2010-07-03 06:26:15

by Ben Greear

[permalink] [raw]
Subject: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

It seems to me that in 2.6.34, there is no code to clean up
virtual wiphys in ath9k on rmmod. Also, ath9k mailing list
is returning error about mis-configured DNS server.

This is with un-modified ath9k driver and is repeatable
every time on my system (crash is often different, but
it always crashes very quickly).

[root@atom ~]# echo add=5 > /debug/ath9k/phy1/wiphy
-bash: /debug/ath9k/phy1/wiphy: No such file or directory
[root@atom ~]# echo add=5 > /debug/ath9k/phy0/wiphy
Jul 2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# Jul 2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
rmmod ath9k
Jul 2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
Jul 2 23:22:24 atom kernel: ath9k: Driver unloaded
[root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
lock: f8a476c0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
Pid: 2877, comm: iw Not tainted 2.6.34 #7
Call Trace:
[<c0730e34>] ? printk+0xf/0x13
[<c05710d6>] spin_bug+0x7b/0x86
[<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
[<c0571171>] do_raw_spin_lock+0x1e/0x125
[<c042f91e>] ? scheduler_tick+0xd6/0x1c9
[<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
[<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
[<c0440b59>] __queue_work+0x12/0x2f
[<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
[<c0440ba4>] delayed_work_timer_fn+0x2e/0x30

I'm new to hacking on this driver..but would love to test
patches, and if someone wants to suggest a good point in
the code to remove the virtual phys, I'll make the attempt.

Thanks,
Ben

--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com


2010-07-03 16:34:11

by Ben Greear

[permalink] [raw]
Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

On 07/03/2010 12:02 AM, Vasanthakumar Thiagarajan wrote:
> On Sat, Jul 03, 2010 at 11:56:14AM +0530, Ben Greear wrote:
>> It seems to me that in 2.6.34, there is no code to clean up
>> virtual wiphys in ath9k on rmmod. Also, ath9k mailing list
>> is returning error about mis-configured DNS server.
>>
>> This is with un-modified ath9k driver and is repeatable
>> every time on my system (crash is often different, but
>> it always crashes very quickly).
>>
>> [root@atom ~]# echo add=5> /debug/ath9k/phy1/wiphy
>> -bash: /debug/ath9k/phy1/wiphy: No such file or directory
>> [root@atom ~]# echo add=5> /debug/ath9k/phy0/wiphy
>> Jul 2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
>> [root@atom ~]# Jul 2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
>> rmmod ath9k
>> Jul 2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
>> Jul 2 23:22:24 atom kernel: ath9k: Driver unloaded
>> [root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
>> lock: f8a476c0, .magic: 00000000, .owner:<none>/-1, .owner_cpu: 0
>> Pid: 2877, comm: iw Not tainted 2.6.34 #7
>> Call Trace:
>> [<c0730e34>] ? printk+0xf/0x13
>> [<c05710d6>] spin_bug+0x7b/0x86
>> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
>> [<c0571171>] do_raw_spin_lock+0x1e/0x125
>> [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
>> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
>> [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
>> [<c0440b59>] __queue_work+0x12/0x2f
>> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
>> [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30
>>
>> I'm new to hacking on this driver..but would love to test
>> patches, and if someone wants to suggest a good point in
>> the code to remove the virtual phys, I'll make the attempt.
>
> Can you please try this patch?

It still crashes for me, and backtraces look similar.

Were you able to reproduce the crash?

Thanks,
Ben


--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com

2010-07-03 17:57:20

by Ben Greear

[permalink] [raw]
Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

Just for reference, same problem on un-modified 2.6.35-rc3+ (pulled last night)

The crash below is from reproducing it with your patch included.

[root@atom ~]# ls
anaconda-ks.cfg Documents Music Public Videos
Desktop Downloads Pictures Templates
[root@atom ~]# echo add > /debug/ath9k/phy0/wiphy
Jul 3 10:55:24 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# Jul 3 10:55:25 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready

[root@atom ~]# rmmod ath9k
BUG: unable to handle kernel NULL pointer dereference at 000000a4
IP: [<f8d65fd1>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:03.0/class
Modules linked in:

(It reboots before printing anything else to console).


