Bug 499811

Summary:	rmmod iwl3945 crash (if wlan0 is up)
Product:	[Fedora] Fedora	Reporter:	Jan Kratochvil <jan.kratochvil>
Component:	kernel	Assignee:	Stanislaw Gruszka <sgruszka>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	11	CC:	a.steffan, hristozov, itamar, jmoyer, kernel-maint, mschmidt, repli2dev, sgruszka, speed47_redhat
Target Milestone:	---
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-08-14 08:54:57 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Kratochvil 2009-05-08 10:40:09 UTC

Description of problem:
$subj says it all.
While it looks as a duplicate of Bug 495223 = Bug 495003 those bugs should have been already fixed (kernel-2.6.29.1-64.bz495003.2.fc11) in my kernel version.

Version-Release number of selected component (if applicable):
kernel-2.6.29.2-126.fc11.x86_64

How reproducible:
Each time my network setup crashed (~5 times).
The artificial reproducer below was tried once on a "s" (init s) GRUB boot. 

Steps to Reproduce:
modprobe iwl3945
ifconfig wlan0 up
rmmod iwl3945
  
Actual results:
Crash.  Seen some (cut as too big) oops on the screen.  No local other machine and kdump just hangs (nothing dumped).

Expected results:
No crash.

Additional info:
Easy workaround is to do before rmmod:
ifconfig wlan0 down

Comment 1 John W. Linville 2009-05-08 13:01:36 UTC

I confirm that my iwl3945 machine crashes on rmmod when the device is up.  Please try to capture an oops, as will I.

