2009-08-24 20:08:37

by Larry Finger

[permalink] [raw]
Subject: Kernel Panic in __ieee80211_tx with p43usb as AP

In trying to track down a WARNING reported while using p54usb as the
basis for an AP (http://bugzilla.kernel.org/show_bug.cgi?id=13725), I
created an AP using hostapd 0.6.8. It worked fine as long as I used a
Linux client. I ran repeated tcpperf runs through it to my server, and
repeated installations of b43 firmware. That routine uses wget to pull
the driver files. The only machine I had available as a client does
not include X, so I could not run a browser.

All went well until I had a Windows Vista client connect to the
network. As soon as I launched a browser, the kernel on the AP crashed.

The kernel in question is 2.6.31-rc7-Linus-00012-g3edf2fb from the
mainline tree. I do not know the reported reason for the panic, as
that scrolls off the screen. The traceback shows the error to be in
__ieee80211_tx in this statement: ret = drv_tx(local, skb), which
makes the problem be here:

static inline int drv_tx(struct ieee80211_local *local, struct sk_buff
*skb)
{
return local->ops->tx(&local->hw, skb);
}

Are there any suggest changes that would let me debug this problem
without crashing the kernel?

Thanks,

Larry



2009-08-24 20:17:28

by Johannes Berg

[permalink] [raw]
Subject: Re: Kernel Panic in __ieee80211_tx with p43usb as AP

On Mon, 2009-08-24 at 15:07 -0500, Larry Finger wrote:

> All went well until I had a Windows Vista client connect to the
> network. As soon as I launched a browser, the kernel on the AP crashed.

Rather strange.

> The kernel in question is 2.6.31-rc7-Linus-00012-g3edf2fb from the
> mainline tree. I do not know the reported reason for the panic, as
> that scrolls off the screen. The traceback shows the error to be in
> __ieee80211_tx in this statement: ret = drv_tx(local, skb), which
> makes the problem be here:
>
> static inline int drv_tx(struct ieee80211_local *local, struct sk_buff
> *skb)
> {
> return local->ops->tx(&local->hw, skb);
> }
>
> Are there any suggest changes that would let me debug this problem
> without crashing the kernel?

Are you sure it's right there, and not maybe in p54's tx routine which
gets called from here? I mean, the only reason I see for this particular
line of code to go wrong would be corruption of the "local",
"local->ops", or "local->ops->tx" pointers, which seems rather unlikely.

johannes


Attachments:
signature.asc (801.00 B)
This is a digitally signed message part

2009-08-24 20:19:13

by Bob Copeland

[permalink] [raw]
Subject: Re: Kernel Panic in __ieee80211_tx with p43usb as AP

On Mon, Aug 24, 2009 at 4:07 PM, Larry Finger<[email protected]> wrote:
> static inline int drv_tx(struct ieee80211_local *local, struct sk_buff
> *skb)
> {
> ? ? ? ?return local->ops->tx(&local->hw, skb);
> }
>
> Are there any suggest changes that would let me debug this problem
> without crashing the kernel?

Could be a callback into mac80211, e.g. ieee80211_get_tx_rate()
returning null (I haven't looked at any p54 code, I just know I've hit
one there before with ath5k).

--
Bob Copeland %% http://www.bobcopeland.com