kernel BUG at /build/buildd/linux-2.6.27/drivers/net/wireless/iwlwifi/iwl-tx.c:1198 and subsequent panic

[Roger E Critchlow Jr]

kernel BUG message and then a kernel panic at random when running wireless. Machine locks up with flashing caps-lock. No messages in /var/log. Kernel BUG message and panic collected by serial console.

No known trigger other than running wireless, but the BUG message clearly identifies the line in the iwlwifi sources where it happens and the oops can be avoided by running a wired network connection.

This appears to be the same problem reported against hardy linux-backports-modules in bug 244429 (https://bugs.launchpad.net/ubuntu/+source/linux-backports-modules-2.6.24/+bug/244429) starting in July, which has never been triaged or responded to by any developer.

lsb_release -rd
Description: Ubuntu intrepid (development branch)
Release: 8.10

apt-cache policy linux-image-2.6.27-4-generic
linux-image-2.6.27-4-generic:
  Installed: 2.6.27-4.6
  Candidate: 2.6.27-4.6
  Version table:
 *** 2.6.27-4.6 0
        500 http://us.archive.ubuntu.com intrepid/main Packages
        100 /var/lib/dpkg/status

[ 7192.033059] kernel BUG at /build/buildd/linux-2.6.27/drivers/net/wireless/iwlwifi/iwl-tx.c:1198!
[ 7192.033059] invalid opcode: 0000 [1] SMP
[ 7192.033059] CPU 1
[ 7192.033059] Modules linked in: ipv6 af_packet binfmt_misc bridge stp bnep rfcomm l2cap ppdev acpi_cpufreq cpufreq_powersave cpufreq_ondemand cpufreq_userspace cpufreq_stats freq_table cpufreq_conservative pci_slot container sbs sbshc iptable_filter ip_tables x_tables sbp2 parport_pc lp parport joydev snd_hda_intel snd_pcm_oss snd_mixer_oss arc4 ecb crypto_blkcipher snd_pcm snd_seq_dummy snd_seq_oss iwlagn iwlcore snd_seq_midi rfkill snd_rawmidi pcmcia led_class snd_seq_midi_event psmouse nvidia(P) mac80211 snd_seq btusb cfg80211 bluetooth i2c_core serio_raw snd_timer snd_seq_device yenta_socket snd soundcore rsrc_nonstatic snd_page_alloc pcmcia_core iTCO_wdt iTCO_vendor_support shpchp intel_agp wmi pci_hotplug video output button battery ac dcdbas evdev ext3 jbd mbcache sg sr_mod cdrom sd_mod crc_t10dif ata_piix ata_generic pata_acpi ohci1394 libata scsi_mod ieee1394 tg3 uhci_hcd libphy ehci_hcd usbcore dock thermal processor fan fbcon tileblit font bitblit softcursor uvesafb cn fuse
[ 7192.033059] Pid: 7182, comm: firefox Tainted: P 2.6.27-4-generic #1
[ 7192.033059] RIP: 0010:[<ffffffffa0acd137>] [<ffffffffa0acd137>] iwl_tx_cmd_complete+0x107/0x110 [iwlcore]
[ 7192.033059] RSP: 0000:ffff88011f05be00 EFLAGS: 00010086
[ 7192.033059] RAX: 0000000000000046 RBX: ffff88011a804c60 RCX: ffff88011d543e50
[ 7192.033059] RDX: ffffffff8066c248 RSI: 0000000000000086 RDI: 0000000000000082
[ 7192.033059] RBP: ffff88011f05be20 R08: 0000000000001eff R09: 00000000fffffa00
[ 7192.033059] R10: 0000000000000000 R11: 00000000ffffffff R12: ffff88011a801a00
[ 7192.033059] R13: ffff88011a804c60 R14: 00000000000000c8 R15: 0000000000000008
[ 7192.033059] FS: 00007fd1bc3546f0(0000) GS:ffff88011fc02980(0000) knlGS:0000000000000000
[ 7192.033059] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 7192.033059] CR2: 000000000b8b1238 CR3: 000000010073c000 CR4: 00000000000006e0
[ 7192.033059] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 7192.033059] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 7192.033059] Process firefox (pid: 7182, threadinfo ffff8801006dc000, task ffff8800dd4e9670)
[ 7192.033059] Stack: ffff88011a804c60 ffff88011a801a00 0000000000000001 00000000000000c8
[ 7192.033059] ffff88011f05be80 ffffffffa0ae40e2 ffffffff8023dd1e 000000000185d700
[ 7192.033059] ffff88011a805b94 ffff88011a805b80 000000c90185d700 ffff88011a801a00
[ 7192.033059] Call Trace:
[ 7192.033059] <IRQ> [<ffffffffa0ae40e2>] iwl_rx_handle+0xf2/0x2d0 [iwlagn]
[ 7192.033059] [<ffffffff8023dd1e>] ? __wake_up+0x4e/0x70
[ 7192.033059] [<ffffffffa0ae63cf>] iwl4965_irq_tasklet+0x1ef/0x350 [iwlagn]
[ 7192.033059] [<ffffffff802545d6>] tasklet_action+0x86/0x110
[ 7192.033059] [<ffffffff80254c9c>] __do_softirq+0x8c/0x100
[ 7192.033059] [<ffffffffa0ae6058>] ? iwl4965_isr+0x88/0x110 [iwlagn]
[ 7192.033059] [<ffffffff802141ac>] call_softirq+0x1c/0x30
[ 7192.033059] [<ffffffff802158a5>] do_softirq+0x65/0xa0
[ 7192.033059] [<ffffffff80254a05>] irq_exit+0x95/0xa0
[ 7192.033059] [<ffffffff80215b4b>] do_IRQ+0x8b/0x100
[ 7192.033059] [<ffffffff80212f3e>] ret_from_intr+0x0/0x29
[ 7192.033059] <EOI>
[ 7192.033059]
[ 7192.033059] Code: 4c 89 e7 ff d0 85 c0 75 83 49 c7 45 08 00 00 00 00 0f 1f 00 e9 73 ff ff ff 0f b6 51 04 48 c7 c7 58 3c ad a0 31 c0 e8 33 bc a4 df <0f> 0b eb fe 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 48 83 ec
[ 7192.033059] RIP [<ffffffffa0acd137>] iwl_tx_cmd_complete+0x107/0x110 [iwlcore]
[ 7192.033059] RSP <ffff88011f05be00>
[ 7192.033059] ---[ end trace baeeb32c2931cd0f ]---
[ 7192.033059] Kernel panic - not syncing: Aiee, killing interrupt handler!

