Kernel bug in madwifi on x86_32 with ath_rate/sample/sample.c:366

[Philippe Höij]

Binary package hint: linux-image-2.6.15-27-386
The bug looks very similar to what I encountered on amd64 previously: #29020

Dear kernel folks/driver developers,

I have over the last few weeks encountered hangs at random occasions (about every other day) on my server with two Atheros cards using the madwifi driver. The hang seems to be in the driver when selecting transfer speeds... The dist used is Dapper LTS 6.06. The hangs are starting to worry me because of risk of facing corruption in the long run, I run ext3 so it should withstand some more hangs at least.

The system runs perfectly for a day or two with both wireless interfaces running perfectly, the interfaces are both up until the panics.

I'm running with two Atheros cards on the PCI bus:
0000:00:09.0 Ethernet controller: Atheros Communications, Inc. AR5212 802.11abg NIC (rev 01)
0000:00:0e.0 Ethernet controller: Atheros Communications, Inc. AR5212 802.11abg NIC (rev 01)

On the two networks I have WEP with 128bit encryption and the following clients:
1st nw) A Dell laptop as client, with Intel Pro/Wireless
2nd nw) A D-link AP (2100AP)

The Kernel stack trace is attached and the hangs are consistent with the same kernel bug location, I had similar problems with X86_64 which went away after I migrated to x86_32 but to reappear now for some reason. This seems to have started during november or december, I don't know exactly since the server reboots automatically after 600sek when a kernel panic has occured.

Is there more information you need to track it down?