Comment 2 John W. Linville 2009-05-12 16:55:37 UTC

cfg80211: Using static regulatory domain info
cfg80211: Regulatory domain: US
	(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
	(2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
	(5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
cfg80211: Calling CRDA for country: US
lib80211: common routines for IEEE802.11 drivers
iwl3945: Intel(R) PRO/Wireless 3945ABG/BG Network Connection driver for Linux, 1.2.26kds
iwl3945: Copyright(c) 2003-2008 Intel Corporation
iwl3945 0000:06:00.0: PCI INT A -> GSI 18 (level, low) -> IRQ 18
iwl3945: Tunable channels: 11 802.11bg, 13 802.11a channels
iwl3945: Detected Intel Wireless WiFi Link 3945ABG
wmaster0 (iwl3945): not using net_device_ops yet
wlan0 (iwl3945): not using net_device_ops yet
iwl3945 0000:06:00.0: firmware: requesting iwlwifi-3945-2.ucode
iwl3945 loaded firmware version 15.28.2.8
Registered led device: iwl-phy0:radio
Registered led device: iwl-phy0:assoc
Registered led device: iwl-phy0:RX
Registered led device: iwl-phy0:TX
ADDRCONF(NETDEV_UP): wlan0: link is not ready
------------[ cut here ]------------
WARNING: at lib/list_debug.c:30 __list_add+0x44/0x5c() (Not tainted)
Hardware name: VGN-FE570G
list_add corruption. prev->next should be next (c0977c34), but was (null). (prev=f4774adc).
Modules linked in: iwl3945 mac80211 lib80211 cfg80211 netconsole configfs i915 drm i2c_algo_bit rfcomm sco bridge stp bnep l2cap autofs4 sunrpc nf_conntrack_netbios_ns ip6t_REJECT ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq dm_multipath uinput snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device arc4 gspca_vc032x snd_pcm_oss snd_mixer_oss firewire_ohci snd_pcm gspca_main ecb tifm_7xx1 firewire_core iTCO_vendor_support snd_timer videodev yenta_socket tifm_core crc_itu_t snd rsrc_nonstatic v4l1_compat soundcore e100 mii i2c_i801 i2c_core btusb pcspkr serio_raw joydev snd_page_alloc bluetooth sony_laptop video output ata_generic pata_acpi [last unloaded: cfg80211]
Pid: 3000, comm: iwl3945/0 Not tainted 2.6.29.2-52.fc10.i686 #1
Call Trace:
 [<c042e5c4>] warn_slowpath+0x77/0xb4
 [<c0410063>] ? speedstep_detect_processor+0xf4/0x1fd
 [<c06d7a61>] ? _spin_lock_irqsave+0x2b/0x32
 [<c04369a9>] ? lock_timer_base+0x1f/0x3e
 [<c0436a10>] ? try_to_del_timer_sync+0x48/0x4f
 [<c0436a24>] ? del_timer_sync+0xd/0x18
 [<c041b455>] ? default_spin_lock_flags+0x8/0xb
 [<c06d7a61>] ? _spin_lock_irqsave+0x2b/0x32
 [<c0436b5a>] ? __mod_timer+0x9d/0xa8
 [<c043c8bf>] ? queue_delayed_work_on+0xad/0xba
 [<c0421da5>] ? update_curr+0x94/0x1a8
 [<c05356b0>] __list_add+0x44/0x5c
 [<c04362d1>] internal_add_timer+0x88/0x8c
 [<c0436b50>] __mod_timer+0x93/0xa8
 [<c06d6564>] schedule_timeout+0x98/0xbc
 [<f8e85c75>] ? iwl3945_enqueue_hcmd+0x27e/0x2ae [iwl3945]
 [<c04366af>] ? process_timeout+0x0/0xa
 [<c0436ad0>] ? __mod_timer+0x13/0xa8
 [<f8e85dc2>] iwl3945_send_cmd_sync+0x11d/0x292 [iwl3945]
 [<c043f137>] ? autoremove_wake_function+0x0/0x33
 [<f8e8632a>] iwl3945_send_scan_abort+0x4e/0xcb [iwl3945]
 [<f8e86485>] iwl3945_bg_abort_scan+0x44/0x50 [iwl3945]
 [<c043c10a>] run_workqueue+0x89/0x113
 [<f8e86441>] ? iwl3945_bg_abort_scan+0x0/0x50 [iwl3945]
 [<c043c24a>] worker_thread+0xb6/0xc2
 [<c043f137>] ? autoremove_wake_function+0x0/0x33
 [<c043c194>] ? worker_thread+0x0/0xc2
 [<c043ee6b>] kthread+0x3b/0x61
 [<c043ee30>] ? kthread+0x0/0x61
 [<c040463f>] kernel_thread_helper+0x7/0x10
---[ end trace 20471da268e13da2 ]---
------------[ cut here ]------------
kernel BUG at kernel/workqueue.c:241!
invalid opcode: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1c.2/0000:06:00.0/net/wmaster0/flags
Modules linked in: iwl3945 mac80211 lib80211 cfg80211 netconsole configfs i915 drm i2c_algo_bit rfcomm sco bridge stp bnep l2cap autofs4 sunrpc nf_conntrack_netbios_ns ip6t_REJECT ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq dm_multipath uinput snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device arc4 gspca_vc032x snd_pcm_oss snd_mixer_oss firewire_ohci snd_pcm iTCO_wdt gspca_main ecb tifm_7xx1 firewire_core iTCO_vendor_support snd_timer videodev yenta_socket tifm_core crc_itu_t snd rsrc_nonstatic v4l1_compat soundcore e100 mii i2c_i801 i2c_core btusb pcspkr serio_raw joydev snd_page_alloc bluetooth sony_laptop video output ata_generic pata_acpi [last unloaded: cfg80211]

