Bug 447105

Summary: kernel-2.6.26-0.13.rc2.git5.fc10.i686: BUG: unable to handle kernel NULL pointer dereference at 0000009c
Product: [Fedora] Fedora Reporter: Tom London <selinux>
Component: kernelAssignee: John W. Linville <linville>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: low Docs Contact:
Priority: low    
Version: rawhideCC: kernel-maint, nhorman
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-06-13 14:05:59 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Complete /var/log/messages with BUG/Oops
none
the attachement to comment #4 none

Description Tom London 2008-05-17 22:56:06 UTC 
Description of problem:
Get this from kernel-2.6.26-0.13.rc2.git5.fc10.i686, trying to associate with WLAN.

May 17 15:49:40 localhost NetworkManager: <info>  (wlan0): supplicant connection
state change: 0 -> 2
May 17 15:49:44 localhost NetworkManager: <info>  (wlan0): supplicant connection
state change: 2 -> 3
May 17 15:49:44 localhost kernel: BUG: unable to handle kernel NULL pointer
dereference at 0000009c
May 17 15:49:44 localhost kernel: IP: [<f8de32bb>]
:mac80211:ieee80211_associate+0x289/0x524
May 17 15:49:44 localhost kernel: *pde = 7e8f2067 
May 17 15:49:44 localhost kernel: Oops: 0000 [#1] SMP 
May 17 15:49:44 localhost kernel: Modules linked in: ext4dev jbd2 crc16 i915 drm
ib_iser rdma_cm ib_cm iw_cm ib_sa ib_mad ib_core ib_addr iscsi_tcp libiscsi
scsi_transport_iscsi coretemp nf_conntrack_ipv4 ipt_REJECT iptable_filter
ip_tables nf_conntrack_netbios_ns nf_conntrack_ipv6 xt_state nf_conntrack
xt_tcpudp ip6t_ipv6header ip6t_REJECT ip6table_filter ip6_tables x_tables ipv6
cpufreq_ondemand acpi_cpufreq fuse loop kvm_intel kvm sr_mod cdrom ppdev
snd_hda_intel ata_piix thinkpad_acpi snd_seq_dummy ata_generic nsc_ircc
snd_seq_oss arc4 hwmon parport_pc irda crc_ccitt iTCO_wdt parport i2c_i801
snd_seq_midi_event ecb iTCO_vendor_support crypto_blkcipher sg snd_seq
firewire_ohci i2c_core sdhci firewire_core mmc_core pata_acpi snd_seq_device
snd_pcm_oss snd_mixer_oss crc_itu_t ac snd_pcm video snd_timer battery bay
output snd_page_alloc snd_hwdep iwl3945 hci_usb snd mac80211 button bluetooth
e1000e cfg80211 soundcore usb_storage dm_snapshot dm_zero dm_mirror dm_log
dm_mod ahci libata sd_mod scsi_mod ext3 jbd mbcach
May 17 15:49:44 localhost kernel: e uhci_hcd ohci_hcd ehci_hcd [last unloaded:
scsi_wait_scan]
May 17 15:49:44 localhost kernel: 
May 17 15:49:44 localhost kernel: Pid: 977, comm: iwl3945 Not tainted
(2.6.26-0.13.rc2.git5.fc10.i686 #1)
May 17 15:49:44 localhost kernel: EIP: 0060:[<f8de32bb>] EFLAGS: 00010246 CPU: 1
May 17 15:49:44 localhost kernel: EIP is at ieee80211_associate+0x289/0x524
[mac80211]
May 17 15:49:44 localhost kernel: EAX: 0000000a EBX: ebfc9500 ECX: 00000000 EDX:
ebfc9522
May 17 15:49:44 localhost kernel: ESI: 00000000 EDI: 00000000 EBP: f57a1e08 ESP:
f57a1da4
May 17 15:49:44 localhost kernel:  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
May 17 15:49:44 localhost kernel: Process iwl3945 (pid: 977, ti=f57a1000
task=f6c217e0 task.ti=f57a1000)
May 17 15:49:44 localhost kernel: Stack: 00000052 00000246 00000001 f7b7e898
00000018 f7b7e848 f7b7e120 f57a1dd0 
May 17 15:49:44 localhost kernel:        c0505058 f57a1de4 f57a1f4f f50896a4
00000000 00000000 ebfc9522 f4a41c00 
May 17 15:49:44 localhost kernel:        f7b7e8a4 303a3030 37393a64 3a34303a
623a6330 f57a0065 00000002 00000000 
May 17 15:49:44 localhost kernel: Call Trace:
May 17 15:49:44 localhost kernel:  [mac80211:scnprintf+24/38] ? scnprintf+0x18/0x26
May 17 15:49:44 localhost kernel:  [<f8de4d01>] ?
ieee80211_sta_work+0x645/0x1714 [mac80211]
May 17 15:49:44 localhost kernel:  [native_sched_clock+181/209] ?
native_sched_clock+0xb5/0xd1
May 17 15:49:44 localhost kernel:  [native_sched_clock+181/209] ?
native_sched_clock+0xb5/0xd1
May 17 15:49:44 localhost kernel:  [native_sched_clock+181/209] ?
native_sched_clock+0xb5/0xd1
May 17 15:49:44 localhost kernel:  [sched_clock+8/11] ? sched_clock+0x8/0xb
May 17 15:49:44 localhost kernel:  [run_workqueue+211/417] ?
run_workqueue+0xd3/0x1a1
May 17 15:49:44 localhost kernel:  [run_workqueue+145/417] ?
run_workqueue+0x91/0x1a1
May 17 15:49:44 localhost kernel:  [<f8de46bc>] ? ieee80211_sta_work+0x0/0x1714
[mac80211]
May 17 15:49:44 localhost kernel:  [worker_thread+182/194] ? worker_thread+0xb6/0xc2
May 17 15:49:44 localhost kernel:  [<c043be5b>] ? autoremove_wake_function+0x0/0x33
May 17 15:49:44 localhost kernel:  [worker_thread+0/194] ? worker_thread+0x0/0xc2
May 17 15:49:44 localhost kernel:  [kthread+59/97] ? kthread+0x3b/0x61
May 17 15:49:44 localhost kernel:  [kthread+0/97] ? kthread+0x0/0x61
May 17 15:49:44 localhost kernel:  [kernel_thread_helper+7/16] ?
kernel_thread_helper+0x7/0x10
May 17 15:49:44 localhost kernel:  =======================
May 17 15:49:44 localhost kernel: Code: 8b 55 d4 88 42 01 8b 87 80 00 00 00 89
d7 83 c7 02 8b 75 dc 89 c1 c1 e9 02 f3 a5 89 c1 83 e1 03 74 02 f3 a4 8b 4d d0 31
ff 31 f6 <8b> 89 9c 00 00 00 c7 45 c0 00 00 00 00 c7 45 c4 00 00 00 00 89 
May 17 15:49:44 localhost NetworkManager: <info>  (wlan0): supplicant connection
state change: 3 -> 0
May 17 15:49:44 localhost kernel: EIP: [<f8de32bb>]
ieee80211_associate+0x289/0x524 [mac80211] SS:ESP 0068:f57a1da4
May 17 15:49:44 localhost kernel: ---[ end trace 07aac334cae0913a ]---
May 17 15:49:59 localhost NetworkManager: <info>  (wlan0): supplicant connection
state change: 0 -> 2


