Bug 47721

Summary: brcmsmac: slab corruption
Product: Drivers Reporter: Stanislaw Gruszka (stf_xl)
Component: network-wirelessAssignee: brcm80211 driver developers (brcm80211-dev-list)
Status: CLOSED UNREPRODUCIBLE    
Severity: normal CC: aspriel, phaber
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: 3.6.0-rc5-wl+ Subsystem:
Regression: No Bisected commit-id:
Attachments: dmesg.txt
config.txt

Description Stanislaw Gruszka 2012-09-19 11:57:09 UTC
Transmitting data over brcmsmac interface results in memory corruption 

Slab corruption (Not tainted): skbuff_head_cache start=ffff880125b4bee8, len=240
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<ffffffff81479517>](__kfree_skb+0x47/0xa0)
040: 60 98 5d 23 01 88 ff ff 6b 6b 6b 6b 6b 6b 6b 6b  `.]#....kkkkkkkk
Prev obj: start=ffff880125b4bde0, len=240
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<ffffffff81479517>](__kfree_skb+0x47/0xa0)
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Comment 1 Stanislaw Gruszka 2012-09-19 12:00:03 UTC
Problem happen on latest wireless-testing tree head:

commit 0a92aec2f22d7c7bf8d1dd9425dd23cb93a41a07
Merge: 80851a0 7a5f799
Author: John W. Linville <linville@tuxdriver.com>
Date:   Wed Sep 12 14:53:02 2012 -0400

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

with small, not related patch (hence "+" in kernel version)
Comment 2 Stanislaw Gruszka 2012-09-19 12:00:52 UTC
Created attachment 80541 [details]
dmesg.txt
Comment 3 Stanislaw Gruszka 2012-09-19 12:01:27 UTC
Created attachment 80551 [details]
config.txt
Comment 4 Stanislaw Gruszka 2012-09-19 12:01:55 UTC
a0:00.0 Network controller [0280]: Broadcom Corporation BCM43224 802.11a/b/g/n [14e4:4353] (rev 01)
        Subsystem: Dell Wireless 1520 Half-size Mini PCIe Card [1028:000e]
        Physical Slot: 5
        Flags: bus master, fast devsel, latency 0, IRQ 26
        Memory at f3600000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: <access denied>
        Kernel driver in use: bcma-pci-bridge
        Kernel modules: bcma
Comment 5 Arend van Spriel 2012-09-19 20:55:27 UTC
I will try to build a kernel over here using your config. Keep you posted.
Comment 6 Piotr Haber 2012-09-26 13:46:31 UTC
I was able to reproduce slab corruption on kernel built from your configuration and commit 0a92aec2f22d7c7bf8d1dd9425dd23cb93a41a07.
But could not on v3.6-rc7 (commit 979570e02981d4a8fc20b3cc8fd651856c98ee9d)
Could you retest?

Can you also share your method of your test (I suppose it is more than simple associate & ping)?
Comment 7 Stanislaw Gruszka 2012-10-01 15:22:30 UTC
I do not have slab corruptions on earlier kernel versions, but similarly like on wireless-testing I have terrible performance, which perhaps is related to this bug, but can be also a different issue. I transmit data using "scp 700MB_file user@IP_ADDR:~/" to computer connected via cable to the AP.
Comment 8 Stanislaw Gruszka 2013-01-24 13:48:59 UTC
I can not reproduce this problem any longer on recent kernel versions.
Comment 9 Arend van Spriel 2013-01-24 14:12:37 UTC
This issue was by following upstream commit:

commit c4dea35e34f5f46e1701156153a09cce429d1ea9
Author: Piotr Haber <phaber@broadcom.com>
Date:   Wed Nov 28 21:44:05 2012 +0100

    brcmsmac: handle packet drop during transmit correctly