Correcting stable address ...
On 12/10/18 13:37, Jon Hunter wrote:
> [1.] One line summary of the problem:
> brcmfmac driver crashes on resuming if no firmware is loaded
>
> [2.] Full description of the problem/report:
> In stable-v4.4, if the brcmfmac driver fails to load the required
> firmware on boot for an SDIO based device, then the driver fails
> to remove one of the two devices it registered during probe with
> the kernel. If the kernel then enters suspend, on resume the
> kernel tries to resume the device registered by brcmfmac driver
> and crashes due to a NULL pointer deference (see 6 below).
>
> This issue is seen in stable-v4.4 but not in stable-v4.9 and I
> believe is fixed by commit 7a51461fc2da ("brcmfmac: unbind all
> devices upon failure in firmware callback"). Unfortunately, this
> fix is dependent on other changes and so is not easily
> back-ported AFAICT.
>
> This issue is seen on Tegra20 Ventana and Tegra30 Cardhu.
>
> [3.] Keywords (i.e., modules, networking, kernel):
> BROADCOM BRCM80211
>
> [4.] Kernel information
> [4.1.] Kernel version (from /proc/version):
> Linux version 4.4.160-rc1-00116-g5826f1d1ce56
> [4.2.] Kernel .config file:
> Generated using tegra_defconfig
>
> [5.] Most recent kernel version which did not have the bug:
> Not seen in current mainline or -next.
>
> [6.] Output of Oops.. message (if applicable) with symbolic information
>
> [ 51.941094] Unable to handle kernel NULL pointer dereference at virtual address 00000000
>
> [ 51.949836] pgd = eee54000
>
> [ 51.952771] [00000000] *pgd=2db16831, *pte=00000000, *ppte=00000000
>
> [ 51.959722] Internal error: Oops: 17 [#1] SMP ARM
>
> [ 51.964774] Modules linked in: snd_soc_tegra_wm8903 snd_soc_wm8903 snd_soc_tegra_utils snd_soc_core snd_pcm_dmaengine snd_pcm brcmfmac brcmutil cfg80211 snd_timer snd soundcore ac97_bus snd_soc_tegra20_das
>
> [ 51.984922] CPU: 1 PID: 512 Comm: rtcwake Not tainted 4.4.160-rc1-00116-g5826f1d1ce56 #1
>
> [ 51.993577] Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
>
> [ 52.000303] task: eefa3900 ti: ed93c000 task.ti: ed93c000
>
> [ 52.006294] PC is at brcmf_ops_sdio_resume+0x10/0x5c [brcmfmac]
>
> [ 52.012672] LR is at pm_generic_resume+0x2c/0x38
>
> [ 52.017641] pc : [<bf12bbb8>] lr : [<c06502d4>] psr: 60000113
>
> [ 52.017641] sp : ed93ddb8 ip : eed72e74 fp : c0f4a2d8
>
> [ 52.029914] r10: c0fa7580 r9 : 00000010 r8 : 00000000
>
> [ 52.035522] r7 : 00000010 r6 : eed7303c r5 : 00000001 r4 : c06502a8
>
> [ 52.042514] r3 : 00000000 r2 : 00000002 r1 : eed73008 r0 : eed73008
>
> [ 52.049511] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
>
> [ 52.057156] Control: 10c5387d Table: 2ee5404a DAC: 00000051
>
> [ 52.063319] Process rtcwake (pid: 512, stack limit = 0xed93c220)
>
> [ 52.069761] Stack: (0xed93ddb8 to 0xed93e000)
>
> [ 52.074450] dda0: c06502a8 c06502d4
>
> [ 52.083225] ddc0: c0cae914 c0653674 17c10408 c027fc00 eed72e08 eed73008 00000001 c0653cdc
>
> [ 52.091993] dde0: eed73070 eed73008 c0fa7548 c0fa7578 c104ce7c c0655018 c0f4a2d8 c0654ee8
>