Please help me.
Best regards
Philippe Höij

------------[ cut here ]------------
[17195402.780000] kernel BUG at /build/buildd/linux-restricted-modules-2.6.15-2.6.15.12/debian/build/2.6.15-27-386/madwifi/ath_rate/sample/sa
mple.c:366!
[17195402.780000] invalid operand: 0000 [#1]
[17195402.780000] PREEMPT
[17195402.780000] Modules linked in: vmnet vmmon binfmt_misc rfcomm l2cap bluetooth ppdev tun powernow_k8 cpufreq_userspace cpufreq_stats fre
q_table cpufreq_powersave cpufreq_ondemand cpufreq_conservative video tc1100_wmi sony_acpi pcc_acpi hotkey dev_acpi container button acpi_sbs battery i2c_acpi_ec ac sch_sfq cls_u32 sch_ingress sch_htb ip6table_filter ip6_tables iptable_raw iptable_mangle ipt_ULOG ipt_TTL ipt_ttl ipt_TOS ipt_tos ipt_TCPMSS ipt_tcpmss ipt_state ipt_sctp ipt_SAME ipt_REJECT ipt_REDIRECT ipt_recent ipt_realm ipt_pkttype ipt_physdev ipt_owner ipt_NOTRACK ipt_NETMAP ipt_multiport ipt_MASQUERADE ipt_MARK ipt_mark ipt_mac ipt_LOG ipt_limit ipt_length ipt_iprange ipt_helper ipt_hashlimit ipt_esp ipt_ECN ipt_ecn ipt_DSCP ipt_dscp ipt_conntrack ipt_CONNMARK ipt_connmark ipt_comment ipt_CLUSTERIP ipt_CLASSIFY ipt_ah ipt_addrtype ip_nat_irc ip_nat_tftp ip_nat_ftp iptable_nat ip_nat ip_conntrack_irc ip_conntrack_tftp ip_conntrack_ftp ip_conntrack nfnetlink iptable_filter ip_tables ipv6 ext2 md_mod w83627hf hwmon_vid eeprom i2c_isa af_packet tda9887 saa7127 saa7115 ivtv sr_mod sbp2 lp rsrc_nonstatic pcmcia_core ftdi_sio usbserial joydev tsdev wlan_wep touchkitusb usbhid usblp snd_emu10k1_synth snd_emux_synth snd_seq_virmidi snd_seq_midi_emul snd_seq_dummy snd_seq_oss pcspkr snd_seq_midi snd_seq_midi_event snd_seq bt878 tuner tvaudio msp3400 psmouse i2c_viapro snd_emu10k1 rtc parport_pc parport serio_raw bttv video_buf i2c_algo_bit v4l2_common btcx_risc tveeprom videodev nvidia i2c_core floppy ath_pci ath_rate_sample wlan snd_rawmidi snd_ac97_codec snd_ac97_bus snd_bt87x ath_hal snd_seq_device snd_pcm_oss snd_mixer_oss emu10k1_gp snd_util_mem snd_hwdep shpchp pci_hotplug skge amd64_agp agpgart snd_pcm snd_timer snd_page_alloc gameport snd soundcore evdev sg ext3 jbd dm_mod usb_storage ide_generic ehci_hcd uhci_hcd usbcore ohci1394 ieee1394 ide_cd cdrom via82cxxx generic sd_mod sata_via libata scsi_mod thermal processor fan capability commoncap vesafb fbcon tileblit font bitblit softcursor
[17195402.780000] CPU: 0
[17195402.780000] EIP: 0060:[<f8c1747a>] Tainted: P VLI
[17195402.780000] EFLAGS: 00210292 (2.6.15-27-386)
[17195402.780000] EIP is at ath_rate_findrate+0x18c/0x678 [ath_rate_sample]
[17195402.780000] eax: 0000001b ebx: ffffffff ecx: c03364ac edx: c03364ac
[17195402.780000] esi: c9e72000 edi: 00000000 ebp: c9e72260 esp: f57dfaa8
[17195402.780000] ds: 007b es: 007b ss: 0068
[17195402.780000] Process openvpn (pid: 7664, threadinfo=f57de000 task=f561c030)
[17195402.780000] Stack: f8c193db ffffffff 00000001 f9698680 00000018 00000004 00000018 c01ddfb8
[17195402.780000] f749d134 f749d138 00000018 f749d134 00000004 ffffffff f8f0a22c f749d134
[17195402.780000] 00000000 00000018 0026f750 f7c1ea60 f790e6b0 00000018 f7af2980 00000001
[17195402.780000] Call Trace:
[17195402.780000] [<c01ddfb8>] memmove+0x38/0x44
[17195402.780000] [<f8f0a22c>] wep_encap+0xba/0x1b0 [wlan_wep]
[17195402.780000] [<f8ced503>] ieee80211_crypto_encap+0x61/0x12c [wlan]
[17195402.780000] [<f8d1717c>] ath_tx_start+0xe8b/0x1001 [ath_pci]
[17195402.780000] [<c0279a3b>] kfree_skbmem+0xb/0x90
[17195402.780000] [<f8cf74fb>] ieee80211_skbhdr_adjust+0x77/0x23e [wlan]
[17195402.780000] [<f8cf77db>] ieee80211_encap+0x119/0x698 [wlan]
[17195402.780000] [<f8d1263f>] ath_start+0x106/0x64f [ath_pci]
[17195402.780000] [<c028fd31>] qdisc_restart+0x61/0x210
[17195402.780000] [<c027f53d>] dev_queue_xmit+0x7d/0x2e0
[17195402.780000] [<c02a39b3>] ip_output+0x133/0x280
[17195402.780000] [<c02a3dab>] ip_queue_xmit+0x2ab/0x510
[17195402.780000] [<f926f750>] _nv001807rm+0x50/0x70 [nvidia]
[17195402.780000] [<f8c54984>] zz000b6c10+0x78/0x10d0 [ath_hal]
[17195402.780000] [<f8c54943>] zz000b6c10+0x37/0x10d0 [ath_hal]
[17195402.780000] [<c02bac26>] tcp_v4_send_check+0x36/0xf0
[17195402.780000] [<c02b4a3f>] tcp_cwnd_restart+0x1f/0xd0
