* [regression] iwlwifi: crash in iwl_parse_tlv_firmware()
@ 2017-01-29 13:56 Kalle Valo
2017-01-29 14:04 ` Kalle Valo
0 siblings, 1 reply; 6+ messages in thread
From: Kalle Valo @ 2017-01-29 13:56 UTC (permalink / raw)
To: linux-wireless; +Cc: linuxwifi
Hi,
updated the kernel on my test laptop and noticed that now iwlwifi
crashes every time during boot. This is with tag ath-201701271935
ath.git master branch, which essentially is wt-2017-01-27 from
wireless-testing plus latest ath patches.
I tried v4.10-rc5 and iwlwifi didn't crash so my guess is that this is a
regression in the latest iwlwifi pull. Below is the crash log and the
location in source. This is all I got via netconsole.
[ 39.296218] Intel(R) Wireless WiFi driver for Linux
[ 39.296219] Copyright(c) 2003- 2015 Intel Corporation
[ 39.299373] iwlwifi 0000:44:00.0: can't disable ASPM; OS doesn't have ASPM control
[ 39.677192] BUG: unable to handle kernel NULL pointer dereference at 0000000c
[ 39.677212] IP: iwl_parse_tlv_firmware.isra.5+0x9a0/0xd60 [iwlwifi]
[ 39.677213] *pdpt = 000000002f5bd001 *pde = 0000000000000000
[ 39.677215]
[ 39.677217] Oops: 0002 [#1] SMP
[ 39.677219] Modules linked in: btrtl(+) snd_seq_midi_event btbcm rfcomm(+) iwlwifi snd_rawmidi btintel bnep joydev input_leds coretemp cfg80211 bluetooth snd_seq snd_timer serio_raw snd_seq_device wmi snd video mac_hid soundcore lpc_ich shpchp parport_pc ppdev lp parport psmouse firewire_ohc
[ 39.677244] CPU: 3 PID: 35 Comm: kworker/3:1 Not tainted 4.10.0-rc5-wt-ath+ #173
[ 39.677245] Hardware name: Hewlett-Packard HP ProBook 6540b/1722, BIOS 68CDD Ver. F.04 01/27/2010
[ 39.677252] Workqueue: events request_firmware_work_func
[ 39.677254] task: f387bac0 task.stack: f3916000
[ 39.677263] EIP: iwl_parse_tlv_firmware.isra.5+0x9a0/0xd60 [iwlwifi]
[ 39.677264] EFLAGS: 00010293 CPU: 3
[ 39.677266] EAX: 00000000 EBX: 0001ec18 ECX: f8fc2060 EDX: 000339f8
[ 39.677267] ESI: f8fc2058 EDI: f8fe0c78 EBP: f3917e54 ESP: f3917df8
[ 39.677268] DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
[ 39.677270] CR0: 80050033 CR2: 0000000c CR3: 3033cd20 CR4: 000006f0
[ 39.677271] Call Trace:
gdb drivers/net/wireless/intel/iwlwifi/iwlwifi.ko
(gdb) l *(iwl_parse_tlv_firmware+0x9a0)
0x2170 is in iwl_parse_tlv_firmware (drivers/net/wireless/intel/iwlwifi/iwl-drv.c:299).
294 static void set_sec_data(struct iwl_firmware_pieces *pieces,
295 enum iwl_ucode_type type,
296 int sec,
297 const void *data)
298 {
299 pieces->img[type].sec[sec].data = data;
300 }
301
302 static void set_sec_size(struct iwl_firmware_pieces *pieces,
303 enum iwl_ucode_type type,
(gdb)
--
Kalle Valo
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [regression] iwlwifi: crash in iwl_parse_tlv_firmware() 2017-01-29 13:56 [regression] iwlwifi: crash in iwl_parse_tlv_firmware() Kalle Valo @ 2017-01-29 14:04 ` Kalle Valo 2017-01-30 10:34 ` [PATCH] iwlwifi: alloc memory dynamically also for DVM Luca Coelho 0 siblings, 1 reply; 6+ messages in thread From: Kalle Valo @ 2017-01-29 14:04 UTC (permalink / raw) To: linux-wireless; +Cc: linuxwifi Kalle Valo <kvalo@codeaurora.org> writes: > updated the kernel on my test laptop and noticed that now iwlwifi > crashes every time during boot. This is with tag ath-201701271935 > ath.git master branch, which essentially is wt-2017-01-27 from > wireless-testing plus latest ath patches. > > I tried v4.10-rc5 and iwlwifi didn't crash so my guess is that this is a > regression in the latest iwlwifi pull. Below is the crash log and the > location in source. This is all I got via netconsole. Forgot to include info about the device (from a working kernel): [ 17.911087] iwlwifi 0000:44:00.0: can't disable ASPM; OS doesn't have ASPM control [ 17.931205] iwlwifi 0000:44:00.0: loaded firmware version 39.31.5.1 build 35138 op_mode iwldvm [ 18.073590] iwlwifi 0000:44:00.0: CONFIG_IWLWIFI_DEBUG enabled [ 18.073679] iwlwifi 0000:44:00.0: CONFIG_IWLWIFI_DEBUGFS enabled [ 18.073757] iwlwifi 0000:44:00.0: CONFIG_IWLWIFI_DEVICE_TRACING enabled [ 18.073837] iwlwifi 0000:44:00.0: Detected Intel(R) Centrino(R) Wireless-N 1000 BGN, REV=0x6C [ 18.078383] iwlwifi 0000:44:00.0: L1 Enabled - LTR Disabled [ 19.359378] iwlwifi 0000:44:00.0 wlan1: renamed from wlan0 -- Kalle Valo ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH] iwlwifi: alloc memory dynamically also for DVM 2017-01-29 14:04 ` Kalle Valo @ 2017-01-30 10:34 ` Luca Coelho 2017-01-30 11:40 ` Kalle Valo 2017-01-31 7:11 ` Kalle Valo 0 siblings, 2 replies; 6+ messages in thread From: Luca Coelho @ 2017-01-30 10:34 UTC (permalink / raw) To: kvalo; +Cc: linux-wireless, Sara Sharon, Luca Coelho From: Sara Sharon <sara.sharon@intel.com> For old firmwares the memory wasn't allocated, resulting in panic. Make it dynamically allocated as well. Allow any order of functions call. Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections") Signed-off-by: Sara Sharon <sara.sharon@intel.com> Signed-off-by: Luca Coelho <luciano.coelho@intel.com> --- Kalle, Could you test this patch to see if it solves the problem? Thanks! drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c index 1d1af4bc1530..d22821501676 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -291,11 +291,33 @@ static struct fw_sec *get_sec(struct iwl_firmware_pieces *pieces, return &pieces->img[type].sec[sec]; } +static void alloc_sec_data(struct iwl_firmware_pieces *pieces, + enum iwl_ucode_type type, + int sec) +{ + struct fw_img_parsing *img = &pieces->img[type]; + struct fw_sec *sec_memory; + int size = sec + 1; + size_t alloc_size = sizeof(*img->sec) * size; + + if (img->sec && img->sec_counter >= size) + return; + + sec_memory = krealloc(img->sec, alloc_size, GFP_KERNEL); + if (!sec_memory) + return; + + img->sec = sec_memory; + img->sec_counter = size; +} + static void set_sec_data(struct iwl_firmware_pieces *pieces, enum iwl_ucode_type type, int sec, const void *data) { + alloc_sec_data(pieces, type, sec); + pieces->img[type].sec[sec].data = data; } @@ -304,6 +326,8 @@ static void set_sec_size(struct iwl_firmware_pieces *pieces, int sec, size_t size) { + alloc_sec_data(pieces, type, sec); + pieces->img[type].sec[sec].size = size; } @@ -319,6 +343,8 @@ static void set_sec_offset(struct iwl_firmware_pieces *pieces, int sec, u32 offset) { + alloc_sec_data(pieces, type, sec); + pieces->img[type].sec[sec].offset = offset; } -- 2.11.0 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] iwlwifi: alloc memory dynamically also for DVM 2017-01-30 10:34 ` [PATCH] iwlwifi: alloc memory dynamically also for DVM Luca Coelho @ 2017-01-30 11:40 ` Kalle Valo 2017-01-30 11:42 ` Luca Coelho 2017-01-31 7:11 ` Kalle Valo 1 sibling, 1 reply; 6+ messages in thread From: Kalle Valo @ 2017-01-30 11:40 UTC (permalink / raw) To: Luca Coelho; +Cc: linux-wireless, Sara Sharon, Luca Coelho Luca Coelho <luca@coelho.fi> writes: > From: Sara Sharon <sara.sharon@intel.com> > > For old firmwares the memory wasn't allocated, resulting in panic. > Make it dynamically allocated as well. Allow any order of functions > call. > > Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections") > Signed-off-by: Sara Sharon <sara.sharon@intel.com> > Signed-off-by: Luca Coelho <luciano.coelho@intel.com> > --- > > Kalle, > > Could you test this patch to see if it solves the problem? It does, thank you for quickly fixing this. Tested-by: Kalle Valo <kvalo@codeaurora.org> As this is a serious regression can I apply this directly to wireless-drivers-next? -- Kalle Valo ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] iwlwifi: alloc memory dynamically also for DVM 2017-01-30 11:40 ` Kalle Valo @ 2017-01-30 11:42 ` Luca Coelho 0 siblings, 0 replies; 6+ messages in thread From: Luca Coelho @ 2017-01-30 11:42 UTC (permalink / raw) To: Kalle Valo; +Cc: linux-wireless, Sara Sharon On Mon, 2017-01-30 at 13:40 +0200, Kalle Valo wrote: > Luca Coelho <luca@coelho.fi> writes: > > > From: Sara Sharon <sara.sharon@intel.com> > > > > For old firmwares the memory wasn't allocated, resulting in panic. > > Make it dynamically allocated as well. Allow any order of functions > > call. > > > > Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections") > > Signed-off-by: Sara Sharon <sara.sharon@intel.com> > > Signed-off-by: Luca Coelho <luciano.coelho@intel.com> > > --- > > > > Kalle, > > > > Could you test this patch to see if it solves the problem? > > It does, thank you for quickly fixing this. > > Tested-by: Kalle Valo <kvalo@codeaurora.org> Great! Thanks a lot for testing it quickly. :) > As this is a serious regression can I apply this directly to > wireless-drivers-next? Yes, please go ahead. -- Cheers, Luca. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: iwlwifi: alloc memory dynamically also for DVM 2017-01-30 10:34 ` [PATCH] iwlwifi: alloc memory dynamically also for DVM Luca Coelho 2017-01-30 11:40 ` Kalle Valo @ 2017-01-31 7:11 ` Kalle Valo 1 sibling, 0 replies; 6+ messages in thread From: Kalle Valo @ 2017-01-31 7:11 UTC (permalink / raw) To: Luciano Coelho; +Cc: linux-wireless, Sara Sharon, Luca Coelho Luciano Coelho <luca@coelho.fi> wrote: > From: Sara Sharon <sara.sharon@intel.com> > > For old firmwares the memory wasn't allocated, resulting in panic. > Make it dynamically allocated as well. Allow any order of functions > call. > > Fixes: eef187a7b8a1 ("iwlwifi: enlarge number of ucode sections") > Signed-off-by: Sara Sharon <sara.sharon@intel.com> > Signed-off-by: Luca Coelho <luciano.coelho@intel.com> > Tested-by: Kalle Valo <kvalo@codeaurora.org> Patch applied to wireless-drivers-next.git, thanks. d546530e5694 iwlwifi: alloc memory dynamically also for DVM -- https://patchwork.kernel.org/patch/9544763/ Documentation about submitting wireless patches and checking status from patchwork: https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2017-01-31 7:11 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2017-01-29 13:56 [regression] iwlwifi: crash in iwl_parse_tlv_firmware() Kalle Valo 2017-01-29 14:04 ` Kalle Valo 2017-01-30 10:34 ` [PATCH] iwlwifi: alloc memory dynamically also for DVM Luca Coelho 2017-01-30 11:40 ` Kalle Valo 2017-01-30 11:42 ` Luca Coelho 2017-01-31 7:11 ` Kalle Valo
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.