| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <87pron6j8n.wl%peterc@chubb.wattle.id.au> Date: Wed, 06 Aug 2008 11:10:48 +1000 From: Peter Chubb <peterc@...ato.unsw.edu.au> To: Ivo van Doorn <ivdoorn@...il.com> Cc: Peter Chubb <peterc@...ato.unsw.edu.au>, linux-kernel@...r.kernel.org, linux-wireless@...r.kernel.org, John Linville <linville@...driver.com> Subject: Re: Fixing rt2500pci >>>>> "Ivo" == Ivo van Doorn <ivdoorn@...il.com> writes: Ivo> Are you running rt2500pci in managed or adhoc mode? And when Ivo> does this bug trigger, when authenticating, associating, Ivo> deauthentication or random? Managed mode; the bug happens randomly. Ivo> Also could you post some of the rt2500/mac80211 debug messages Ivo> from the log from before the actual bug? There isn't very much. Here's another trace plus all messages from the rt2500 or MAC or PHY. I can turn on more debugging if you can suggest what'd be appropriate. The gap between the `switching to long barker preamble' message and the OOPS is about half an hour. I should perhaps mention that the card has difficulty in associating now: I do ifup and nothing happens unless a different window I force a reassociation by doing iwconfig wlan0 essid any in a different window while dhclient is running. rt2500pci 0000:05:09.0: PCI INT A -> GSI 16 (level, low) -> IRQ 16 phy0: Selected rate control algorithm 'pid' Registered led device: rt2500pci-phy0:radio phy0: HW CONFIG: freq=2412 ADDRCONF(NETDEV_UP): wlan: link is not ready phy0: HW CONFIG: freq=2412 phy0: HW CONFIG: freq=2417 phy0: HW CONFIG: freq=2422 phy0: HW CONFIG: freq=2427 phy0: HW CONFIG: freq=2432 phy0: HW CONFIG: freq=2437 phy0: HW CONFIG: freq=2442 phy0: HW CONFIG: freq=2447 phy0: HW CONFIG: freq=2452 phy0: HW CONFIG: freq=2457 phy0: HW CONFIG: freq=2462 phy0: HW CONFIG: freq=2412 phy0: HW CONFIG: freq=2422 wlan: authenticate with AP 00:12:17:68:eb:05 wlan: authenticated wlan: associate with AP 00:12:17:68:eb:05 wlan: RX AssocResp from 00:12:17:68:eb:05 (capab=0x11 status=0 aid=17) wlan: associated phy0: Allocated STA 00:12:17:68:eb:05 phy0: Inserted STA 00:12:17:68:eb:05 ADDRCONF(NETDEV_CHANGE): wlan: link becomes ready phy0: Removed STA 00:12:17:68:eb:05 phy0: Destroyed STA 00:12:17:68:eb:05 phy0: HW CONFIG: freq=2422 ADDRCONF(NETDEV_UP): wlan: link is not ready phy0: HW CONFIG: freq=2422 wlan: authenticate with AP 00:12:17:68:eb:05 wlan: authenticated wlan: associate with AP 00:12:17:68:eb:05 wlan: RX AssocResp from 00:12:17:68:eb:05 (capab=0x11 status=0 aid=17) wlan: associated phy0: Allocated STA 00:12:17:68:eb:05 phy0: Inserted STA 00:12:17:68:eb:05 wlan: No ProbeResp from current AP 00:12:17:68:eb:05 - assume out of range phy0: Removed STA 00:12:17:68:eb:05 ADDRCONF(NETDEV_CHANGE): wlan: link becomes ready wlan: dropped frame to 00:12:17:68:eb:05 (unauthorized port) phy0: Destroyed STA 00:12:17:68:eb:05 wlan: dropped frame to 00:12:17:68:eb:05 (unauthorized port) phy0: HW CONFIG: freq=2422 ADDRCONF(NETDEV_UP): wlan: link is not ready phy0: HW CONFIG: freq=2422 wlan: authenticate with AP 00:12:17:68:eb:05 wlan: authenticated wlan: associate with AP 00:12:17:68:eb:05 wlan: RX AssocResp from 00:12:17:68:eb:05 (capab=0x11 status=0 aid=17) wlan: associated phy0: Allocated STA 00:12:17:68:eb:05 phy0: Inserted STA 00:12:17:68:eb:05 ADDRCONF(NETDEV_CHANGE): wlan: link becomes ready wlan: no IPv6 routers present wlan: CTS protection enabled (BSSID=00:12:17:68:eb:05) wlan: switched to short barker preamble (BSSID=00:12:17:68:eb:05) wlan: CTS protection disabled (BSSID=00:12:17:68:eb:05) wlan: switched to long barker preamble (BSSID=00:12:17:68:eb:05) **30 minutes gap here*** general protection fault: 0000 [1] PREEMPT CPU 0 Modules linked