[OpenWrt-Tickets] [OpenWrt] #3401: ar2313 segfaults on init

[OpenWrt]

#3401: ar2313 segfaults on init
--------------------+-------------------------------------------------------
 Reporter:  matteo  |       Owner:  kaloz                
     Type:  defect  |      Status:  new                  
 Priority:  normal  |   Milestone:                       
Component:  kernel  |    Keywords:  atheros ar2315 ar2313
--------------------+-------------------------------------------------------
 ar2313, the atheros ethernet driver, does a kernel panic when loading:
 {{{
 Unhandled kernel unaligned access[#1]:
 Cpu 0
 $ 0   : 00000000 10008400 ffffffff 00000660
 $ 4   : 00000600 00000020 80191f38 801a5bf4
 $ 8   : 00000010 80161f80 00000000 8031e000
 $12   : 00000000 00000000 0098963a e5effe80
 $16   : 8029ac60 ffffffff 10008401 00000020
 $20   : 80191f38 00000000 80331800 010006b0
 $24   : 00000002 802a6c38
 $28   : 8030c000 8030dd40 80260000 800c66e0
 Hi    : fffffff5
 Lo    : 0413a000
 epc   : 800c6728 __kmalloc_track_caller+0x7c/0x1b4     Tainted: G    B
 ra    : 800c66e0 __kmalloc_track_caller+0x34/0x1b4
 Status: 10008402    KERNEL EXL
 Cause : 30801010
 BadVA : ffffffff
 PrId  : 00019064 (MIPS 4KEc)
 Modules linked in:
 Process swapper (pid: 1, threadinfo=8030c000, task=8030a000)
 Stack : ffffffff 8005f0f0 00000000 00000001 8030de0b 80331b60 8030e780
 80191f38
         00000740 802f5500 00000020 801a5c18 8024119c 801608a0 8030dd80
 8030ddf0
         00000001 80331b60 00000004 80331b60 00000001 1fffffff 80191f38
 80331b60
         80331800 8030de08 b0500000 802b7140 80260000 802b0000 80331ba8
 80331b60
         80331800 1fffffff b0500000 802b7140 80260000 802b0000 802a6e8c
 802a6e30
         ...
 Call Trace:
 [<800c6728>] __kmalloc_track_caller+0x7c/0x1b4
 [<801a5c18>] __alloc_skb+0x70/0x144
 [<XXXXXXXX>] ar2313_load_rx_ring:867 // hint
 [<80191f38>] ar2313_init+0xcc/0x448
 [<802a6e8c>] ar2313_probe+0x254/0x598
 [<80188930>] driver_probe_device+0xec/0x300
 [<8018902c>] __driver_attach+0x2c4/0x30c
 [<80187590>] bus_for_each_dev+0x58/0xc4
 [<8018849c>] bus_add_driver+0x1e0/0x304
 [<80189680>] driver_register+0x50/0x128
 [<8029b6e4>] kernel_init+0xc8/0x33c
 [<800450d4>] kernel_thread_helper+0x10/0x18


 Code: 8e020080  00021080  00511021 <8c430000> ae030074  40016000  32520001
 3421001f  3821001f
 Kernel panic - not syncing: Attempted to kill init!
 }}}
 I've compiled the kernel with debug info and I found where the error lies:
 {{{
 $ gdb -q build_dir/linux-atheros/linux-2.6.25.1/vmlinux
 (gdb) l *0x80191f38
 0x80191f38 is in ar2313_init (drivers/net/ar2313/ar2313.c:867).
 862
 863                     /* initialize dma descriptor */
 864                     rd->devcs = ((AR2313_BUFSIZE <<
 DMA_RX1_BSIZE_SHIFT) |
 865                                              DMA_RX1_CHAINED);
 866                     rd->addr = virt_to_phys(skb->data);
 867                     rd->descr =
 868                             virt_to_phys(&sp->
 869                                                      rx_ring[(idx + 1)
 & (AR2313_DESCR_ENTRIES - 1)]);
 870                     rd->status = DMA_RX_OWN;
 871
 (gdb)
 }}}

 This happens only when the SLUB allocator is used, but I doubt that it's a
 SLUB bug,[[BR]]
 I think that the but is triggered when using SLUB and hidden when using
 SLAB, as I had a similar case: https://dev.openwrt.org/ticket/2140

-- 
Ticket URL: <https://dev.openwrt.org/ticket/3401>
OpenWrt <http://openwrt.org>
Opensource Wireless Router Technology