[17195402.780000] [<c02b4fef>] tcp_transmit_skb+0x3ef/0x7d0
[17195402.780000] [<c02b6247>] tcp_write_xmit+0x127/0x3d0
[17195402.780000] [<c02b6514>] __tcp_push_pending_frames+0x24/0xa0
[17195402.780000] [<c02aae4e>] tcp_sendmsg+0x9ae/0xb10
[17195402.780000] [<c0274e5a>] sock_sendmsg+0xea/0x120
[17195402.780000] [<c01311b0>] autoremove_wake_function+0x0/0x40
[17195402.780000] [<f8c1840c>] ath_rate_tx_complete+0x58c/0x840 [ath_rate_sample]
[17195402.780000] [<c02764c0>] sys_sendto+0x140/0x150
[17195402.780000] [<c0117f56>] deactivate_task+0x16/0x30
[17195402.780000] [<c02ec347>] schedule+0x317/0x690
[17195402.780000] [<c0279a6c>] kfree_skbmem+0x3c/0x90
[17195402.780000] [<c02757b3>] sock_poll+0x13/0x20
[17195402.780000] [<c02757b3>] sock_poll+0x13/0x20
[17195402.780000] [<c0174267>] do_pollfd+0x47/0xd0
[17195402.780000] [<c02764ed>] sys_send+0x1d/0x30
[17195402.780000] [<c0276d7a>] sys_socketcall+0x11a/0x1e0
[17195402.780000] [<c0102feb>] sysenter_past_esp+0x54/0x79
[17195402.780000] Code: 41 14 8b 94 24 a8 00 00 00 88 02 83 84 bd fc 05 00 00 01 83 c4 7c 5b 5e 5f 5d c3 89 5c 24 04 c7 04 24 db 93 c1 f8 e8
66 52 50 c7 <0f> 0b 6e 01 04 96 c1 f8 c1 e3 04 8d 0c 2b 8b 51 0c 8b 84 24 a0
[17195402.780000] <0>Kernel panic - not syncing: Fatal exception in interrupt
[17195404.424000] <0>Rebooting in 600 seconds..Badness in pci_get_subsys at drivers/pci/search.c:234
[17196000.568000] [<c01e7824>] pci_get_subsys+0x114/0x120
[17196000.636000] [<c0104bd0>] do_invalid_op+0x0/0xa0
[17196000.700000] [<c01e7848>] pci_get_device+0x18/0x20
[17196000.768000] [<c0115073>] mach_reboot_fixups+0x13/0x30
[17196000.836000] [<c0112371>] machine_emergency_restart+0x41/0x120
[17196000.916000] [<c011be5d>] panic+0xcd/0x100
[17196000.976000] [<c0104909>] die+0x159/0x170
[17196001.032000] [<c0104c5c>] do_invalid_op+0x8c/0xa0
[17196001.096000] [<f8c1747a>] ath_rate_findrate+0x18c/0x678 [ath_rate_sample]
[17196001.192000] [<c011cba5>] release_console_sem+0xd5/0xf0
[17196001.264000] [<c011c8d3>] vprintk+0x1d3/0x340
[17196001.324000] [<c010419f>] error_code+0x4f/0x60
[17196001.384000] [<f8c1747a>] ath_rate_findrate+0x18c/0x678 [ath_rate_sample]
[17196001.480000] [<c01ddfb8>] memmove+0x38/0x44
[17196001.536000] [<f8f0a22c>] wep_encap+0xba/0x1b0 [wlan_wep]
[17196001.612000] [<f8ced503>] ieee80211_crypto_encap+0x61/0x12c [wlan]
[17196001.696000] [<f8d1717c>] ath_tx_start+0xe8b/0x1001 [ath_pci]
[17196001.776000] [<c0279a3b>] kfree_skbmem+0xb/0x90
[17196001.840000] [<f8cf74fb>] ieee80211_skbhdr_adjust+0x77/0x23e [wlan]
[17196001.928000] [<f8cf77db>] ieee80211_encap+0x119/0x698 [wlan]
[17196002.004000] [<f8d1263f>] ath_start+0x106/0x64f [ath_pci]
[17196002.080000] [<c028fd31>] qdisc_restart+0x61/0x210
[17196002.148000] [<c027f53d>] dev_queue_xmit+0x7d/0x2e0
[17196002.212000] [<c02a39b3>] ip_output+0x133/0x280
[17196002.276000] [<c02a3dab>] ip_queue_xmit+0x2ab/0x510
[17196002.344000] [<f926f750>] _nv001807rm+0x50/0x70 [nvidia]
[17196002.420000] [<f8c54984>] zz000b6c10+0x78/0x10d0 [ath_hal]
[17196002.496000] [<f8c54943>] zz000b6c10+0x37/0x10d0 [ath_hal]
[17196002.572000] [<c02bac26>] tcp_v4_send_check+0x36/0xf0
[17196002.640000] [<c02b4a3f>] tcp_cwnd_restart+0x1f/0xd0
[17196002.708000] [<c02b4fef>] tcp_transmit_skb+0x3ef/0x7d0
[17196002.780000] [<c02b6247>] tcp_write_xmit+0x127/0x3d0
[17196002.848000] [<c02b6514>] __tcp_push_pending_frames+0x24/0xa0
[17196002.928000] [<c02aae4e>] tcp_sendmsg+0x9ae/0xb10
[17196002.996000] [<c0274e5a>] sock_sendmsg+0xea/0x120
[17196003.060000] [<c01311b0>] autoremove_wake_function+0x0/0x40
[17196003.136000] [<f8c1840c>] ath_rate_tx_complete+0x58c/0x840 [ath_rate_sample]
[17196003.236000] [<c02764c0>] sys_sendto+0x140/0x150
[17196003.300000] [<c0117f56>] deactivate_task+0x16/0x30
[17196003.368000] [<c02ec347>] schedule+0x317/0x690
[17196003.428000] [<c0279a6c>] kfree_skbmem+0x3c/0x90
[17196003.492000] [<c02757b3>] sock_poll+0x13/0x20
[17196003.556000] [<c02757b3>] sock_poll+0x13/0x20
[17196003.616000] [<c0174267>] do_pollfd+0x47/0xd0
[17196003.676000] [<c02764ed>] sys_send+0x1d/0x30
[17196003.736000] [<c0276d7a>] sys_socketcall+0x11a/0x1e0
[17196003.804000] [<c0102feb>] sysenter_past_esp+0x54/0x79