Pid: 2303, comm: wpa_supplicant Tainted: G        W  (2.6.29.2-52.fc10.i686 #1) VGN-FE570G
EIP: 0060:[<c043c839>] EFLAGS: 00210282 CPU: 0
EIP is at queue_delayed_work_on+0x27/0xba
EAX: 00000000 EBX: f4774acc ECX: f4774acc EDX: 00000000
ESI: f4770e60 EDI: efb21840 EBP: f3600e08 ESP: f3600df8
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process wpa_supplicant (pid: 2303, ti=f3600000 task=f3643f20 task.ti=f3600000)
Stack:
 ffffffff f47713dc f4770e60 efa8b500 f3600e14 c043cb11 00000993 f3600e24
 f8e857eb 00000000 f47701a0 f3600e54 f8cf46be efa8b500 efa8b000 f47702c4
 c06d7868 00000002 efa8b804 efa8b144 efa8b000 efa8b45c 00001003 f3600e64
Call Trace:
 [<c043cb11>] ? queue_delayed_work+0x1b/0x1e
 [<f8e857eb>] ? iwl3945_mac_stop+0xdf/0x11c [iwl3945]
 [<f8cf46be>] ? ieee80211_stop+0x3d1/0x435 [mac80211]
 [<c06d7868>] ? _spin_unlock_bh+0x11/0x13
 [<c06552e0>] ? dev_close+0x7a/0xa0
 [<c0654ff9>] ? dev_change_flags+0xa5/0x158
 [<c0697882>] ? devinet_ioctl+0x21a/0x494
 [<c069886d>] ? inet_ioctl+0x8e/0xa7
 [<c064899c>] ? sock_ioctl+0x1be/0x1e2
 [<c06487de>] ? sock_ioctl+0x0/0x1e2
 [<c04a626f>] ? vfs_ioctl+0x22/0x69
 [<c04a6a49>] ? do_vfs_ioctl+0x467/0x4a0
 [<c0505aeb>] ? selinux_file_ioctl+0x3e/0x42
 [<c04a6ac2>] ? sys_ioctl+0x40/0x5a
 [<c0403dde>] ? syscall_call+0x7/0xb
Code: ff ff 5d c3 55 89 e5 57 89 d7 56 53 89 cb 83 ec 04 89 45 f0 f0 0f ba 29 00 19 c0 31 d2 85 c0 0f 85 91 00 00 00 83 79 10 00 74 04 <0f> 0b eb fe 8d 41 04 39 41 04 74 04 0f 0b eb fe 8b 55 04 8d 71 
EIP: [<c043c839>] queue_delayed_work_on+0x27/0xba SS:ESP 0068:f3600df8
---[ end trace 20471da268e13da3 ]---

Comment 3 John W. Linville 2009-05-12 17:46:01 UTC

iwl3945 0000:06:00.0: PCI INT A disabled
cfg80211: Using static regulatory domain info
cfg80211: Regulatory domain: US
	(start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)
	(2402000 KHz - 2472000 KHz @ 40000 KHz), (600 mBi, 2700 mBm)
	(5170000 KHz - 5190000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5190000 KHz - 5210000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5210000 KHz - 5230000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5230000 KHz - 5330000 KHz @ 40000 KHz), (600 mBi, 2300 mBm)
	(5735000 KHz - 5835000 KHz @ 40000 KHz), (600 mBi, 3000 mBm)
cfg80211: Calling CRDA for country: US
lib80211: common routines for IEEE802.11 drivers
iwl3945: Intel(R) PRO/Wireless 3945ABG/BG Network Connection driver for Linux, 1.2.26kds
iwl3945: Copyright(c) 2003-2008 Intel Corporation
iwl3945 0000:06:00.0: PCI INT A -> GSI 18 (level, low) -> IRQ 18
iwl3945: Tunable channels: 11 802.11bg, 13 802.11a channels
iwl3945: Detected Intel Wireless WiFi Link 3945ABG
wmaster0 (iwl3945): not using net_device_ops yet
wlan0 (iwl3945): not using net_device_ops yet
iwl3945 0000:06:00.0: firmware: requesting iwlwifi-3945-2.ucode
iwl3945 loaded firmware version 15.28.2.8
Registered led device: iwl-phy0:radio
Registered led device: iwl-phy0:assoc
Registered led device: iwl-phy0:RX
Registered led device: iwl-phy0:TX
ADDRCONF(NETDEV_UP): wlan0: link is not ready
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: [<c04368c3>] get_next_timer_interrupt+0xeb/0x1b2
*pde = 302e1067 *pte = 00000000 
Oops: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1c.2/0000:06:00.0/net/wlan0/address
Modules linked in: iwl3945 mac80211 lib80211 cfg80211 fuse i915 drm i2c_algo_bit rfcomm netconsole configfs sco bridge stp bnep l2cap autofs4 sunrpc nf_conntrack_netbios_ns ip6t_REJECT ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq dm_multipath uinput snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm firewire_ohci arc4 yenta_socket snd_timer firewire_core ecb iTCO_wdt e100 mii tifm_7xx1 rsrc_nonstatic gspca_vc032x snd iTCO_vendor_support tifm_core i2c_i801 i2c_core crc_itu_t serio_raw gspca_main sony_laptop soundcore snd_page_alloc pcspkr joydev btusb videodev bluetooth video output v4l1_compat ata_generic pata_acpi [last unloaded: cfg80211]