[Chris Coulson (chrisccoulson)]

Thanks. There is no Oops in your log. There is a BUG message and then you get a kernel panic straight afterwards, and then a warning. I have removed the kernel-oops tag and replaced it with a kernel-bug tag.

Please include the following additional information, if you have not already done so (pay attention to lspci's additional options), as required by the Ubuntu Kernel Team:
1. Please include the output of the command "uname -a" in your next response. It should be one, long line of text which includes the exact kernel version you're running, as well as the CPU architecture.
2. Please run the command "dmesg > dmesg.log" after a fresh boot and attach the resulting file "dmesg.log" to this bug report.
3. Please run the command "sudo lspci -vvnn > lspci-vvnn.log" and attach the resulting file "lspci-vvnn.log" to this bug report.

For your reference, the full description of procedures for kernel-related bug reports is available at https://wiki.ubuntu.com/KernelTeamBugPolicies Thanks in advance!

[Chris Coulson (chrisccoulson)]

Thanks Roger. I have edited your bug title and description to include the trace from the BUG message and emphasize that a kernel panic occurs too.

[Chris Coulson (chrisccoulson)]

Thanks for putting the effort in to extracting the information about the crash from you machine too.

[Roger E Critchlow Jr (rec)]

This bug doesn't turn up when searching for bugs in Intrepid Ibex, even though it's filed against the Intrepid Ibex kernel.

[Chris Coulson (chrisccoulson)]

That's because it is just filed against 'linux', which is not just the Intrepid kernel. You have the option of 'Nominate for release' at the top of the page, where you can nominate for fixing in a particular release. The release manager will then accept or decline the nomination. If accepted, it's status will be tracked in Intrepid, and will appear on the list of Intrepid bugs.

[Scott Armitage (scott-armitage)]

I am experiencing the same issue: sometimes (randomly, as far as I can tell; I only have wireless connections, no wired connections) my Lenovo T61 will lock up; can't move the mouse, can't type, etc.. Any animations on-screen also freeze completely. The only indication of life is that the CAPS-LOCK key is blinking at a steady pace. This has started happening only after upgrading to the Intrepid beta; also, although I can't be sure, I think it may only have started after the last round of kernel updates (but I can't remember this for sure).