Thanks,
Ben

--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com

2010-07-04 15:59:14

by Ben Greear

[permalink] [raw]
Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

On 07/04/2010 02:35 AM, Vasanthakumar Thiagarajan wrote:
> On Sat, Jul 03, 2010 at 10:04:09PM +0530, Ben Greear wrote:
>> On 07/03/2010 12:02 AM, Vasanthakumar Thiagarajan wrote:
>>> On Sat, Jul 03, 2010 at 11:56:14AM +0530, Ben Greear wrote:
>>>> It seems to me that in 2.6.34, there is no code to clean up
>>>> virtual wiphys in ath9k on rmmod. Also, ath9k mailing list
>>>> is returning error about mis-configured DNS server.
>>>>
>>>> This is with un-modified ath9k driver and is repeatable
>>>> every time on my system (crash is often different, but
>>>> it always crashes very quickly).
>>>>
>>>> [root@atom ~]# echo add=5> /debug/ath9k/phy1/wiphy
>>>> -bash: /debug/ath9k/phy1/wiphy: No such file or directory
>>>> [root@atom ~]# echo add=5> /debug/ath9k/phy0/wiphy
>>>> Jul 2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
>>>> [root@atom ~]# Jul 2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
>>>> rmmod ath9k
>>>> Jul 2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
>>>> Jul 2 23:22:24 atom kernel: ath9k: Driver unloaded
>>>> [root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
>>>> lock: f8a476c0, .magic: 00000000, .owner:<none>/-1, .owner_cpu: 0
>>>> Pid: 2877, comm: iw Not tainted 2.6.34 #7
>>>> Call Trace:
>>>> [<c0730e34>] ? printk+0xf/0x13
>>>> [<c05710d6>] spin_bug+0x7b/0x86
>>>> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
>>>> [<c0571171>] do_raw_spin_lock+0x1e/0x125
>>>> [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
>>>> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
>>>> [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
>>>> [<c0440b59>] __queue_work+0x12/0x2f
>>>> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
>>>> [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30
>>>>
>>>> I'm new to hacking on this driver..but would love to test
>>>> patches, and if someone wants to suggest a good point in
>>>> the code to remove the virtual phys, I'll make the attempt.
>>>
>>> Can you please try this patch?
>>
>> It still crashes for me, and backtraces look similar.
>>
>> Were you able to reproduce the crash?
>
> with my patch, no. Can you please give the steps to trigger
> this crash?

It happens every time if I:

echo add > /debug/ath9k/phy0/wiphy
rmmod ath9k

I notice the patch applied with offsets. What kernel/driver
version are you testing? I tried .34 kernel as well as the top-of-tree
2.6.35-rcX.

Thanks,
Ben

--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com

Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

On Sat, Jul 03, 2010 at 10:04:09PM +0530, Ben Greear wrote:
> On 07/03/2010 12:02 AM, Vasanthakumar Thiagarajan wrote:
> > On Sat, Jul 03, 2010 at 11:56:14AM +0530, Ben Greear wrote:
> >> It seems to me that in 2.6.34, there is no code to clean up
> >> virtual wiphys in ath9k on rmmod. Also, ath9k mailing list
> >> is returning error about mis-configured DNS server.
> >>
> >> This is with un-modified ath9k driver and is repeatable
> >> every time on my system (crash is often different, but
> >> it always crashes very quickly).
> >>
> >> [root@atom ~]# echo add=5> /debug/ath9k/phy1/wiphy
> >> -bash: /debug/ath9k/phy1/wiphy: No such file or directory
> >> [root@atom ~]# echo add=5> /debug/ath9k/phy0/wiphy
> >> Jul 2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
> >> [root@atom ~]# Jul 2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
> >> rmmod ath9k
> >> Jul 2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
> >> Jul 2 23:22:24 atom kernel: ath9k: Driver unloaded
> >> [root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
> >> lock: f8a476c0, .magic: 00000000, .owner:<none>/-1, .owner_cpu: 0
> >> Pid: 2877, comm: iw Not tainted 2.6.34 #7
> >> Call Trace:
> >> [<c0730e34>] ? printk+0xf/0x13
> >> [<c05710d6>] spin_bug+0x7b/0x86
> >> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
> >> [<c0571171>] do_raw_spin_lock+0x1e/0x125
> >> [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
> >> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
> >> [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
> >> [<c0440b59>] __queue_work+0x12/0x2f
> >> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
> >> [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30
> >>
> >> I'm new to hacking on this driver..but would love to test
> >> patches, and if someone wants to suggest a good point in
> >> the code to remove the virtual phys, I'll make the attempt.
> >
> > Can you please try this patch?
>
> It still crashes for me, and backtraces look similar.
>
> Were you able to reproduce the crash?

with my patch, no. Can you please give the steps to trigger
this crash?

Vasanth

2010-07-06 12:05:28

by Ben Greear

[permalink] [raw]
Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

On 07/06/2010 01:36 AM, Rajkumar Manoharan wrote:
> On Tue, Jul 06, 2010 at 12:27:42AM +0530, Ben Greear wrote:
>> I ran the same test on wireless-testing, and it still crashes.
>>
>> It appears that the patch you sent is already in wireless-testing,
>> so I did not apply it.

> Can you please try this patch?

That patch appears to fix the problem. I was able to rmmod
ath9k after adding a virtual phy and no crashes. It used to
immediately crash every time.

I'll do some more testing later today if all goes according to plan.

Thanks!
Ben

--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com

Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

On Sat, Jul 03, 2010 at 11:56:14AM +0530, Ben Greear wrote:
> It seems to me that in 2.6.34, there is no code to clean up
> virtual wiphys in ath9k on rmmod. Also, ath9k mailing list
> is returning error about mis-configured DNS server.
>
> This is with un-modified ath9k driver and is repeatable
> every time on my system (crash is often different, but
> it always crashes very quickly).
>
> [root@atom ~]# echo add=5 > /debug/ath9k/phy1/wiphy
> -bash: /debug/ath9k/phy1/wiphy: No such file or directory
> [root@atom ~]# echo add=5 > /debug/ath9k/phy0/wiphy
> Jul 2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
> [root@atom ~]# Jul 2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
> rmmod ath9k
> Jul 2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
> Jul 2 23:22:24 atom kernel: ath9k: Driver unloaded
> [root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
> lock: f8a476c0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
> Pid: 2877, comm: iw Not tainted 2.6.34 #7
> Call Trace:
> [<c0730e34>] ? printk+0xf/0x13
> [<c05710d6>] spin_bug+0x7b/0x86
> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
> [<c0571171>] do_raw_spin_lock+0x1e/0x125
> [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
> [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
> [<c0440b59>] __queue_work+0x12/0x2f
> [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
> [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30
>
> I'm new to hacking on this driver..but would love to test
> patches, and if someone wants to suggest a good point in
> the code to remove the virtual phys, I'll make the attempt.

Can you please try this patch?


diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 3a14630..6218890 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -516,6 +516,7 @@ void ath_deinit_leds(struct ath_softc *sc);
#define SC_OP_TSF_RESET BIT(11)
#define SC_OP_BT_PRIORITY_DETECTED BIT(12)
#define SC_OP_BT_SCAN BIT(13)
+#define SC_OP_ANI_RUN BIT(14)

/* Powersave flags */
#define PS_WAIT_FOR_BEACON BIT(0)
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 5af2596..41a317d 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -451,6 +451,10 @@ static void ath_start_ani(struct ath_common *common)
{
struct ath_hw *ah = common->ah;
unsigned long timestamp = jiffies_to_msecs(jiffies);
+ struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+ if (!(sc->sc_flags & SC_OP_ANI_RUN))
+ return;

common->ani.longcal_timer = timestamp;
common->ani.shortcal_timer = timestamp;
@@ -766,11 +770,13 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
/* Reset rssi stats */
sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;

+ sc->sc_flags |= SC_OP_ANI_RUN;
ath_start_ani(common);
} else {
ath_print(common, ATH_DBG_CONFIG, "Bss Info DISASSOC\n");
common->curaid = 0;
/* Stop ANI */
+ sc->sc_flags &= ~SC_OP_ANI_RUN;
del_timer_sync(&common->ani.timer);
}
}
@@ -1376,8 +1382,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,

if (vif->type == NL80211_IFTYPE_AP ||
vif->type == NL80211_IFTYPE_ADHOC ||
- vif->type == NL80211_IFTYPE_MONITOR)
+ vif->type == NL80211_IFTYPE_MONITOR) {
+ sc->sc_flags |= SC_OP_ANI_RUN;
ath_start_ani(common);
+ }

out:
mutex_unlock(&sc->mutex);
@@ -1398,6 +1406,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
mutex_lock(&sc->mutex);

/* Stop ANI */
+ sc->sc_flags &= ~SC_OP_ANI_RUN;
del_timer_sync(&common->ani.timer);

/* Reclaim beacon resources */
--


Vasanth

2010-07-06 08:36:26

by Rajkumar Manoharan

[permalink] [raw]
Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

On Tue, Jul 06, 2010 at 12:27:42AM +0530, Ben Greear wrote:
> I ran the same test on wireless-testing, and it still crashes.
>
> It appears that the patch you sent is already in wireless-testing,
> so I did not apply it.
>
> [root@atom ~]# uname -a
> Linux atom 2.6.35-rc3-wl+ #1 SMP Mon Jul 5 11:36:08 PDT 2010 i686 i686 i386 GNU/Linux
> [root@atom ~]# echo add > /debug/ath9k/phy0/wiphy
> Jul 5 11:54:59 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
> [root@atom ~]# rmmod ath9k
> BUG: unable to handle kernel NULL pointer dereference at 000000a4
> IP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
> *pde = 00000000
> Oops: 0000 [#1] SMP
> last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:00.0/net/wlan1/flags
> Modules linked in: xt_CT iptable_raw ipt_addrtype xt_DSCP xt_dscp xt_string xt_owner xt_NFQUEUE xt_mul]
>
> Pid: 5817, comm: rmmod Not tainted 2.6.35-rc3-wl+ #1 To be filled by O.E.M./To Be Filled By O.E.M.
> EIP: 0060:[<f8d455d6>] EFLAGS: 00010046 CPU: 0
> EIP is at ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
> EAX: 00000000 EBX: 00000000 ECX: c08de3bc EDX: f705ec78
> ESI: f705ec78 EDI: 00000010 EBP: f4563e70 ESP: f4563e6c
> DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
> Process rmmod (pid: 5817, ti=f4562000 task=f4504550 task.ti=f4562000)
> Stack:
> 00000000 f4563e88 f8de3cb4 00000010 f6aab6c0 00000282 00000010 f4563ea8
> <0> c046d228 f705ec78 00000282 c08de3bc 00000010 c08de380 f705ec78 f4563ebc
> <0> c046d28f f705ec78 f7113000 f8f00000 f4563ed0 f8dea27f f7113000 f8def9a8
> Call Trace:
> [<f8de3cb4>] ? ath_isr+0x25/0x189 [ath9k]
> [<c046d228>] ? __free_irq+0x11e/0x15e
> [<c046d28f>] ? free_irq+0x27/0x3a
> [<f8dea27f>] ? ath_pci_remove+0x2f/0x54 [ath9k]
> [<c05816da>] ? pci_device_remove+0x19/0x39
> [<c06036d6>] ? __device_release_driver+0x59/0x9d
> [<c0603781>] ? driver_detach+0x67/0x85
> [<c0602c9d>] ? bus_remove_driver+0x69/0x85
> [<c0603b92>] ? driver_unregister+0x4b/0x52
> [<c05818a9>] ? pci_unregister_driver+0x2d/0x6e
> [<f8dea171>] ? ath_pci_exit+0xd/0xf [ath9k]
> [<f8dec664>] ? ath9k_exit+0x8/0x2f [ath9k]
> [<c0455232>] ? sys_delete_module+0x16f/0x1c0
> [<c07458dc>] ? do_page_fault+0x26a/0x2c5
> [<c074590a>] ? do_page_fault+0x298/0x2c5
> [<c0402fdc>] ? sysenter_do_call+0x12/0x28
> Code: 80 4b 06 10 31 c9 83 c4 68 89 c8 5b 5e 5f 5d c3 55 b9 0c 00 00 00 89 e5 53 8b 98 94 00 00 00 ff
> EIP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw] SS:ESP 0068:f4563e6c
> CR2: 00000000000000a4
> ---[ end trace 43bc6f57caff1689 ]---
> Killed

Can you please try this patch?

diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index fe730cb..243c177 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -787,12 +787,12 @@ void ath9k_deinit_device(struct ath_softc *sc)
ieee80211_unregister_hw(aphy->hw);
ieee80211_free_hw(aphy->hw);
}
- kfree(sc->sec_wiphy);

ieee80211_unregister_hw(hw);
ath_rx_cleanup(sc);
ath_tx_cleanup(sc);
ath9k_deinit_softc(sc);
+ kfree(sc->sec_wiphy);
}

void ath_descdma_cleanup(struct ath_softc *sc,
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 4c0831f..a6b6af2 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1264,6 +1264,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
struct ath_softc *sc = aphy->sc;
struct ath_hw *ah = sc->sc_ah;
struct ath_common *common = ath9k_hw_common(ah);
+ int i;

mutex_lock(&sc->mutex);