> [ 52.100757] de00: 0ea73a40 0000000c 0ea73a40 0000000c 0e3050d8 00000010 00000003 00000000
>
> [ 52.109529] de20: c0f1650c c10109f4 c0f170a4 00000000 00000000 c06552e8 c10109f4 c02870b0
>
> [ 52.118399] de40: 00000000 c028a464 c0d3b71c ed93de6c c0f49314 c02cd350 00000003 c10109f4
>
> [ 52.127166] de60: 00000003 00000000 00000003 edbb45c0 00000004 00000000 00000000 c0287540
>
> [ 52.135933] de80: 00000003 c0c8401c c1010a04 c02862fc 00000004 ee8f86e0 edbb45c0 edbb4fcc
>
> [ 52.144698] dea0: 00000004 ed93df80 00028290 c048c684 00000004 c036dec8 c036de84 edbb4fc0
>
> [ 52.169613] dec0: edbb45c0 c036d70c 00000000 00000000 000081a4 c0a0113c 00028290 eee13b40
>
> [ 52.194484] dee0: ed93df80 00000004 00028290 00000000 00000005 c030f990 c0f1ba64 ed93dfb0
>
> [ 52.219219] df00: 00002710 000001ff b6fb42e4 c020a29c 5a9fd343 0b532b80 5a9fd343 0b532b80
>
> [ 52.244031] df20: 0000050e 00000000 eee13b40 becb54b8 00028128 00028128 000000c5 eee13b40
>
> [ 52.268893] df40: eee13b40 00028290 ed93df80 00000004 00000004 c031018c 0000000f 000081a4
>
> [ 52.293765] df60: 00000001 00000000 00000000 eee13b40 eee13b40 00000004 00028290 c0310994
>
> [ 52.318818] df80: 00000000 00000000 5a9fd343 00000004 00028290 00028128 00000004 c0210c44
>
> [ 52.343980] dfa0: ed93c000 c0210a80 00000004 00028290 00000004 00028290 00000004 00000000
>
> [ 52.369292] dfc0: 00000004 00028290 00028128 00000004 00014f40 00026180 00014ca4 00000005
>
> [ 52.394701] dfe0: 00000000 becb5a1c b6f3479b b6f700d6 000f0030 00000004 00000000 00000000
>
> [ 52.420294] [<bf12bbb8>] (brcmf_ops_sdio_resume [brcmfmac]) from [<c06502d4>] (pm_generic_resume+0x2c/0x38)
>
> [ 52.447649] [<c06502d4>] (pm_generic_resume) from [<c0653674>] (dpm_run_callback+0x1c/0x58)
>
> [ 52.474009] [<c0653674>] (dpm_run_callback) from [<c0653cdc>] (device_resume+0x98/0x260)
>
> [ 52.500177] [<c0653cdc>] (device_resume) from [<c0655018>] (dpm_resume+0x100/0x228)
>
> [ 52.525931] [<c0655018>] (dpm_resume) from [<c06552e8>] (dpm_resume_end+0xc/0x18)
>
> [ 52.551807] [<c06552e8>] (dpm_resume_end) from [<c02870b0>] (suspend_devices_and_enter+0x124/0x420)
>
> [ 52.579701] [<c02870b0>] (suspend_devices_and_enter) from [<c0287540>] (pm_suspend+0x194/0x254)
>
> [ 52.607599] [<c0287540>] (pm_suspend) from [<c02862fc>] (state_store+0x6c/0xbc)
>
> [ 52.634364] [<c02862fc>] (state_store) from [<c048c684>] (kobj_attr_store+0x14/0x20)
>
> [ 52.661518] [<c048c684>] (kobj_attr_store) from [<c036dec8>] (sysfs_kf_write+0x44/0x48)
>
> [ 52.688909] [<c036dec8>] (sysfs_kf_write) from [<c036d70c>] (kernfs_fop_write+0xbc/0x1b0)
>
> [ 52.716566] [<c036d70c>] (kernfs_fop_write) from [<c030f990>] (__vfs_write+0x24/0xd8)
>
> [ 52.743917] [<c030f990>] (__vfs_write) from [<c031018c>] (vfs_write+0x94/0x154)
>
> [ 52.770230] [<c031018c>] (vfs_write) from [<c0310994>] (SyS_write+0x40/0x94)
>
> [ 52.795713] [<c0310994>] (SyS_write) from [<c0210a80>] (ret_fast_syscall+0x0/0x48)
>
> [ 52.821478] Code: e92d4010 e590218c e5903058 e3520002 (e5934000)
>
> [ 52.845762] ---[ end trace d797b5b1ce195377 ]---
>
--
nvpublic