Pid: 0, comm: swapper Not tainted (2.6.29.2-52.fc10.i686 #1) VGN-FE570G
EIP: 0060:[<c04368c3>] EFLAGS: 00010017 CPU: 0
EIP is at get_next_timer_interrupt+0xeb/0x1b2
EAX: 00000000 EBX: 0000003b ECX: 00ffff3b EDX: 0000003b
ESI: 00000000 EDI: c0977280 EBP: c0892f6c ESP: c0892f34
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
Process swapper (pid: 0, ti=c0892000 task=c0824350 task.ti=c0892000)
Stack:
 ffff3a8e c0977a8c 00000001 c0977c64 c09776cc c0892f50 ffff3b88 c0977a8c
 c0977c8c c0977e8c c097808c c17f8af4 149df780 0000003a c0892fb8 c0449242
 c0441dd4 00000000 00000000 00000001 c0892fa0 c0448d9f 149f17a0 0000003a
Call Trace:
 [<c0449242>] ? tick_nohz_stop_sched_tick+0x177/0x34d
 [<c0441dd4>] ? hrtimer_start_range_ns+0x10/0x12
 [<c0448d9f>] ? hrtimer_start_expires+0x1a/0x22
 [<c0402db7>] ? cpu_idle+0x26/0x8b
 [<c06c67fb>] ? rest_init+0x53/0x55
Code: 89 da 8b 00 89 45 cc 8b 75 cc 8b 04 d6 8d 34 d6 89 75 d4 eb 16 8b 40 08 3b 45 e0 0f 49 45 e0 c7 45 d0 01 00 00 00 89 45 e0 89 f0 <8b> 30 0f 18 06 90 3b 45 d4 75 df 83 7d d0 00 74 11 85 db 74 04 
EIP: [<c04368c3>] get_next_timer_interrupt+0xeb/0x1b2 SS:ESP 0068:c0892f34
---[ end trace 14eba42306d24b6d ]---
Kernel panic - not syncing: Attempted to kill the idle task!
------------[ cut here ]------------
WARNING: at kernel/smp.c:329 smp_call_function_many+0x37/0x1be() (Tainted: G      D   )
Hardware name: VGN-FE570G
Modules linked in: iwl3945 mac80211 lib80211 cfg80211 fuse i915 drm i2c_algo_bit rfcomm netconsole configfs sco bridge stp bnep l2cap autofs4 sunrpc nf_conntrack_netbios_ns ip6t_REJECT ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq dm_multipath uinput snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm firewire_ohci arc4 yenta_socket snd_timer firewire_core ecb iTCO_wdt e100 mii tifm_7xx1 rsrc_nonstatic gspca_vc032x snd iTCO_vendor_support tifm_core i2c_i801 i2c_core crc_itu_t serio_raw gspca_main sony_laptop soundcore snd_page_alloc pcspkr joydev btusb videodev bluetooth video output v4l1_compat ata_generic pata_acpi [last unloaded: cfg80211]
Pid: 0, comm: swapper Tainted: G      D    2.6.29.2-52.fc10.i686 #1
Call Trace:
 [<c042e5c4>] warn_slowpath+0x77/0xb4
 [<c065ffd1>] ? netpoll_send_udp+0x1d1/0x1dc
