> > hmm, looks like someone tries to skb_push on a NULL skb. hmmmm, > > can you please enable ksym, it's a bit hard to see the obvious bug here. > [ 1612.708465] skb_over_panic: text:bf000544 len:88 put:88 head:c78f4000 data:c78f4020 tail:0xc78f4078 end:0xc78f4020 dev:<NULL> I see here valid skb with size 0x20, where we try to put 88 more bytes. That's because p54spi_probe calls __dev_alloc_skb before p54spi_request_firmware. It's working with the following change: diff --git a/drivers/net/wireless/p54/p54spi.c b/drivers/net/wireless/p54/p54spi.c index ab5b9b8..ff73a64 100644 --- a/drivers/net/wireless/p54/p54spi.c +++ b/drivers/net/wireless/p54/p54spi.c @@ -651,11 +651,6 @@ static int __devinit p54spi_probe(struct spi_device *spi) priv->common.stop = p54spi_op_stop; priv->common.tx = p54spi_op_tx; - skb = __dev_alloc_skb(priv->common.rx_mtu, GFP_KERNEL); - if (!skb) - goto err_free_common; - skb_queue_tail(&priv->rx_pool, skb); - ret = p54spi_request_firmware(hw); if (ret < 0) goto err_free_common; @@ -664,6 +659,11 @@ static int __devinit p54spi_probe(struct spi_device *spi) if (ret) goto err_free_common; + skb = __dev_alloc_skb(priv->common.rx_mtu, GFP_KERNEL); + if (!skb) + goto err_free_common; + skb_queue_tail(&priv->rx_pool, skb); + ret = p54_register_common(hw, &priv->spi->dev); if (ret) goto err_free_common; Still cannot stress-test it: it hangs in IBSS mode (I suspect rate control) and it cannot initialize mesh: firmware doesn't respond after beacon submission. Does mesh work now with USB/PCI? Thanks. -- Max -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