$ uname -a
Linux asuka 2.6.27-7-generic #1 SMP Wed Oct 22 01:30:40 UTC 2008 x86_64 GNU/Linux

[Scott Armitage (scott-armitage)]

I was just taking a look at the Ubuntu 8.10 RC release notes page (http://www.ubuntu.com/getubuntu/releasenotes/810) and it would seem that this is a known issue:

> System lock-ups with Intel 4965 wireless
>
> The version of the iwlagn wireless driver for Intel 4965 wireless chipsets included in Linux
> kernel version 2.6.27 causes kernel panics when used with 802.11n networks. Users
> affected by this issue can install the linux-backports-modules-intrepid package, to install
> a newer version of this driver that corrects the bug. (Because the known fix requires a new
> version of the driver, it is not expected to be possible to include this fix in the main kernel
> package.)

Bleh =/

[matjan (matty-janssen)]

I have been experiencing the same problem on my Thinkpad T61. I did a clean install of Intrepid beta two weeks ago (October 13th), just to give you an idea of what kernel version I started using. The problem manifested itself at that time (I upgraded from Gutsy).

$ uname -a
Linux laptop 2.6.27-7-generic #1 SMP Fri Oct 24 06:42:44 UTC 2008 i686 GNU/Linux

[Chris Coulson (chrisccoulson)]

Scott - You might have a different issue, and you should open a new bug report.

matjan - there is nothing in your dmesg output to suggest you are experiencing this same bug

[matjan (matty-janssen)]

Chris - I have not been able to capture a message either in the logs that might relate to the problem I experience. Nevertheless, the symptoms described in the initial bug report (total freeze + caps lock light flashing) are exactly the same that I observe. Furthermore, I have only experienced this problem when using wireless. This led me to believe that this is the bug I am dealing with.
Please let me know what information I would need to provide to more accurately assess the problem.

matjan

[Chris Coulson (chrisccoulson)]

matjan - the symptoms you describe are the general symptoms of a kernel panic, of which there could be many possible causes. Without being absolutely certain that this is the bug you are experiencing, you should open a new report, providing the information requested at https://wiki.ubuntu.com/KernelTeamBugPolicies

[Gerard Dethier (g-dethier)]

Hi,

I think that I experience the same bug on my Dell Inspiron 1520. Althought, I cannot be sure for the kernel BUG as I only saw the end of the kernel panic message (attached as a screenshot). However, the trace that I get with my kernel panic is quite similar to the end of the trace included in the bug description ( ``iwl4965_irq_tasklet+0x1ef/0x350 [iwlagn]'' becomes ``iwl3945_irq_tasklet+0x23f/0x440 [iwl3945]'' in my case).

Should I open a new bug or provide more information here?

Gerard

[Marc Schiffbauer (mschiff)]

Hi,

I have a Lenovo T61 and I had a Kernel panic today (frozen X-Server with blinking Capslock-Led). The logs did not show anything about right before the panic.

Now after the reboot I saw this OOps and I think it might be related.

I have installed the backported modules package.
ii linux-backports-modules-2.6.27-7-generic 2.6.27-7.6 Ubuntu supplied Linux modules for version 2.6.27 on x86/x86_64
ii linux-backports-modules-intrepid 2.6.27.7.11 Generic Linux backported drivers.
ii linux-backports-modules-intrepid-generic 2.6.27.7.11 Backported drivers for generic kernel image

uname -a:
Linux bart 2.6.27-7-generic #1 SMP Tue Nov 4 19:33:20 UTC 2008 i686 GNU/Linux

