Johannes Berg wrote:
On Thu, 2008-01-24 at 00:16 -0700, Larry Finger wrote:
I have been having "random" kernel panics where the "Caps Lock" LED is flashing at ~1 Hz. These
crashes only occur for the wireless-2.6 tree and have been happening for roughly 3 weeks. After
running a memory test to ensure that these panics were not caused by a hardware problem, I enabled
netconsole logging and caught the following crash report for my x86_64 system:
Code: f6 44 02 08 10 74 12 45 85 ed 78 05 44 39 e9 7f 08 89 8f 24
RIP [<ffffffff88202940>] :mac80211:rate_control_pid_tx_status+0x426/0x45a
Damn, I've seen that too but blamed it on my own patching. Stefano, any
idea? IIRC some sta struct was NULL in pid_tx_status.
The problem is not a NULL in one of the structs, but a runaway loop. The error occurs in the
following loop in rate_control_pid_adjust_rate():
while (newidx != sta->txrate) {
if (rate_supported(sta, mode, newidx) &&
(maxrate < 0 || newidx <= maxrate)) {
sta->txrate = newidx;
break;
}
newidx += back;
}
The panic triggers in rate_supported(), which is compiled in-line, with newidx having a value of 576
at the time of the panic!! I'm not sure of the fix, but I think newindex should always be <=
mode->num_rates. The following patch should cure the crash, but may not be the best fix.
Index: wireless-2.6/net/mac80211/rc80211_pid_algo.c
===================================================================
--- wireless-2.6.orig/net/mac80211/rc80211_pid_algo.c
+++ wireless-2.6/net/mac80211/rc80211_pid_algo.c
@@ -123,6 +123,8 @@ static void rate_control_pid_adjust_rate
}
newidx += back;
+ if (newidx < 0 || newidx >= mode->num_rates)
+ return;
}
#ifdef CONFIG_MAC80211_DEBUGFS
This patch has been compile tested at the moment, but it will get further testing after this E-mail
is sent.
Larry
-
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
