Description of problem: Tried a new kernel and it crashed on iwconfig of my iwl3945 card. Version-Release number of selected component (if applicable): kernel-2.6.23.15-137.fc8.x86_64 kernel-2.6.23.14-107.fc8.x86_64 (this one works for me) How reproducible: Tried only once. Steps to Reproduce: My startup scripts contain these iwconfig commands: modprobe iwl3945 sleep 2 iwconfig wlan0 essid "foo" iwconfig wlan0 ap "00:4F:62:17:E3:55" iwconfig wlan0 rts 0 iwconfig wlan0 rate 2M Actual results: Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP: [<ffffffff88468b05>] :mac80211:ieee80211_ioctl_siwrate+0x71/0xc0 PGD 4fe9f067 PUD 507f5067 PMD 0 Oops: 0000 [1] SMP CPU 0 Modules linked in: iwl3945 mac80211 nf_conntrack_sane nf_conntrack_proto_udplite nf_conntrack_proto_sctp nf_conntrack_netlink nf_nat_tftp nf_conntrack_tftp nf_nat_snmp_basic nf_nat_sip nf_conntrack_sip nf_nat_pptp nf_conntrack_pptp nf_conntrack_proto_gre nf_nat_proto_gre nf_nat_irc nf_conntrack_irc nf_nat_h323 nf_conntrack_h323 nf_nat_ftp nf_conntrack_ftp nf_nat_amanda ts_kmp nf_conntrack_amanda nfsd exportfs lockd nfs_acl auth_rpcgss sunrpc tun rfcomm l2cap ipv6 nf_conntrack_netbios_ns iptable_mangle ipt_MASQUERADE iptable_nat nf_nat ipt_REJECT nf_conntrack_ipv4 xt_conntrack nf_conntrack nfnetlink xt_tcpudp iptable_filter ip_tables x_tables cpufreq_ondemand acpi_cpufreq dm_mirror dm_mod uinput kvm_intel kvm snd_usb_audio snd_seq_dummy snd_hda_intel snd_seq_oss snd_seq_midi_event snd_seq snd_pcm_oss snd_mixer_oss snd_pcm iTCO_wdt iTCO_vendor_support arc4 snd_timer ac thinkpad_acpi video ecb blkcipher snd_usb_lib output i2c_i801 battery snd_rawmidi hci_usb button i2c_core pcspkr snd _seq_device snd_page_alloc joydev snd_hwdep bluetooth snd cfg80211 hwmon soundcore sg sr_mod cdrom ata_piix ahci libata sd_mod scsi_mod ext3 jbd mbcache uhci_hcd ohci_hcd ehci_hcd Pid: 10104, comm: iwconfig Not tainted 2.6.23.15-137.fc8 #1 RIP: 0010:[<ffffffff88468b05>] [<ffffffff88468b05>] :mac80211:ieee80211_ioctl_siwrate+0x71/0xc0 RSP: 0018:ffff810056b81cf8 EFLAGS: 00010202 RAX: ffff81007c86e920 RBX: 00000000000186a0 RCX: ffff81005786c780 RDX: ffff81007c86e920 RSI: ffff81007e760060 RDI: 0000000000000000 RBP: ffff810056b81e58 R08: ffff810056b81e58 R09: 0000000000000003 R10: 0000000000000014 R11: 0000000000000246 R12: 00000000ffffffa1 R13: ffffffff812983c0 R14: 0000000000008b20 R15: 0000000000000003 FS: 00002aaaaaac2f60(0000) GS:ffffffff813be000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000028 CR3: 000000005189a000 CR4: 00000000000026e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process iwconfig (pid: 10104, threadinfo ffff810056b80000, task ffff810069550000) Stack: 0000000000000180 ffffffff81257c1c ffffffff88468a94 ffff81005786c000 ffff81000000f2b0 ffff81004fe9f770 ffff810058456d10 0000000000000000 ffff81000abdc4e0 ffffffff00000000 ffff81000abdc4e0 ffffffff8107e7c2 Call Trace: [<ffffffff81257c1c>] ioctl_standard_call+0x66/0x2ef [<ffffffff88468a94>] :mac80211:ieee80211_ioctl_siwrate+0x0/0xc0 [<ffffffff8107e7c2>] __do_fault+0x44f/0x489 [<ffffffff81257f56>] wext_handle_ioctl+0xb1/0x39d [<ffffffff88468a94>] :mac80211:ieee80211_ioctl_siwrate+0x0/0xc0 [<ffffffff811f21cf>] dev_ioctl+0x418/0x43e [<ffffffff81121027>] __up_read+0x19/0x7f [<ffffffff811e5846>] sock_ioctl+0x1db/0x1e5 [<ffffffff810a768d>] do_ioctl+0x21/0x6b [<ffffffff810a791a>] vfs_ioctl+0x243/0x25c [<ffffffff810a798c>] sys_ioctl+0x59/0x79 [<ffffffff8100bd45>] tracesys+0xd5/0xda Code: 44 8b 4f 28 31 f6 31 d2 eb 35 48 8b 47 18 8b 04 10 48 83 c2 RIP [<ffffffff88468b05>] :mac80211:ieee80211_ioctl_siwrate+0x71/0xc0 RSP <ffff810056b81cf8> CR2: 0000000000000028 Expected results: No crash. Additional info: I can try rebooting it again if it is required.
Before we go further, could you recreate this on a more recent kernel? http://koji.fedoraproject.org/koji/buildinfo?buildID=39121
OK, it works now on: kernel-2.6.25-0.65.rc2.git7.fc9.x86_64 (although this crashes inside KVM different ways, out of the scope of this Bug)