Bug 47721 - brcmsmac: slab corruption
Summary: brcmsmac: slab corruption
Status: CLOSED UNREPRODUCIBLE
Alias: None
Product: Drivers
Classification: Unclassified
Component: network-wireless (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: brcm80211 driver developers
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-09-19 11:57 UTC by Stanislaw Gruszka
Modified: 2013-01-24 14:12 UTC (History)
2 users (show)

See Also:
Kernel Version: 3.6.0-rc5-wl+
Subsystem:
Regression: No
Bisected commit-id:

Attachments
dmesg.txt (83.08 KB, text/plain)
2012-09-19 12:00 UTC, Stanislaw Gruszka 		Details
config.txt (112.58 KB, text/plain)
2012-09-19 12:01 UTC, Stanislaw Gruszka 		Details
Add an attachment (proposed patch, testcase, etc.)

Description Stanislaw Gruszka 2012-09-19 11:57:09 UTC 
Transmitting data over brcmsmac interface results in memory corruption 

Slab corruption (Not tainted): skbuff_head_cache start=ffff880125b4bee8, len=240
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<ffffffff81479517>](__kfree_skb+0x47/0xa0)
040: 60 98 5d 23 01 88 ff ff 6b 6b 6b 6b 6b 6b 6b 6b  `.]#....kkkkkkkk
Prev obj: start=ffff880125b4bde0, len=240
Redzone: 0x9f911029d74e35b/0x9f911029d74e35b.
Last user: [<ffffffff81479517>](__kfree_skb+0x47/0xa0)
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b  kkkkkkkkkkkkkkkk
Comment 1 Stanislaw Gruszka 2012-09-19 12:00:03 UTC 
Problem happen on latest wireless-testing tree head:

commit 0a92aec2f22d7c7bf8d1dd9425dd23cb93a41a07
Merge: 80851a0 7a5f799
Author: John W. Linville <linville@tuxdriver.com>
Date:   Wed Sep 12 14:53:02 2012 -0400

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next

with small, not related patch (hence "+" in kernel version)
Comment 2 Stanislaw Gruszka 2012-09-19 12:00:52 UTC 
Created attachment 80541 [details]
dmesg.txt
Comment 3 Stanislaw Gruszka 2012-09-19 12:01:27 UTC 
Created attachment 80551 [details]
config.txt
Comment 4 Stanislaw Gruszka 2012-09-19 12:01:55 UTC 
a0:00.0 Network controller [0280]: Broadcom Corporation BCM43224 802.11a/b/g/n [14e4:4353] (rev 01)
        Subsystem: Dell Wireless 1520 Half-size Mini PCIe Card [1028:000e]
        Physical Slot: 5
        Flags: bus master, fast devsel, latency 0, IRQ 26
        Memory at f3600000 (64-bit, non-prefetchable) [size=16K]
        Capabilities: <access denied>
        Kernel driver in use: bcma-pci-bridge
        Kernel modules: bcma
Comment 5 Arend van Spriel 2012-09-19 20:55:27 UTC 
I will try to build a kernel over here using your config. Keep you posted.
Comment 6 Piotr Haber 2012-09-26 13:46:31 UTC 
I was able to reproduce slab corruption on kernel built from your configuration and commit 0a92aec2f22d7c7bf8d1dd9425dd23cb93a41a07.
But could not on v3.6-rc7 (commit 979570e02981d4a8fc20b3cc8fd651856c98ee9d)
Could you retest?

Can you also share your method of your test (I suppose it is more than simple associate & ping)?
Comment 7 Stanislaw Gruszka 2012-10-01 15:22:30 UTC 
I do not have slab corruptions on earlier kernel versions, but similarly like on wireless-testing I have terrible performance, which perhaps is related to this bug, but can be also a different issue. I transmit data using "scp 700MB_file user@IP_ADDR:~/" to computer connected via cable to the AP.
Comment 8 Stanislaw Gruszka 2013-01-24 13:48:59 UTC 
I can not reproduce this problem any longer on recent kernel versions.
Comment 9 Arend van Spriel 2013-01-24 14:12:37 UTC 
This issue was by following upstream commit:

commit c4dea35e34f5f46e1701156153a09cce429d1ea9
Author: Piotr Haber <phaber@broadcom.com>
Date:   Wed Nov 28 21:44:05 2012 +0100

    brcmsmac: handle packet drop during transmit correctly
Note You need to log in before you can comment on or make changes to this bug.