@@ -1276,11 +1277,15 @@ static void ath9k_stop(struct ieee80211_hw *hw)
cancel_work_sync(&sc->paprd_work);
cancel_work_sync(&sc->hw_check_work);

- if (!sc->num_sec_wiphy) {
+ for (i = 0; i < sc->num_sec_wiphy; i++) {
+ if (sc->sec_wiphy[i])
+ break;
+ }
+
+ if (i == sc->num_sec_wiphy) {
cancel_delayed_work_sync(&sc->wiphy_work);
cancel_work_sync(&sc->chan_work);
}
-
if (sc->sc_flags & SC_OP_INVALID) {
ath_print(common, ATH_DBG_ANY, "Device not present\n");
mutex_unlock(&sc->mutex);

---
Rajkumar

2010-07-05 18:57:47

by Ben Greear

[permalink] [raw]
Subject: Re: ath9k doesn't clean up virtual wifis on rmmod, and crashes.

I ran the same test on wireless-testing, and it still crashes.

It appears that the patch you sent is already in wireless-testing,
so I did not apply it.

[root@atom ~]# uname -a
Linux atom 2.6.35-rc3-wl+ #1 SMP Mon Jul 5 11:36:08 PDT 2010 i686 i686 i386 GNU/Linux
[root@atom ~]# echo add > /debug/ath9k/phy0/wiphy
Jul 5 11:54:59 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# rmmod ath9k
BUG: unable to handle kernel NULL pointer dereference at 000000a4
IP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:00.0/net/wlan1/flags
Modules linked in: xt_CT iptable_raw ipt_addrtype xt_DSCP xt_dscp xt_string xt_owner xt_NFQUEUE xt_mul]

Pid: 5817, comm: rmmod Not tainted 2.6.35-rc3-wl+ #1 To be filled by O.E.M./To Be Filled By O.E.M.
EIP: 0060:[<f8d455d6>] EFLAGS: 00010046 CPU: 0
EIP is at ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
EAX: 00000000 EBX: 00000000 ECX: c08de3bc EDX: f705ec78
ESI: f705ec78 EDI: 00000010 EBP: f4563e70 ESP: f4563e6c
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process rmmod (pid: 5817, ti=f4562000 task=f4504550 task.ti=f4562000)
Stack:
00000000 f4563e88 f8de3cb4 00000010 f6aab6c0 00000282 00000010 f4563ea8
<0> c046d228 f705ec78 00000282 c08de3bc 00000010 c08de380 f705ec78 f4563ebc
<0> c046d28f f705ec78 f7113000 f8f00000 f4563ed0 f8dea27f f7113000 f8def9a8
Call Trace:
[<f8de3cb4>] ? ath_isr+0x25/0x189 [ath9k]
[<c046d228>] ? __free_irq+0x11e/0x15e
[<c046d28f>] ? free_irq+0x27/0x3a
[<f8dea27f>] ? ath_pci_remove+0x2f/0x54 [ath9k]
[<c05816da>] ? pci_device_remove+0x19/0x39
[<c06036d6>] ? __device_release_driver+0x59/0x9d
[<c0603781>] ? driver_detach+0x67/0x85
[<c0602c9d>] ? bus_remove_driver+0x69/0x85
[<c0603b92>] ? driver_unregister+0x4b/0x52
[<c05818a9>] ? pci_unregister_driver+0x2d/0x6e
[<f8dea171>] ? ath_pci_exit+0xd/0xf [ath9k]
[<f8dec664>] ? ath9k_exit+0x8/0x2f [ath9k]
[<c0455232>] ? sys_delete_module+0x16f/0x1c0
[<c07458dc>] ? do_page_fault+0x26a/0x2c5
[<c074590a>] ? do_page_fault+0x298/0x2c5
[<c0402fdc>] ? sysenter_do_call+0x12/0x28
Code: 80 4b 06 10 31 c9 83 c4 68 89 c8 5b 5e 5f 5d c3 55 b9 0c 00 00 00 89 e5 53 8b 98 94 00 00 00 ff
EIP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw] SS:ESP 0068:f4563e6c
CR2: 00000000000000a4
---[ end trace 43bc6f57caff1689 ]---
Killed
Jul 5 1


--
Ben Greear <[email protected]>
Candela Technologies Inc http://www.candelatech.com