On Mon, 2009-01-05 at 15:10 -0600, Larry Finger wrote:
> Johannes Berg wrote:
> >
> > Does the backtrace continue beyond what you pasted?
>
> Yes, here is the whole thing.
Thanks.
> [<ffffffff8023afce>] warn_on_slowpath+0x58/0x7d
> [<ffffffffa029e98b>] ieee80211_master_start_xmit+0x41c/0x50d [mac80211]
> [<ffffffff803cf0a4>] dev_hard_start_xmit+0x214/0x28f
> [<ffffffff803cf584>] dev_queue_xmit+0x357/0x48f
> [<ffffffffa029fa0e>] ieee80211_tx_skb+0x60/0x62 [mac80211]
> [<ffffffffa0293c61>] ieee80211_send_probe_req+0x1d2/0x1e1 [mac80211]
> [<ffffffffa0290c1b>] ieee80211_scan_work+0x155/0x17a [mac80211]
> [<ffffffff8024ac68>] run_workqueue+0x103/0x20a
> [<ffffffff8024ae4f>] worker_thread+0xe0/0xf1
> [<ffffffff8024e664>] kthread+0x49/0x76
> [<ffffffff8020d0c9>] child_rip+0xa/0x11
That's rather strange, I see no way for this path to attempt sending an
SKB that has since been freed. Unless... yes, here's a problem:
rtl8187_tx is not supposed to return error codes, it's supposed to
return NETDEV_TX_{OK,BUSY}.
This should fix it:
--- wireless-testing.orig/drivers/net/wireless/rtl818x/rtl8187_dev.c 2009-01-05 22:22:04.000000000 +0100
+++ wireless-testing/drivers/net/wireless/rtl818x/rtl8187_dev.c 2009-01-05 22:22:59.000000000 +0100
@@ -213,7 +213,7 @@ static int rtl8187_tx(struct ieee80211_h
urb = usb_alloc_urb(0, GFP_ATOMIC);
if (!urb) {
kfree_skb(skb);
- return -ENOMEM;
+ return NETDEV_TX_OK;
}
flags = skb->len;
@@ -281,7 +281,7 @@ static int rtl8187_tx(struct ieee80211_h
}
usb_free_urb(urb);
- return rc;
+ return NETDEV_TX_OK;
}
static void rtl8187_rx_cb(struct urb *urb)
johannes
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