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<f8db4178>] ? write_msg+0xb1/0xb9 [netconsole]
 [<f8db40c7>] ? write_msg+0x0/0xb9 [netconsole]
 [<c041b455>] ? default_spin_lock_flags+0x8/0xb
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c042eabb>] ? release_console_sem+0x1b4/0x1e1
 [<c044c2d0>] smp_call_function_many+0x37/0x1be
 [<c040934e>] ? stop_this_cpu+0x0/0x4c
 [<c044c473>] smp_call_function+0x1c/0x23
 [<c0413341>] native_smp_send_stop+0x1b/0x67
 [<c06d5832>] panic+0x48/0xe9
 [<c043141d>] do_exit+0x62/0x71e
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c06d58e2>] ? printk+0xf/0x15
 [<c042e49d>] ? oops_exit+0x23/0x28
 [<c06d85da>] oops_end+0xa1/0xa9
 [<c0406356>] die+0x54/0x5a
 [<c06d9a57>] do_page_fault+0x5ec/0x690
 [<c04459cb>] ? getnstimeofday+0x56/0xe4
 [<c0414038>] ? lapic_next_event+0x13/0x17
 [<c04479db>] ? clockevents_program_event+0xdb/0xea
 [<c04487d1>] ? tick_dev_program_event+0x28/0x95
 [<c041b455>] ? default_spin_lock_flags+0x8/0xb
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c04465dc>] ? clocksource_get_next+0x3c/0x43
 [<c0445795>] ? update_wall_time+0x66a/0x717
 [<c04459cb>] ? getnstimeofday+0x56/0xe4
 [<c0414038>] ? lapic_next_event+0x13/0x17
 [<c04433e2>] ? sched_clock_cpu+0x137/0x146
 [<c06d946b>] ? do_page_fault+0x0/0x690
 [<c06d7b8f>] error_code+0x77/0x7c
 [<c044007b>] ? run_posix_cpu_timers+0x18e/0x724
 [<c04368c3>] ? get_next_timer_interrupt+0xeb/0x1b2
 [<c0449242>] tick_nohz_stop_sched_tick+0x177/0x34d
 [<c0441dd4>] ? hrtimer_start_range_ns+0x10/0x12
 [<c0448d9f>] ? hrtimer_start_expires+0x1a/0x22
 [<c0402db7>] cpu_idle+0x26/0x8b
 [<c06c67fb>] rest_init+0x53/0x55
---[ end trace 14eba42306d24b6e ]---
------------[ cut here ]------------
WARNING: at kernel/smp.c:226 smp_call_function_single+0x37/0x10a() (Tainted: G      D W )
Hardware name: VGN-FE570G
Modules linked in: iwl3945 mac80211 lib80211 cfg80211 fuse i915 drm i2c_algo_bit rfcomm netconsole configfs sco bridge stp bnep l2cap autofs4 sunrpc nf_conntrack_netbios_ns ip6t_REJECT ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq dm_multipath uinput snd_hda_codec_idt snd_hda_intel snd_hda_codec snd_hwdep snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm firewire_ohci arc4 yenta_socket snd_timer firewire_core ecb iTCO_wdt e100 mii tifm_7xx1 rsrc_nonstatic gspca_vc032x snd iTCO_vendor_support tifm_core i2c_i801 i2c_core crc_itu_t serio_raw gspca_main sony_laptop soundcore snd_page_alloc pcspkr joydev btusb videodev bluetooth video output v4l1_compat ata_generic pata_acpi [last unloaded: cfg80211]
