[3.13.0-30.55] rtl8821ae Kernel PANIC due to calling incorrect function
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
linux (Ubuntu) |
Fix Released
|
High
|
Unassigned | ||
Trusty |
Fix Released
|
Undecided
|
Tim Gardner | ||
Utopic |
Fix Released
|
High
|
Unassigned |
Bug Description
I had a support incident with a user of an Asus X551MA containing a Realtek RTL8821AE WiFi card. After the kernel update from 3.13.0-24 to 3.13.0-30 there was a kernel Panic as soon as the wifi card began scanning (photograph attached).
I investigated the bug in detail and diagnosed the cause to commit 22bf70f which modifies a function prototype called by the RTL8821ae driver but does not update the driver to call the alternative function.
Corrective patch attached.
RIP [<ffffffffa042f
No changes were introduced in the rtl8821ae module between 3.13.0-24 and 3.13.0-30. The only changes were in mac80211, which rtl8821ae depends on (along with cfg80211):
# check rtl8821ae
$ gitlog Ubuntu-
# check mac80211
$ gitlog Ubuntu-
7049ad3 Mon May 19 18:45:30 2014 +0100 Michael Braun mac80211: fix WPA with VLAN on AP side with ps-sta again
5d31275 Mon May 19 18:45:30 2014 +0100 Johannes Berg mac80211: fix suspend vs. authentication race
56f2ea4 Mon May 19 18:45:29 2014 +0100 Johannes Berg mac80211: fix potential use-after-free
22bf70f Tue Apr 15 15:27:46 2014 +0100 Johannes Berg mac80211: add length check in ieee80211_
# check cfg80211
$ gitlog Ubuntu-
$
The faulting location is in function rx_query_desc() at offset 0x1d5.
$ objdump -d /lib/modules/
0000000000033e40 <rtl8821ae_
Faulting instruction is at 0x33e40 + 0x1d5 = 0x34015
Now I examine the debug-symbols of the module with:
$ gdb -d drivers/
(gdb) info line rtl8821ae_
Line 539 of "/build/
and ends at 0x33e65 <rtl8821ae_
(gdb) x/i 0x34015
0x34015 <rtl8821ae_
(gdb) disas rtl8821ae_
...
0x000000000
0x000000000
0x000000000
0x000000000
0x000000000
0x000000000
0x000000000
0x000000000
0x000000000
...
(gdb) info line *0x34015
Line 2194 of "/build/
and ends at 0x34018 <rtl8821ae_
---- include/
/**
* _ieee80211_
* @hdr: the frame (buffer must include at least the first octet of payload)
*/
static inline bool _ieee80211_
{
if (ieee80211_
return true;
/**
* ieee80211_
* @fc: frame control bytes in little-endian byteorder
*/
static inline int ieee80211_
{
return (fc & cpu_to_
}
----- drivers/
...
if ((ieee80211_
else
}
...
----- 8-< -----
On investigation it appears that gdb may have an incorrect debug reference for the location of ieee80211_
location it references is for the underscore-prefix function _ieee80211_
The changes introduced in commit:
22bf70f Tue Apr 15 15:27:46 2014 +0100 Johannes Berg mac80211: add length check in ieee80211_
include renaming the existing
ieee80211_
to
_ieee80211_
and replacing the original function with one taking an skb, not ieee80211_hdr:
+ * ieee80211_
+ * @skb: the skb containing the frame, length will be checked
+ */
+static inline bool ieee80211_
+{
+ if (skb->len < 25)
+ return false;
+ return _ieee80211_
+}
+
+/**
Not being able to debug a live kernel with this hardware I'm unable to pursue much further, but commit 22bf70f suggests that the wrong function is now being called by rtl8821ae because it isn't
patched to call the underscore version of the function as all other rtl* drivers were. If this is the case, the receiving function is expecting a skb.
The required change therefore probably should be:
$ git diff drivers/
diff --git a/drivers/
index 75ae438..963b55f 100644
--- a/drivers/
+++ b/drivers/
@@ -616,7 +616,7 @@ bool rtl8821ae_
}
- if ((ieee80211_
+ if ((_ieee80211_
---
description: | updated |
tags: | added: patch |
Changed in linux (Ubuntu Trusty): | |
status: | In Progress → Fix Committed |
Hello,
I can confirm the kernel panics after loading rtl8821ae module, while ubuntu boots on Asus R510L notebook.
$ sudo lspci|grep -i rtl
02:00.1 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 12)
03:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8821AE 802.11ac PCIe Wireless Network Adapter
After blacklisting the rtl8821ae module the computer starts fine but without the network (wlan or ethernet): d/blacklist- asus_rtl. conf
$ cat /etc/modprobe.
blacklist rtl8821ae
02:00.1 Ethernet controller: Realtek Semiconductor Co., Ltd. RTL8111/8168/8411 PCI Express Gigabit Ethernet Controller (rev 12)
Subsystem: ASUSTeK Computer Inc. Device 200f
Flags: bus master, fast devsel, latency 0, IRQ 65
I/O ports at e000 [size=256]
Memory at f7914000 (64-bit, non-prefetchable) [size=4K]
Memory at f7910000 (64-bit, non-prefetchable) [size=16K]
Capabilities: [40] Power Management version 3
Capabilities: [50] MSI: Enable+ Count=1/1 Maskable- 64bit+
Capabilities: [70] Express Endpoint, MSI 01
Capabilities: [b0] MSI-X: Enable- Count=4 Masked-
Capabilities: [d0] Vital Product Data
Capabilities: [100] Advanced Error Reporting
Capabilities: [160] Device Serial Number 34-80-75-<removed>
Capabilities: [170] Latency Tolerance Reporting
Capabilities: [178] L1 PM Substates
Kernel driver in use: r8169
03:00.0 Network controller: Realtek Semiconductor Co., Ltd. RTL8821AE 802.11ac PCIe Wireless Network Adapter ff-<removed>
Subsystem: AzureWave Device 2161
Flags: bus master, fast devsel, latency 0, IRQ 10
I/O ports at d000 [size=256]
Memory at f7800000 (64-bit, non-prefetchable) [size=16K]
Capabilities: [40] Power Management version 3
Capabilities: [50] MSI: Enable- Count=1/1 Maskable- 64bit+
Capabilities: [70] Express Endpoint, MSI 00
Capabilities: [100] Advanced Error Reporting
Capabilities: [140] Device Serial Number 00-e0-4c-
Capabilities: [150] Latency Tolerance Reporting
Capabilities: [158] L1 PM Substates
Regards,
BemNum