Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#40500 - [linux] networking-related system freeze with kernel 3.14.x

Attached to Project: Arch Linux
Opened by Janna Martl (jmartl109) - Friday, 23 May 2014, 01:39 GMT
Last edited by Tobias Powalowski (tpowa) - Monday, 16 June 2014, 10:10 GMT
Task Type Bug Report
Category Kernel
Status Closed
Assigned To Tobias Powalowski (tpowa)
Thomas Bächler (brain0)
Architecture x86_64
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

I use NetworkManager to connect to a WPA enterprise wireless network. After a few repetitions of the following

# systemctl stop NetworkManager
# rmmod b43
# rmmod ssb
# modprobe ssb
# modprobe b43
# systemctl start NetworkManager

my entire system freezes -- not even the magic SysRq key does anything.

* This happens both with b43 (as above) and with broadcom-wl.
* This happens both with dhcpcd and dhclient.
* This happens with 3.14.x kernels but not 3.13.x kernels.

It seems that this has something to do with releasing the dhcp lease: the last thing I see watching journalctl -f before the freeze is something of the form

May 22 20:44:21 <hostname> dhclient[1624]: DHCPRELEASE on wlan0 to <IP> port 67

There are no logs or coredumps from the event that I can see after rebooting (so the line I copied above is from an iteration that did not actually trigger the bug).


Other information:

# lspci -vvv | grep -i wireless
02:00.0 Network controller: Broadcom Corporation BCM4322 802.11a/b/g/n Wireless LAN Controller (rev 01)

# uname -a
Linux hostname 3.14.0-4-ARCH #1 SMP PREEMPT Wed Apr 9 21:11:25 CEST 2014 x86_64 GNU/Linux

I'm not really sure how to provide better information about this, seeing as it leaves no trace in the logs.
This task depends upon

Closed by  Tobias Powalowski (tpowa)
Monday, 16 June 2014, 10:10 GMT
Reason for closing:  Fixed
Additional comments about closing:  3.15
Comment by Janna Martl (jmartl109) - Wednesday, 28 May 2014, 04:49 GMT
I managed to get a stack trace:

May 28 00:21:46 hostname kernel: BUG: unable to handle kernel NULL pointer dereference at 0000000000000038
May 28 00:21:46 hostname kernel: IP: [<ffffffffa09a39c8>] reg_todo+0xd8/0x4e0 [cfg80211]
May 28 00:21:46 hostname kernel: PGD a6d54067 PUD 37c15067 PMD 0
May 28 00:21:46 hostname kernel: Oops: 0000 [#1] PREEMPT SMP
May 28 00:21:46 hostname kernel: Modules linked in: b43 ssb arc4 bcma mac80211 mmc_core pcmcia pcmcia_core nouveau mxm_wmi wmi ttm drm_kms_helper drm i2c_algo_bit cfg80211 msr nls_cp437 vfat fat snd_hda_codec_hdmi tg3 coretemp snd_hda_codec_cirrus snd_hda_codec_generic kvm_intel ptp kvm pps_core uvcvideo joydev libphy hid_generic mousedev applesmc videobuf2_vmalloc videobuf2_memops pcspkr videobuf2_core hid_apple hid_appleir input_polldev videodev evdev bcm5974 microcode btusb snd_hda_intel snd_hda_codec bluetooth media i2c_core shpchp snd_hwdep snd_pcm snd_timer snd soundcore 6lowpan_iphc usbhid rfkill hid video sbs sbshc ac button battery apple_bl acpi_cpufreq processor ext4 crc16 mbcache jbd2 usb_storage sd_mod crc_t10dif crct10dif_common sr_mod cdrom ata_generic pata_acpi ohci_pci ohci_hcd ehci_pci ehci_hcd firewire_ohci
May 28 00:21:46 hostname kernel: ahci libahci firewire_core crc_itu_t libata scsi_mod usbcore usb_common [last unloaded: ssb]
May 28 00:21:46 hostname kernel: CPU: 1 PID: 27 Comm: kworker/1:1 Not tainted 3.14.0-git-455c6fd-dirty #1
May 28 00:21:46 hostname kernel: Hardware name: Apple Inc. MacBookPro7,1/Mac-F222BEC8, BIOS MBP71.88Z.0039.B0B.1006012305 06/01/10
May 28 00:21:46 hostname kernel: Workqueue: events reg_todo [cfg80211]
May 28 00:21:46 hostname kernel: task: ffff880139ebe2c0 ti: ffff8801398ce000 task.ti: ffff8801398ce000
May 28 00:21:46 hostname kernel: RIP: 0010:[<ffffffffa09a39c8>] [<ffffffffa09a39c8>] reg_todo+0xd8/0x4e0 [cfg80211]
May 28 00:21:46 hostname kernel: RSP: 0018:ffff8801398cfdf0 EFLAGS: 00010297
May 28 00:21:46 hostname kernel: RAX: ffffffffa09f14c0 RBX: ffff880139bda5b0 RCX: 0000000000000003
May 28 00:21:46 hostname kernel: RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000002
May 28 00:21:46 hostname kernel: RBP: ffff8801398cfe28 R08: 0000000000000000 R09: 0000000000000001
May 28 00:21:46 hostname kernel: R10: 0000000000000000 R11: ffff8801399ba400 R12: ffff880139bda580
May 28 00:21:46 hostname kernel: R13: 0000000000000000 R14: ffff880139bda59c R15: 0ffff88013fd1830
May 28 00:21:46 hostname kernel: FS: 0000000000000000(0000) GS:ffff88013fd00000(0000) knlGS:0000000000000000
May 28 00:21:46 hostname kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
May 28 00:21:46 hostname kernel: CR2: 0000000000000038 CR3: 00000000aa797000 CR4: 00000000000407e0
May 28 00:21:46 hostname kernel: Stack:
May 28 00:21:46 hostname kernel: ffff8801398cfe28 ffffffffa09c5457 ffff880139fc9300 ffff88013fd14100
May 28 00:21:46 hostname kernel: ffffffffa09f1400 ffff88013fd18300 0ffff88013fd1830 ffff8801398cfe68
May 28 00:21:46 hostname kernel: ffffffff81082df8 00ff880100000000 ffff88013fd14100 ffff880139fc9330
May 28 00:21:46 hostname kernel: Call Trace:
May 28 00:21:46 hostname kernel: [<ffffffffa09c5457>] ? disconnect_work+0xc7/0xe0 [cfg80211]
May 28 00:21:46 hostname kernel: [<ffffffff81082df8>] process_one_work+0x168/0x450
May 28 00:21:46 hostname kernel: [<ffffffff81083822>] worker_thread+0x132/0x3e0
May 28 00:21:46 hostname kernel: [<ffffffff810836f0>] ? manage_workers.isra.23+0x2d0/0x2d0
May 28 00:21:46 hostname kernel: [<ffffffff81089cab>] kthread+0xdb/0x100
May 28 00:21:46 hostname kernel: [<ffffffff81089bd0>] ? kthread_create_on_node+0x180/0x180
May 28 00:21:46 hostname kernel: [<ffffffff8154583c>] ret_from_fork+0x7c/0xb0
May 28 00:21:46 hostname kernel: [<ffffffff81089bd0>] ? kthread_create_on_node+0x180/0x180
May 28 00:21:46 hostname kernel: Code: 97 02 00 00 72 53 83 f9 02 0f 84 e4 01 00 00 83 f9 03 0f 85 95 01 00 00 48 8b 05 d4 da 04 00 8b 50 14 83 fa 01 0f 84 b0 03 00 00 <41> f6 45 38 10 0f 85 a0 03 00 00 0f b6 4b ec f6 81 80 65 64 81
May 28 00:21:46 hostname kernel: RIP [<ffffffffa09a39c8>] reg_todo+0xd8/0x4e0 [cfg80211]
May 28 00:21:46 hostname kernel: RSP <ffff8801398cfdf0>
Comment by Janna Martl (jmartl109) - Wednesday, 28 May 2014, 13:21 GMT
This seems to be fixed in 3.15.

Loading...