Pid: 0, comm: swapper Tainted: G      D W  2.6.29.2-52.fc10.i686 #1
Call Trace:
 [<c042e5c4>] warn_slowpath+0x77/0xb4
 [<c065ffd1>] ? netpoll_send_udp+0x1d1/0x1dc
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<f8db4178>] ? write_msg+0xb1/0xb9 [netconsole]
 [<f8db40c7>] ? write_msg+0x0/0xb9 [netconsole]
 [<c041b455>] ? default_spin_lock_flags+0x8/0xb
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c042eabb>] ? release_console_sem+0x1b4/0x1e1
 [<c044c1c6>] smp_call_function_single+0x37/0x10a
 [<c040934e>] ? stop_this_cpu+0x0/0x4c
 [<c044c352>] smp_call_function_many+0xb9/0x1be
 [<c040934e>] ? stop_this_cpu+0x0/0x4c
 [<c044c473>] smp_call_function+0x1c/0x23
 [<c0413341>] native_smp_send_stop+0x1b/0x67
 [<c06d5832>] panic+0x48/0xe9
 [<c043141d>] do_exit+0x62/0x71e
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c06d58e2>] ? printk+0xf/0x15
 [<c042e49d>] ? oops_exit+0x23/0x28
 [<c06d85da>] oops_end+0xa1/0xa9
 [<c0406356>] die+0x54/0x5a
 [<c06d9a57>] do_page_fault+0x5ec/0x690
 [<c04459cb>] ? getnstimeofday+0x56/0xe4
 [<c0414038>] ? lapic_next_event+0x13/0x17
 [<c04479db>] ? clockevents_program_event+0xdb/0xea
 [<c04487d1>] ? tick_dev_program_event+0x28/0x95
 [<c041b455>] ? default_spin_lock_flags+0x8/0xb
 [<c06d7946>] ? _spin_unlock_irqrestore+0x22/0x38
 [<c04465dc>] ? clocksource_get_next+0x3c/0x43
 [<c0445795>] ? update_wall_time+0x66a/0x717
 [<c04459cb>] ? getnstimeofday+0x56/0xe4
 [<c0414038>] ? lapic_next_event+0x13/0x17
 [<c04433e2>] ? sched_clock_cpu+0x137/0x146
 [<c06d946b>] ? do_page_fault+0x0/0x690
 [<c06d7b8f>] error_code+0x77/0x7c
 [<c044007b>] ? run_posix_cpu_timers+0x18e/0x724
 [<c04368c3>] ? get_next_timer_interrupt+0xeb/0x1b2
 [<c0449242>] tick_nohz_stop_sched_tick+0x177/0x34d
 [<c0441dd4>] ? hrtimer_start_range_ns+0x10/0x12
 [<c0448d9f>] ? hrtimer_start_expires+0x1a/0x22
 [<c0402db7>] cpu_idle+0x26/0x8b
 [<c06c67fb>] rest_init+0x53/0x55
---[ end trace 14eba42306d24b6f ]---

Comment 4 Stéphane Lesimple 2009-05-13 20:32:09 UTC

I can also confirm this on my setup.

Kernels affected by this bug :

- 2.6.29.1-30.fc10.i686
- 2.6.29.1-42.fc10.i686
- 2.6.29.2-52.fc10.i686
- 2.6.29.3-60.fc10.i686

Kernels Unaffected :

- 2.6.27.21-170.2.56.fc10.i686
- possibly lower versions (untested)

Sometimes I get blinking leds when the system freezes, sometimes not.
In lower runlevels, I can sometimes see the bottom of a kernel call trace followed by a kernel panic notice, even if more often than not the console seems to freeze before any text appears.

Comment 5 Jan Drábek 2009-05-21 07:46:42 UTC

I can also confirm this on current rawhide.

Comment 6 Jeff Moyer 2009-05-21 17:49:44 UTC

I also ran into this problem.  The last known working kernel for me was 2.6.29-0.237.rc7.git4.fc11.  I'm seeing the failure under 2.6.29.3-140.fc11.

Comment 7 Michal Schmidt 2009-05-31 11:01:51 UTC

linux-2.6-iwl3945-use-cancel_delayed_work_sync-to-cancel-rfkill_poll.patch which has been applied since -158 should fix it:
* Fri May 22 2009 John W. Linville <linville> - 2.6.29.3-158
- back-port "iwl3945: use cancel_delayed_work_sync to cancel rfkill_poll"

Is this still reproducible with a current F11 kernel?

Comment 8 Stéphane Lesimple 2009-05-31 19:21:40 UTC

(In reply to comment #7)
> linux-2.6-iwl3945-use-cancel_delayed_work_sync-to-cancel-rfkill_poll.patch
> which has been applied since -158 should fix it:

I'm not yet under F11 but I tried 2.6.27.24-170.2.68.fc10.i686 found in updates-testing, as it seems to contain the above patch, indicated by the build log located at http://kojipkgs.fedoraproject.org/packages/kernel/2.6.29.4/75.fc10/data/logs/i686/build.log (Patch685)

I booted under runlevel 1, modprobe iwl3945, ifconfig wlan0 up, rmmod iwl3945, and bingo, blinking keyboard leds and hard-lockup !

The kernel panic is visible here http://img172.imageshack.us/img172/8582/1003246.jpg

Comment 9 Jan Drábek 2009-06-01 08:19:50 UTC

Still no change in 2.6.29.4-167.fc11.x86_64.

Comment 10 Bug Zapper 2009-06-09 15:26:25 UTC

This bug appears to have been reported against 'rawhide' during the Fedora 11 development cycle.
Changing version to '11'.

More information and reason for this action is here:
http://fedoraproject.org/wiki/BugZappers/HouseKeeping

Comment 11 John W. Linville 2009-07-08 17:36:06 UTC

*** Bug 498769 has been marked as a duplicate of this bug. ***

Comment 12 Stanislaw Gruszka 2009-07-23 13:14:06 UTC

This bug should be fixed by:

commit d552bfb65241a35d48e44ddb0d27e0454f579ab4
Author: Kolekar, Abhijeet <abhijeet.kolekar>
Date:   Fri Dec 19 10:37:41 2008 +0800

    iwl3945: release resources before shutting down

The cause is described in BZ 501117. While this bug (way to reproduce and oops message) is a bit different than bug 501117, fix should work here. I tested on my laptop on i686. If someone else would like to test, here is koji build: 

http://koji.fedoraproject.org/koji/taskinfo?taskID=1494153

Comment 13 Georgi Hristozov 2009-07-23 16:08:13 UTC

(In reply to comment #12)
> This bug should be fixed by:
> 
> commit d552bfb65241a35d48e44ddb0d27e0454f579ab4
> Author: Kolekar, Abhijeet <abhijeet.kolekar>
> Date:   Fri Dec 19 10:37:41 2008 +0800
> 
>     iwl3945: release resources before shutting down
> 
> The cause is described in BZ 501117. While this bug (way to reproduce and oops
> message) is a bit different than bug 501117, fix should work here. I tested on
> my laptop on i686. If someone else would like to test, here is koji build: 
> 
> http://koji.fedoraproject.org/koji/taskinfo?taskID=1494153  

The patch works for me too - Toshiba Satellite A200 with 3945ABG (i686). Hope we'll see it in testing soon. :)

Comment 14 Stanislaw Gruszka 2009-08-14 08:54:57 UTC

As bug is now fixed in 2.6.29.6-217.2.3.fc11 I'm closing this bug report.