This is the kernel messages I observed (I hope this helps):
[ 65.658860] ------------[ cut here ]------------
[ 65.658874] WARNING: at /build/buildd/linux-backports-modules-2.6.27-2.6.27/debian/build/build-generic/compat-wireless-2.6/net/mac80211/main.c:227 ieee80211_hw_config+0x8f/0xa0 [lbm_cw_mac80211]()
[ 65.658883] Modules linked in: binfmt_misc rfcomm bridge stp bnep sco l2cap bluetooth af_packet ppdev vmnet vmblock vmci vmmon ipv6 sbs pci_slot sbshc container acpi_cpufreq cpufreq_conservative cpufreq_userspace cpufreq_ondemand cpufreq_powersave cpufreq_stats freq_table iptable_filter ip_tables x_tables sha256_generic aes_i586 aes_generic cbc dm_crypt sbp2 parport_pc lp parport loop joydev pcmcia snd_hda_intel snd_pcm_oss snd_mixer_oss snd_pcm arc4 ecb crypto_blkcipher snd_seq_dummy snd_seq_oss thinkpad_acpi serio_raw nvram iwlagn evdev pcspkr dm_multipath scsi_dh snd_seq_midi psmouse iwlcore snd_rawmidi rfkill video output battery ac snd_seq_midi_event led_class nvidia(P) snd_seq agpgart lbm_cw_mac80211 wmi snd_timer i2c_core lbm_cw_cfg80211 snd_seq_device yenta_socket sdhci_pci iTCO_wdt button rsrc_nonstatic sdhci ricoh_mmc snd pcmcia_core mmc_core iTCO_vendor_support soundcore snd_page_alloc shpchp pci_hotplug ext3 jbd mbcache sr_mod cdrom sd_mod crc_t10dif sg ata_piix pata_acpi ohci1394 ahci ata_generic ieee1394 libata scsi_mod ehci_hcd dock uhci_hcd usbcore e1000e raid10 raid456 async_xor async_memcpy async_tx xor raid1 raid0 multipath linear md_mod dm_mirror dm_log dm_snapshot dm_mod thermal processor fan fbcon tileblit font bitblit softcursor fuse
[ 65.659156] Pid: 7344, comm: wpa_supplicant Tainted: P 2.6.27-7-generic #1
[ 65.659164] [<c037c406>] ? printk+0x1d/0x1f
[ 65.659180] [<c0131de9>] warn_on_slowpath+0x59/0x90
[ 65.659197] ...

[Captain Nemo (guillaumecardon)]

Hello,

I've got the same problem but it appeared without reasons.

I'm on Intrepid since 2 week, connected on my personal hotspot, and no problem.

However, the problem was appared when i'm connect on my parent's hotspot. No particular settings on this connection (54mbit, WPA-PSK, IP send by DHCP, etc.)

I've upgrade to Linux 2.6.27-8-generic and for the moment, all is allright.

[Captain Nemo (guillaumecardon)]

And no, new freeze...

[icemaann (9-launchpad-mandrake-us)]

This bug affects Dell Latitude D630 laptops, especially when using Cisco wireless. Hopefully this gets resolved soon. For now I may need to switch to ndiswrapper...

[Gerard Dethier (g-dethier)]

I just updated the kernel to version 2.6.27-10. In my case (Dell Inspiron 1520, Intel Pro/Wireless 3945ABG, driver iwl3945), the problem seems to be solved (no more kernel panic after random time).

[Gerard Dethier (g-dethier)]

Nevermind, the kernel panic just occured after more time than usual...

[Mozg (andrei-arhont)]

I have the same issue with the latest kernel on amd64 and backport modules installed. My setup is as following:

Wi-Fi Router: SMC 802.11n with 20/40Mhz / WPA-PSK
Intel 4965 wifi card
Thinkpad 61p 6459CTO

What I've noticed is after connecting to the router, authentication succeeds and I get IP address. However, I can not ping the router for some reason. Iwconfig shows that I am authenticated and shows the encryption key. If I run ping -f -s 10000 <router ip> for about a minute or so I would get the kernel bug in my syslog. Shortly (10-15 seconds) after the kernel bug my pings start working and I get icmp replies from the router. I have to do this every time when I reboot and every time prior to connection actually starts to work I get the kernel bug.

The bug information is attached in files.tar.bz2

I have the following backport modules installed:
linux-backports-modules-2.6.27-9-generic 2.6.27-9.5
linux-backports-modules-intrepid 2.6.27.9.13
linux-backports-modules-intrepid-generic 2.6.27.9.13
linux-image-2.6.27-9-generic 2.6.27-9.19

[goto (gotolaunchpad)]

I also have the same or at least a similar issue. I don't see the BUG message, but a kernel panic occurs often when roaming between access points.

The system is a Dell Vostro 1510 with iwl3945 using WPA2-PSK.

I encountered this problem with different combinations of access points (Asus, Linksys, Apple Airport) but only when roaming from one access point to another. Wireless is stable as long as I always keep in the same BSS.

[Launchpad Janitor (janitor)]

Per a decision made by the Ubuntu Kernel Team, bugs will longer be assigned to the ubuntu-kernel-team in Launchpad as part of the bug triage process. The ubuntu-kernel-team is being unassigned from this bug report. Refer to https://wiki.ubuntu.com/KernelTeamBugPolicies for more information. Thanks.

[Amit Kucheria (amitk)]

Unfortunately it seems this bug is still an issue. This issue appears to be related to a firmware bug as described at http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1703

Can you confirm this issue exists with the most recent Jaunty Jackalope 9.04 release - http://www.ubuntu.com/news/ubuntu-9.04-desktop . It seems to be fixed in 2.6.28 kernels that Jaunty uses. Even a Live-CD test will allow us to see how easy it is to backport the changes to Intrepid.

Please let us know your results. Thanks.

[muchasuerte (nicotra-andrea)]

yes , this issue exists with the most recent Jaunty Jackalope 9.04 release

I have that issue with:

kernel 2.6.28-11-generic
Intel Corporation PRO/Wireless 5300 AGN [Shiloh] Network Connection

I also think that this issue could be related to a firmware bug ( I verify a
corruption of ext3 if I use wifi connection).

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/209346

2009/5/12 Amit Kucheria <email address hidden>

> Unfortunately it seems this bug is still an issue. This issue appears
> to be related to a firmware bug as described at
> http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1703
>
> Can you confirm this issue exists with the most recent Jaunty Jackalope
> 9.04 release - http://www.ubuntu.com/news/ubuntu-9.04-desktop . It seems
> to be fixed in 2.6.28 kernels that Jaunty uses. Even a Live-CD test will
> allow us to see how easy it is to backport the changes to Intrepid.
>
> Please let us know your results. Thanks.
>
> ** Bug watch added: Intel Wireless Linux Bugzilla #1703
> http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1703
>
> --
> kernel BUG at
> /build/buildd/linux-2.6.27/drivers/net/wireless/iwlwifi/iwl-tx.c:1198 and
> subsequent panic
> https://bugs.launchpad.net/bugs/275359
> You received this bug notification because you are a direct subscriber
> of the bug.
>
> Status in “linux” source package in Ubuntu: Triaged
>
> Bug description:
> kernel BUG message and then a kernel panic at random when running wireless.
> Machine locks up with flashing caps-lock. No messages in /var/log. Kernel
> BUG message and panic collected by serial console.
>
> No known trigger other than running wireless, but the BUG message clearly
> identifies the line in the iwlwifi sources where it happens and the oops can
> be avoided by running a wired network connection.
>
> This appears to be the same problem reported against hardy
> linux-backports-modules in bug 244429 (
> https://bugs.launchpad.net/ubuntu/+source/linux-backports-modules-2.6.24/+bug/244429)
> starting in July, which has never been triaged or responded to by any
> developer.
>
> lsb_release -rd
> Description: Ubuntu intrepid (development branch)
> Release: 8.10
>
> apt-cache policy linux-image-2.6.27-4-generic
> linux-image-2.6.27-4-generic:
> Installed: 2.6.27-4.6
> Candidate: 2.6.27-4.6
> Version table:
> *** 2.6.27-4.6 0
> 500 http://us.archive.ubuntu.com intrepid/main Packages
> 100 /var/lib/dpkg/status
>
> [ 7192.033059] kernel BUG at
> /build/buildd/linux-2.6.27/drivers/net/wireless/iwlwifi/iwl-tx.c:1198!
> [ 7192.033059] invalid opcode: 0000 [1] SMP
> [ 7192.033059] CPU 1
> [ 7192.033059] Modules linked in: ipv6 af_packet binfmt_misc bridge stp
> bnep rfcomm l2cap ppdev acpi_cpufreq cpufreq_powersave cpufreq_ondemand
> cpufreq_userspace cpufreq_stats freq_table cpufreq_conservative pci_slot
> container sbs sbshc iptable_filter ip_tables x_tables sbp2 parport_pc lp
> parport joydev snd_hda_intel snd_pcm_oss snd_mixer_oss arc4 ecb
> crypto_blkcipher snd_pcm snd_seq_dummy snd_seq_oss iwlagn iwlcore
> snd_seq_midi rfkill snd_rawmidi pcmcia led_class snd_seq_midi_event psmouse
> nvidia(P) mac80211 snd_seq btu...

[Bernhard Schmidt (berni)]

This bug is fixed for me on Jaunty (with 4965AGN). According to http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1703 the fix does not apply to the 5000 series, the fixed ucode on that chipset is not released yet (http://www.intellinuxwireless.org/bugzilla/show_bug.cgi?id=1946).

[Stefan Bader (smb)]

According to According to http://intellinuxwireless.org/?n=Downloads a new firmware for iwl-5000 has been released. If the file (iwlwifi-5000-2.ucode) is placed into /lib/firmware and the linux-backports-modules version of the iwlwifi driver is used, the problem should be solved. Could someone verify this?

[James Ward (jamesward)]

I'm not seeing this bug anymore on the latest karmic.

[Stefan Bader (smb)]

According to the last comment I will mark this as fixed. Should this be not the case for anybody, please feel free to reopen this bug. Thanks.