Version-Release number of selected component (if applicable):
kernel-2.6.26-0.13.rc2.git5.fc10.i686

How reproducible:
Don't know

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 John W. Linville 2008-05-19 13:36:59 UTC 
Odd...I'm not even sure how one gets to call scnprintf from 
ieee80211_sta_work...  Is this happening a lot?

What sort of network configuration do you have?  What type of encryption?
Comment 2 Tom London 2008-05-19 13:51:27 UTC 
This happened one of the 3 or 4 times I booted 0.13 (running 0.17 now).

I have Thinkpad X60 sitting about 1 foot from standard Linksys WRT54 type
router. I am also within "shouting range" of GoogleWifi (and GoogleWiFiSecure).

My network is WPA2 personal, TKIP+AES.

That what you need?  More?
Comment 3 Tom London 2008-05-19 14:32:48 UTC 
Created attachment 305951 [details]
Complete /var/log/messages with BUG/Oops

In case its useful, here is the complete /var/log/messages output for this run.
Comment 4 Ronald Warsow 2008-05-27 19:10:54 UTC 
I see this (attached) on an F9 box with kernel 2.6.26-0.30.rc3.git6.fc10.x86_64.
I have absolutely no firmware in /lib/firmware, nor for my saa7146- neither
p54-/prism54 cards installed.
Comment 5 Ronald Warsow 2008-05-27 19:12:45 UTC 
Created attachment 306821 [details]
the attachement to comment #4

the attachement to comment #4
Comment 6 John W. Linville 2008-06-12 17:56:32 UTC 
Does this problem persist with current rawhide kernels?
Comment 7 Tom London 2008-06-12 20:52:58 UTC 
Haven't seen this since the date of the report.