Description of problem: Kernel oopses when plugging in Siemens Gigaset USB WLAN Adapter 54. Version-Release number of selected component (if applicable): -/- How reproducible: Every time Steps to Reproduce: 1. Plug in Siemens Gigaset USB WLAN Adapter 54 Actual results: OOPS Expected results: LED should turn on and I should have access to the WLAN. Additional info: OOPS is attached. I had to download the device's firmware from http://jbnote.free.fr/prism54usb/data/firmwares/net2280/2.4.3.7/2.4.3.7.arm to /lib/firmware/isl3890usb
Created attachment 156262 [details] /var/log/messages oops cutting
Did the oops disappear once you had the firmware in place? Just checking...
See also bug 242638 (please do not dup just yet!)
> Did the oops disappear once you had the firmware in place? No, it started appearing after placing the firmware to /lib/firmware and replugging the device in. Without the firmware I do not get a OOPS but I do not get WLAN either ;-)
In bug 242638 one machine does not OOPS because the firmware is not installed (p54usb: cannot find firmware). Caolan in bug 242638 needs an other firmware (isl3887usb_bare) than I had to get (isl3890usb). That's why I think that our devices are slightly different. lsusb output: Bus 002 Device 001: ID 0000:0000 Bus 001 Device 003: ID 1241:1166 Belkin Bus 001 Device 001: ID 0000:0000 Bus 003 Device 026: ID 14aa:0221 AVerMedia (again) or C&E AVermedia DVBT Tuner Dongle Bus 003 Device 016: ID 083a:4502 Accton Technology Corp. Bus 003 Device 001: ID 0000:0000
There is something very wrong with either the firmware or the parsing code. eax (==1fc800a0) contains the len field in the bootrec ebp (==f8da411c) holds the address of the data prism54common.c line 86: bootrec = (struct bootrec *)&bootrec->data[le32_to_cpu(bootrec->len)]; if ((u32 *)bootrec > end_data) break; There is a 32-bit overflow when calculating the new value of bootrec, so the check for "bootrec > end_data" is not true and we go on to dereference an invalid address.
Chuck, how did you manage to perform the above analysis? I downloaded the SRPM for 2.6.23-0.15.rc0.git1.fc8, and there's no prism54usb anywhere in sight on it. What source are you looking at?
Never mind, I found it. Someone took a perfectly good drivers/wireless/prism54usb and ported it to D-scape stack... poorly.
This issue should be resolved with current F7 kernels. Can you verify that?
sorry. my wlan device is broken.,