in: radeon rfcomm l2cap bluetooth tun sd_mod scsi_mod rt2500pci rt2x00pci rt2x00lib led_class pcmcia rtc_cmos firewire_ohci mac80211 snd_hda_intel firewire_core rtc_core yenta_socket i2c_piix4 serio_raw eeprom_93cx6 rtc_lib usbhid rsrc_nonstatic snd_hwdep i2c_core hid Pid: 2203, comm: rt2500pci Not tainted 2.6.27-rc1 #52 RIP: 0010:[<ffffffff80260c8d>] [<ffffffff80260c8d>] put_page+0xc/0xd6 RSP: 0018:ffff88003efbfbf0 EFLAGS: 00010286 RAX: 0000000000000000 RBX: a28ff9ca48bf9c98 RCX: 0000000000000000 RDX: ffff8800361ff9c0 RSI: 0000000000000000 RDI: a28ff9ca48bf9c98 RBP: ffff88003efbfc00 R08: ffff88003ef7a2a0 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8800361ff014 R14: ffff88003ef1b000 R15: 0000000000000000 FS: 00007f47264506e0(0000) GS:ffffffff8068ae40(0000) knlGS:00000000f7ba06c0 CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b CR2: 00007fff807567f6 CR3: 000000003e2a7000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process rt2500pci (pid: 2203, threadinfo ffff88003efbe000, task ffff88003f9d7700) Stack: 0000000000000000 ffff8800361e7300 ffff88003efbfc20 ffffffff80482ee8 ffff8800361e7300 ffff88003ef4c7c0 ffff88003efbfc40 ffffffff8048358a ffff88003ef4c7c0 ffff8800361e7300 ffff88003efbfc60 ffffffff80482d85 Call Trace: [<ffffffff80482ee8>] skb_release_data+0x68/0xac [<ffffffff8048358a>] skb_release_all+0x6f/0x73 [<ffffffff80482d85>] __kfree_skb+0x11/0x77 [<ffffffff80482e11>] kfree_skb+0x26/0x28 [<ffffffffa009c1b6>] ieee80211_sta_rx_queued_mgmt+0xd5f/0xd85 [mac80211] [<ffffffff804835fa>] ? __alloc_skb+0x3b/0x12e [<ffffffff80496f9d>] ? __qdisc_run+0xd1/0x1ea [<ffffffff8048b197>] ? dev_queue_xmit+0x427/0x468 [<ffffffffa0097489>] ? ieee80211_rx_bss_get+0xbb/0xca [mac80211] [<ffffffffa00975d4>] ? ieee80211_rx_bss_put+0x2c/0xf3 [mac80211] [<ffffffffa009776f>] ? ieee80211_privacy_mismatch+0x9e/0xcd [mac80211] [<ffffffffa009d338>] ieee80211_sta_work+0x99/0x6c5 [mac80211] [<ffffffff8052ae7e>] ? thread_return+0x30/0xa9 [<ffffffffa009d29f>] ? ieee80211_sta_work+0x0/0x6c5 [mac80211] [<ffffffff8023a2b9>] run_workqueue+0xb2/0x178 [<ffffffff8023ac9a>] worker_thread+0xd3/0xe0 [<ffffffff8023d9b1>] ? autoremove_wake_function+0x0/0x38 [<ffffffff8023abc7>] ? worker_thread+0x0/0xe0 [<ffffffff8023d8a1>] kthread+0x49/0x78 [<ffffffff8020bc59>] child_rip+0xa/0x11 [<ffffffff8023d858>] ? kthread+0x0/0x78 [<ffffffff8020bc4f>] ? child_rip+0x0/0x11 [<ffffffff80496f9d>] ? __qdisc_run+0xd1/0x1ea [<ffffffff8048b197>] ? dev_queue_xmit+0x427/0x468 [<ffffffffa0097489>] ? ieee80211_rx_bss_get+0xbb/0xca [mac80211] [<ffffffffa00975d4>] ? ieee80211_rx_bss_put+0x2c/0xf3 [mac80211] [<ffffffffa009776f>] ? ieee80211_privacy_mismatch+0x9e/0xcd [mac80211] [<ffffffffa009d338>] ieee80211_sta_work+0x99/0x6c5 [mac80211] [<ffffffff8052ae7e>] ? thread_return+0x30/0xa9 [<ffffffffa009d29f>] ? ieee80211_sta_work+0x0/0x6c5 [mac80211] [<ffffffff8023a2b9>] run_workqueue+0xb2/0x178 [<ffffffff8023ac9a>] worker_thread+0xd3/0xe0 [<ffffffff8023d9b1>] ? autoremove_wake_function+0x0/0x38 [<ffffffff8023abc7>] ? worker_thread+0x0/0xe0 [<ffffffff8023d8a1>] kthread+0x49/0x78 [<ffffffff8020bc59>] child_rip+0xa/0x11 [<ffffffff8023d858>] ? kthread+0x0/0x78 [<ffffffff8020bc4f>] ? child_rip+0x0/0x11 Code: f6 80 38 e0 ff ff 08 74 05 e8 ea a2 2c 00 5e 5b c9 c3 55 48 89 e5 e8 71 ff ff ff c9 31 c0 c3 55 48 89 e5 53 48 89 fb 48 83 ec 08 <f7> 07 00 60 00 00 74 0a e8 05 f9 ff ff e9 b4 00 00 00 ff 4f 08 RIP [<ffffffff80260c8d>] put_page+0xc/0xd6 RSP <ffff88003efbfbf0> ---[ end trace 4f9e6e26b2f3fe71 ]--- -- Dr Peter Chubb http://www.gelato.unsw.edu.au peterc AT gelato.unsw.edu.au http://www.ertos.nicta.com.au ERTOS within National ICT Australia -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists