All of lore.kernel.org
 help / color / mirror / Atom feed
From: Felix Fietkau <nbd@openwrt.org>
To: Tom Hughes <tom@compton.nu>
Cc: linville@tuxdriver.com, linux-wireless@vger.kernel.org,
	ath9k-devel@lists.ath9k.org, mcgrof@qca.qualcomm.com,
	jouni@qca.qualcomm.com, vthiagar@qca.qualcomm.com,
	senthilb@qca.qualcomm.com
Subject: Re: [PATCH] ath9k: fix panic caused by returning a descriptor we have queued for reuse
Date: Wed, 27 Jun 2012 23:22:17 +0200	[thread overview]
Message-ID: <4FEB7989.80708@openwrt.org> (raw)
In-Reply-To: <1340817675-26911-1-git-send-email-tom@compton.nu>

On 2012-06-27 7:21 PM, Tom Hughes wrote:
> Commit 3a2923e83c introduced a bug when a corrupt descriptor
> is encountered - although the following descriptor is discarded
> and returned to the queue for reuse the associated frame is
> also returned for processing. This leads to a panic:
> 
> BUG: unable to handle kernel NULL pointer dereference at 000000000000003a
> IP: [<ffffffffa02599a5>] ath_rx_tasklet+0x165/0x1b00 [ath9k]
> Call Trace:
> <IRQ>
> [<ffffffff812d7fa0>] ? map_single+0x60/0x60
> [<ffffffffa028f044>] ? ath9k_ioread32+0x34/0x90 [ath9k]
> [<ffffffffa0292eec>] athk9k_tasklet+0xdc/0x160 [ath9k]
> [<ffffffff8105e133>] tasklet_action+0x63/0xd0
> [<ffffffff8105dbc0>] __do_softirq+0xc0/0x1e0
> [<ffffffff8101a873>] ? native_sched_clock+0x13/0x80
> [<ffffffff815f9d5c>] call_softirq+0x1c/0x30
> [<ffffffff810151f5>] do_softirq+0x75/0xb0
> [<ffffffff8105df95>] irq_exit+0xb5/0xc0
> [<ffffffff815fa5b3>] do_IRQ+0x63/0xe0
> [<ffffffff815f0cea>] common_interrupt+0x6a/0x6a
> <EOI>
> [<ffffffff8131840a>] ? intel_idle+0xea/0x150
> [<ffffffff813183eb>] ? intel_idle+0xcb/0x150
> [<ffffffff814a1db9>] cpuidle_enter+0x19/0x20
> [<ffffffff814a23d9>] cpuidle_idle_call+0xa9/0x240
> [<ffffffff8101c4bf>] cpu_idle+0xaf/0x120
> [<ffffffff815cda8e>] rest_init+0x72/0x74
> [<ffffffff81cf4c1a>] start_kernel+0x3b7/0x3c4
> [<ffffffff81cf4662>] ? repair_env_string+0x5e/0x5e
> [<ffffffff81cf4346>] x86_64_start_reservations+0x131/0x135
> [<ffffffff81cf444a>] x86_64_start_kernel+0x100/0x10f
> 
> Making sure bf is cleared to NULL in this case restores the
> old behaviour.
> 
> Signed-off-by: Tom Hughes <tom@compton.nu>
Acked-by: Felix Fietkau <nbd@openwrt.org>

WARNING: multiple messages have this Message-ID (diff)
From: Felix Fietkau <nbd@openwrt.org>
To: ath9k-devel@lists.ath9k.org
Subject: [ath9k-devel] [PATCH] ath9k: fix panic caused by returning a descriptor we have queued for reuse
Date: Wed, 27 Jun 2012 23:22:17 +0200	[thread overview]
Message-ID: <4FEB7989.80708@openwrt.org> (raw)
In-Reply-To: <1340817675-26911-1-git-send-email-tom@compton.nu>

On 2012-06-27 7:21 PM, Tom Hughes wrote:
> Commit 3a2923e83c introduced a bug when a corrupt descriptor
> is encountered - although the following descriptor is discarded
> and returned to the queue for reuse the associated frame is
> also returned for processing. This leads to a panic:
> 
> BUG: unable to handle kernel NULL pointer dereference at 000000000000003a
> IP: [<ffffffffa02599a5>] ath_rx_tasklet+0x165/0x1b00 [ath9k]
> Call Trace:
> <IRQ>
> [<ffffffff812d7fa0>] ? map_single+0x60/0x60
> [<ffffffffa028f044>] ? ath9k_ioread32+0x34/0x90 [ath9k]
> [<ffffffffa0292eec>] athk9k_tasklet+0xdc/0x160 [ath9k]
> [<ffffffff8105e133>] tasklet_action+0x63/0xd0
> [<ffffffff8105dbc0>] __do_softirq+0xc0/0x1e0
> [<ffffffff8101a873>] ? native_sched_clock+0x13/0x80
> [<ffffffff815f9d5c>] call_softirq+0x1c/0x30
> [<ffffffff810151f5>] do_softirq+0x75/0xb0
> [<ffffffff8105df95>] irq_exit+0xb5/0xc0
> [<ffffffff815fa5b3>] do_IRQ+0x63/0xe0
> [<ffffffff815f0cea>] common_interrupt+0x6a/0x6a
> <EOI>
> [<ffffffff8131840a>] ? intel_idle+0xea/0x150
> [<ffffffff813183eb>] ? intel_idle+0xcb/0x150
> [<ffffffff814a1db9>] cpuidle_enter+0x19/0x20
> [<ffffffff814a23d9>] cpuidle_idle_call+0xa9/0x240
> [<ffffffff8101c4bf>] cpu_idle+0xaf/0x120
> [<ffffffff815cda8e>] rest_init+0x72/0x74
> [<ffffffff81cf4c1a>] start_kernel+0x3b7/0x3c4
> [<ffffffff81cf4662>] ? repair_env_string+0x5e/0x5e
> [<ffffffff81cf4346>] x86_64_start_reservations+0x131/0x135
> [<ffffffff81cf444a>] x86_64_start_kernel+0x100/0x10f
> 
> Making sure bf is cleared to NULL in this case restores the
> old behaviour.
> 
> Signed-off-by: Tom Hughes <tom@compton.nu>
Acked-by: Felix Fietkau <nbd@openwrt.org>

  reply	other threads:[~2012-06-27 21:22 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-06-27 17:21 [PATCH] ath9k: fix panic caused by returning a descriptor we have queued for reuse Tom Hughes
2012-06-27 17:21 ` [ath9k-devel] " Tom Hughes
2012-06-27 21:22 ` Felix Fietkau [this message]
2012-06-27 21:22   ` Felix Fietkau
2012-06-28  1:09 ` Sujith Manoharan
2012-06-28  1:09   ` [ath9k-devel] " Sujith Manoharan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4FEB7989.80708@openwrt.org \
    --to=nbd@openwrt.org \
    --cc=ath9k-devel@lists.ath9k.org \
    --cc=jouni@qca.qualcomm.com \
    --cc=linux-wireless@vger.kernel.org \
    --cc=linville@tuxdriver.com \
    --cc=mcgrof@qca.qualcomm.com \
    --cc=senthilb@qca.qualcomm.com \
    --cc=tom@compton.nu \
    --cc=vthiagar@qca.qualcomm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.