Bug 47721

Summary:	brcmsmac: slab corruption
Product:	Drivers	Reporter:	Stanislaw Gruszka (stf_xl)
Component:	network-wireless	Assignee:	brcm80211 driver developers (brcm80211-dev-list)
Status:	CLOSED UNREPRODUCIBLE
Severity:	normal	CC:	aspriel, phaber
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	3.6.0-rc5-wl+	Subsystem:
Regression:	No	Bisected commit-id:
Attachments:	dmesg.txt config.txt

Description Stanislaw Gruszka 2012-09-19 11:57:09 UTC

Transmitting data over brcmsmac interface results in memory corruption 

Slab corruption (Not tainted): skbuff_head_cache start=ffff880125b4bee8, len=240
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<ffffffff81479517>](__kfree_skb+0x47/0xa0)
040: 60 98 5d 23 01 88 ff ff 6b 6b 6b 6b 6b 6b 6b 6b  `.]#....kkkkkkkk
Prev obj: start=ffff880125b4bde0, len=240
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<ffffffff81479517>](__kfree_skb+0x47/0xa0)
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk

Comment 1 Stanislaw Gruszka 2012-09-19 12:00:03 UTC

Problem happen on latest wireless-testing tree head:

commit 0a92aec2f22d7c7bf8d1dd9425dd23cb93a41a07
Merge: 80851a0 7a5f799
Author: John W. Linville <linville@tuxdriver.com>
Date:   Wed Sep 12 14:53:02 2012 -0400

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

with small, not related patch (hence "+" in kernel version)

Comment 2 Stanislaw Gruszka 2012-09-19 12:00:52 UTC

Created attachment 80541 [details]
dmesg.txt

Comment 3 Stanislaw Gruszka 2012-09-19 12:01:27 UTC

Created attachment 80551 [details]
config.txt

Comment 4 Stanislaw Gruszka 2012-09-19 12:01:55 UTC

a0:00.0 Network controller [0280]: Broadcom Corporation BCM43224 802.11a/b/g/n [14e4:4353] (rev 01)
        Subsystem: Dell Wireless 1520 Half-size Mini PCIe Card [1028:000e]
        Physical Slot: 5
        Flags: bus master, fast devsel, latency 0, IRQ 26
        Memory at f3600000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: <access denied>
        Kernel driver in use: bcma-pci-bridge
        Kernel modules: bcma

Comment 5 Arend van Spriel 2012-09-19 20:55:27 UTC

I will try to build a kernel over here using your config. Keep you posted.

Comment 6 Piotr Haber 2012-09-26 13:46:31 UTC

I was able to reproduce slab corruption on kernel built from your configuration and commit 0a92aec2f22d7c7bf8d1dd9425dd23cb93a41a07.
But could not on v3.6-rc7 (commit 979570e02981d4a8fc20b3cc8fd651856c98ee9d)
Could you retest?

Can you also share your method of your test (I suppose it is more than simple associate & ping)?

Comment 7 Stanislaw Gruszka 2012-10-01 15:22:30 UTC

I do not have slab corruptions on earlier kernel versions, but similarly like on wireless-testing I have terrible performance, which perhaps is related to this bug, but can be also a different issue. I transmit data using "scp 700MB_file user@IP_ADDR:~/" to computer connected via cable to the AP.

Comment 8 Stanislaw Gruszka 2013-01-24 13:48:59 UTC

I can not reproduce this problem any longer on recent kernel versions.

Comment 9 Arend van Spriel 2013-01-24 14:12:37 UTC

This issue was by following upstream commit:

commit c4dea35e34f5f46e1701156153a09cce429d1ea9
Author: Piotr Haber <phaber@broadcom.com>
Date:   Wed Nov 28 21:44:05 2012 +0100

    brcmsmac: handle packet drop during transmit correctly