[Carlos Diener / emonkey (emonkey)]

The issue that you reported is one that should be reproducible with the live environment of the Desktop CD of the development release - Hardy Heron. It would help us greatly if you could test with it so we can work on getting it fixed in the actively developed release. You can find out more about the development release at [WWW] http://www.ubuntu.com/testing/

[Philippe Höij (philippe-hoij)]

Hi Carlos,

Unfortunately I have changed my setup to use only one wifi card and
I'm no longer using my Linux machine as an access point so I can't
test it anymore.

Sorry, you can close this bug since it doesn't affect me anymore.
Best regards
Philippe

On Wed, Mar 26, 2008 at 1:04 PM, Carlos Diener / emonkey
<email address hidden> wrote:
> The issue that you reported is one that should be reproducible with the
> live environment of the Desktop CD of the development release - Hardy
> Heron. It would help us greatly if you could test with it so we can work
> on getting it fixed in the actively developed release. You can find out
> more about the development release at [WWW]
> http://www.ubuntu.com/testing/
>
>
> ** Changed in: linux-source-2.6.15 (Ubuntu)
> Status: New => Incomplete
>
> --
> Kernel bug in madwifi on x86_32 with ath_rate/sample/sample.c:366
> https://bugs.launchpad.net/bugs/78093
> You received this bug notification because you are a direct subscriber
> of the bug.
>

[Connor Imes (ckimes)]

We are closing this bug report because it lacks the information we need to investigate the problem, as described in the previous comments. Please reopen it if you can give us the missing information, and don't hesitate to submit bug reports in the future. To reopen the bug report you can click on the current status, under the Status column, and change the Status back to "New". Thanks again!