Bug 866104

Summary: update kernel-3.6.1-1.fc17 causes wpa_supplicant and wl kernel module to abort
Product: [Fedora] Fedora Reporter: Allen Hewes <allen>
Component: kernelAssignee: Kernel Maintainer List <kernel-maint>
Status: CLOSED NOTABUG QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: gansalmon, itamar, jonathan, kernel-maint, leigh.orf, madhu.chinakonda
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-10-15 09:24:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
abrt backtrace
none
abrt core_backtrace none

Description Allen Hewes 2012-10-14 01:47:18 UTC 
Created attachment 626726 [details]
abrt backtrace

Description of problem:
After an upgrade to kernel 3.6.1-1 this weekend, Dell Precision M6500 fails to boot into graphical mode.

I was running kernel-3.5.6-1 with the NVIDIA and Broadcom Linux STA without any troubles. Actually, I didn't have any troubles with Fedora 17 kernels until this weekends update to 3.6.1.

nvidia.ko and wl.ko have always worked for me for all released Fedora 17 kernels.

After the update to 3.6.1-1, I rebooted and got wpa_supplicant error:
general protection fault: 0000 [#1] SMP 
Modules linked in: ip6t_REJECT nf_conntrack_ipv4 vboxpci(O) nf_defrag_ipv4 nf_conntrack_ipv6 vboxnetadp(O) nf_defrag_ipv6 vboxnetflt(O) xt_state nf_conntrack vboxdrv(O) ip6table_filter ip6_tables uvcvideo videobuf2_vmalloc videobuf2_memops videobuf2_core videodev media nvidia(PO) snd_hda_codec_idt snd_hda_intel lib80211_crypt_tkip snd_hda_codec snd_hwdep wl(PO) snd_seq snd_seq_device snd_pcm snd_page_alloc tifm_7xx1 i2c_i801 dell_laptop snd_timer snd i7core_edac cfg80211 rfkill tifm_core dcdbas edac_core whc_rc soundcore i2c_core whci_hcd whci umc wusbcore iTCO_wdt uwb iTCO_vendor_support tg3 lpc_ich mfd_core lib80211 coretemp microcode dell_wmi sparse_keymap vhost_net tun macvtap macvlan kvm_intel kvm uinput binfmt_misc crc32c_intel sdhci_pci sdhci firewire_ohci mmc_core yenta_socket firewire_core crc_itu_t wmi video
CPU 7 <4>[   25.102987] Pid: 842, comm: wpa_supplicant Tainted: P         C O 3.6.1-1.fc17.x86_64 #1 Dell Inc. Precision M6500                 /0N9VXG
RIP: 0010:[<ffffffffa03671dc>]  [<ffffffffa03671dc>] wl_cfg80211_scan+0x8c/0x480 [wl]
RSP: 0018:ffff8803edeeb968  EFLAGS: 00010202
RAX: ffffffffa04f1610 RBX: ffff880400cac1e0 RCX: ffff880400cac1e0
RDX: ffff880400cac1e0 RSI: ffff8803edee2000 RDI: ffff880400cac1e0
RBP: ffff8803edeeb9a8 R08: ffff88041bdd6ac0 R09: 0000000000000079
R10: 0000000000000003 R11: ffff88040b002a00 R12: 008c164400000001
R13: ffff8803edee2000 R14: ffff8803edee2000 R15: 0000000000000000
FS:  00007f48eaad1800(0000) GS:ffff88041bdc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000019f9518 CR3: 00000003feffd000 CR4: 00000000000007e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process wpa_supplicant (pid: 842, threadinfo ffff8803edeea000, task ffff880402d30000)
Stack:
 ffffffffa021ac78 ffffffffa021ac78 000000000000000c ffff8803edeeba28
 ffff880400cac000 0000000000000001 ffff8803edee2000 0000000000000000
 ffff8803edeeba08 ffffffffa021b005 000000000000007c 0000000000000004
Call Trace:
 [<ffffffffa021ac78>] ? nl80211_trigger_scan+0xf8/0x610 [cfg80211]
 [<ffffffffa021ac78>] ? nl80211_trigger_scan+0xf8/0x610 [cfg80211]
 [<ffffffffa021b005>] nl80211_trigger_scan+0x485/0x610 [cfg80211]
 [<ffffffff81536f70>] genl_rcv_msg+0x250/0x2d0
 [<ffffffff81536d20>] ? genl_rcv+0x40/0x40
 [<ffffffff81536891>] netlink_rcv_skb+0xa1/0xb0
 [<ffffffff81536d05>] genl_rcv+0x25/0x40
 [<ffffffff815361ed>] netlink_unicast+0x19d/0x220
 [<ffffffff81536548>] netlink_sendmsg+0x2d8/0x390
 [<ffffffff814f598c>] sock_sendmsg+0xbc/0xf0
 [<ffffffff811861db>] ? __mem_cgroup_commit_charge+0x16b/0x3a0
 [<ffffffff814f5d6c>] __sys_sendmsg+0x3ac/0x3c0
 [<ffffffff81154839>] ? handle_mm_fault+0x259/0x320
 [<ffffffff8161e17c>] ? do_page_fault+0x1bc/0x4b0
 [<ffffffff8101de1a>] ? restore_i387_xstate+0x6a/0x1c0
 [<ffffffff8106e6af>] ? recalc_sigpending+0x1f/0x70
 [<ffffffff814f7c09>] sys_sendmsg+0x49/0x90
 [<ffffffff816226e9>] system_call_fastpath+0x16/0x1b
Code: 8b 6d e8 4c 8b 75 f0 4c 8b 7d f8 c9 c3 66 90 48 8b 86 50 02 00 00 48 85 c0 0f 84 6f 03 00 00 4c 8b 20 4d 85 e4 0f 84 2f 03 00 00 <49> 8b 84 24 a8 0a 00 00 4d 8b b4 24 48 06 00 00 a8 02 75 60 49 
RIP  [<ffffffffa03671dc>] wl_cfg80211_scan+0x8c/0x480 [wl]
 RSP <ffff8803edeeb968>

After this error, Fedora will still load for a bit, but it eventually freezes until I kill power and choose the "recovery mode" and then rename /usr/sbin/wpa_supplicant.

I know this will surely be written off as a Broadcom thing, but my system has been stable with all released kernels versions on Fedora 17.

What's weird is that I can 'systemctl mask wpa_supplicant.service' and get back into GNOME. Then unmask it and start it and wpa_supplicant loads fine.

This error only happens on boot up.

Here's mention of something similar on the linux wireless list:
http://marc.info/?l=linux-wireless&m=134908356432162&w=2
(I have different entry point into wl.ko)

Version-Release number of selected component (if applicable):
kernel-3.6.1-1.fc17.x86_64
broadcom-wl-5.100.82.112-2.fc17.1.noarch
kmod-wl-3.5.6-1.fc17.x86_64-5.100.82.112-4.fc17.1.x86_64
kmod-wl-5.100.82.112-4.fc17.1.x86_64
wpa_supplicant-1.0-1.fc17.x86_64

How reproducible:
Everytime I boot kernel-3.6.1-1 for Fedora 17

Steps to Reproduce:
1. update/install kernel-3.6.1-1
2. install kmod-wl from rpmfusion
3.
  
Actual results:
the backtrace I pasted

Expected results:
no backtrace and a happy laptop

Additional info:
Comment 1 Allen Hewes 2012-10-14 01:47:46 UTC 
Created attachment 626727 [details]
abrt core_backtrace
Comment 2 Leigh Orf 2012-10-15 01:52:51 UTC 
Same problem for me using eeePC, same exact version releases as listed above. This is a particularly nasty bug, as it requires a hard reset. I have opted to downgrade to the last fedora 3.5 kernel until this is fixed.

FYI, lspci says:

02:00.0 Network controller: Broadcom Corporation BCM4313 802.11b/g/n Wireless LAN Controller (rev 01)
Comment 3 Josh Boyer 2012-10-15 09:24:46 UTC 
We don't support nvidia, wl, or any of the vbox modules.  You'll have to get this working on your own.
Comment 4 Leigh Orf 2012-10-15 13:29:48 UTC 
I sent an email to linux-wlan-client-support-list, found at http://www.broadcom.com/support/802.11/linux_sta.php. I pointed this to this page. The 5.100.82.112 driver hasn't been updated in a year.