Bug 24102 - time-stamping in phy devices causes kernel panic
Summary: time-stamping in phy devices causes kernel panic
Status: CLOSED CODE_FIX
Alias: None
Product: Networking
Classification: Unclassified
Component: Wireless (show other bugs)
Hardware: All Linux
: P1 blocking
Assignee: networking_wireless@kernel-bugs.osdl.org
URL:
Keywords:
: 24292 24452 (view as bug list)
Depends on:
Blocks:
 
Reported: 2010-11-30 19:19 UTC by akwatts
Modified: 2011-01-23 16:19 UTC (History)
5 users (show)

See Also:
Kernel Version: 2.6.36
Subsystem:
Regression: No
Bisected commit-id:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description akwatts 2010-11-30 19:19:40 UTC 
The 'time stamping in phy devices' code introduced in 2.6.36 (c1f19b51d1d87f3e3bb7e6648f43f7d57ed2da6b et al.) triggers kernel panics when wireless devices are placed in monitor mode (tested with b43 and ath5k devices on a 32-bit system).

To reproduce, set CONFIG_NETWORK_PHY_TIMESTAMPING=y and put a wireless device into monitor mode:

 # ifconfig wlan0 down
 # iwconfig wlan0 mode monitor 
 # ifconfig wlan0 up

~ Andy
Comment 1 John W. Linville 2010-11-30 19:53:07 UTC 
Could you attach the a backtrace?  Even a digital photo would be helpful...
Comment 2 akwatts 2010-12-01 03:45:26 UTC 
 [<c14455ad>] ? __alloc_skb+0x53/0xf8
 [<f92fdd57>] ? b43_dma_rx+0x18a/0x342 [b43]
 [<f92e8475>] ? b43_do_interrupt_thread+0x420/0x92e [b43]
 [<c1027731>] ? __dequeue_entity+0x31/0x35
 [<c1027a44>] ? set_next_entity+0xad/0xbb
 [<f92e899b>] ? b43_interrupt_thread_handler+0x18/0x2b [b43]
 [<c107c378>] ? irq_thread+0xb6/0x19e
 [<c15625a0>] ? schedule+0x254/0x566
 [<c107c2c2>] ? irq_thread+0x0/0x19e
 [<c10448b1>] ? kthread+0x67/0x69
 [<c104484a>] ? kthread+0x0/0x69
 [<c100323e>] ? kernel_thread_helper+0x6/0x18
Code: 4c 24 14 8b 88 a8 00 00 00 89 4c 24 10 89 54 24 0c 8b 40 50 89 44 24 08 8b 45 04 89 44 24 04 c7 04 24 30 74 7a c1 e8 b5 d2 11 00 <0f> 0b eb fe 55 89 e5 56 53 83 ec 24 8b 88 a0 00 00 00 8b 58 54
EIP: [<c1444ea0>] skb_push+0x7d/0x81 SS:ESP 0068:cee01d78
---[ end trace af1c99818e62b195 ]---
Kernel panic - not syncing: Fatal exception in interrupt
Pid: 6674, comm: irq/18-b43 Tainted: G     D     2.6.36.1
Call Trace:
 [<c156217d>] ? printk+0x28/0x2a
 [<c156205c>] panic+0x57/0x150
 [<c1564adf>] oops_begin+0x0/0x40
 [<c1004e36>] die+0x49/0x5d
 [<c1564304>] do_trap+0x84/0xad
 [<c10037e5>] ? do_invalid_op+0x0/0x93
 [<c100386b>] do_invalid_op+0x86/0x93
 [<c1444ea0>] ? skb_push+0x7d/0x81
 [<c15640b9>] error_code+0x65/0x6c
 [<c1444ea0>] ? skb_push+0x7d/0x81
 [<c145f721>] ? skb_defer_rx_timestamp+0x12/0x5a
 [<c145f721>] skb_defer_rx_timestamp+0x12/0x5a
 [<c144d23c>] netif_receive_skb+0x1f/0x47
 [<c153a6e8>] ieee80211_rx+0x661/0x8e1
 [<f85daca2>] ? ssb_pci_read32+0x19/0x31 [ssb]
 [<f92e54cf>] ? b43_tsf_read+0x2a/0x47 [b43]
 [<f92f8d42>] b43_rx+0x24c/0x5eb [b43]
 [<c14455ad>] ? __alloc_skb+0x53/0xf8
 [<f92fdd57>] b43_dma_rx+0x18a/0x342 [b43]
 [<f92e8475>] b43_do_interrupt_thread+0x420/0x92e [b43]
 [<c1027731>] ? __dequeue_entity+0x31/0x35
 [<c1027a44>] ? set_next_entity+0xad/0xbb
 [<f92e899b>] b43_interrupt_thread_handler+0x18/0x2b [b43]
 [<c107c378>] irq_thread+0xb6/0x19e
 [<c15625a0>] ? schedule+0x254/0x566
 [<c107c2c2>] ? irq_thread+0x0/0x19e
 [<c10448b1>] kthread+0x67/0x69
 [<c104484a>] ? kthread+0x0/0x69
 [<c100323e>] kernel_thread_helper+0x6/0x18
panic occurred, switching back to text console
Comment 3 Richard Cochran 2010-12-10 14:25:57 UTC 
The following three bugs are all duplicates of each other:                      
                                                                                
  24102                                                                         
  24292                                                                         
  24452                                                                         
                                                                                
They all have the same root cause, and all are fixed by the patch               
posted by Eric Dumazet on netdev:                                               
                                                                                
   http://article.gmane.org/gmane.linux.network/180108                          
                                                                                
The work-around is to disable CONFIG_NETWORK_PHY_TIMESTAMPING.                  
                                                                                
Richard
Comment 4 John W. Linville 2010-12-10 14:28:01 UTC 
*** Bug 24292 has been marked as a duplicate of this bug. ***
Comment 5 John W. Linville 2010-12-10 14:28:35 UTC 
*** Bug 24452 has been marked as a duplicate of this bug. ***
Comment 6 Florian Mickler 2010-12-10 18:49:08 UTC 
Patch: http://article.gmane.org/gmane.linux.network/180108
Comment 7 Florian Mickler 2011-01-23 16:19:43 UTC 
fixed in .37-rc6 by
commit a19faf0250e09b16cac169354126404bc8aa342b
Author: Eric Dumazet <eric.dumazet@gmail.com>
Date:   Sun Dec 5 18:50:32 2010 +0000

    net: fix skb_defer_rx_timestamp()
Note You need to log in before you can comment on or make changes to this bug.