffff80......>] _cpu_down+0x184/0x2e8
 [<ffffffff80......>] disable_nonboot_cpus+0x7a/0x123
 [<ffffffff80......>] kernel_power_off+0x21/0x3b
 [<ffffffff80......>] sys_reboot+0xe3/0x151
 [<ffffffff80......>] ? tty_write+0x1fb/0x216
 [<ffffffff80......>] ? n_tty_write+0x0/0x38c
 [<ffffffff80......>] ? redirected_tty_write+0x7f/0x92
 [<ffffffff80......>] ? sysret_check+0x27/0x62
 [<ffffffff80......>] ? trace_hardirqs_on_caller+0x114/0x138
 [<ffffffff80......>] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [<ffffffff80......>] ? __wake_up+0x22/0x50
 [<ffffffff80......>] ? system_call_fastpath+0x16/0x1b
Code: 00 19 c0 31 d2 85 c0 75 30 48 8d 46 08 48 39 46 08 74 04 0f 0b eb fe 83 79 20 00 48 8b 01 0f 45 3d c5 eb b9 00 48 f7 d0 48 63 d7 <48> 8b 3c d0 e8 f9 fe ff ff ba 01 00 00 00 89 d0 c9 c3 55 48 89
RIP [<ffffffff80247521>] queue_work_on+0x39/0x4b
 RSP <ffff88007b4d3d58>
CR2: 000077ff8a29a7bf
---[ end trace ... ]---
note: halt[4573] exited with preempt_count 2

Steps to reproduce: seen once on shutdown.
Comment 1 Alex Riesen 2009-01-07 17:11:33 UTC
Created attachment 19709 [details]
Still image of the crash on display
Comment 2 Alex Riesen 2009-01-07 17:18:17 UTC
Created attachment 19710 [details]
Dmesg of that run before the crash (I think).

The BUG of using smp_processor_id in preemptible was reported separately.
Comment 3 John W. Linville 2009-04-27 14:51:50 UTC
The patch fragment (or rather it's equivalent) from the original comment is already present in current upstream kernels.
Comment 4 John W. Linville 2009-06-16 15:35:11 UTC
This bug is incomprehensible -- closing.

Note You need to log in before you can comment on or make changes to this bug.