BCM5354 (Asus WL500GPv2) DMA RX buffer too small and skb_over_panic

Sun May 29 10:39:11 EDT 2011

On 05/29/2011 06:35 AM, Rafał Miłecki wrote:
> Hey,
>
> W dniu 29 maja 2011 13:20 użytkownik Hauke Mehrtens<hauke at hauke-m.de>  napisał:
>> Hi Rafał,
>>
>> I got some bug reports [0] in OpenWrt regarding a kernel panic because
>> of b43. It occurs on BCM5354 devices, when they are in AP mode.
>>
>> There was also a discussion about this on this mailing list some years
>> ago. [1]
>>
>> It happens after some time ( 3h to 2d ) without any load or anything not
>> normal, in station mode this panic does not occur.
>> After the error occurred the CPU usage increases to 3.0 - 5.0
>> Sometimes "b43-phy0 ERROR: MAC suspend failed" is shown in the log
>> before this panic.
>>
>> Rafał could you please have a look at the issue?
>>
>> ------
>> Hauke
>>
>> [0]: https://dev.openwrt.org/ticket/9459
>> [1]: http://permalink.gmane.org/gmane.linux.drivers.bcm54xx.devel/10682
>>
>>
>>
>> Kernel panic:
>>
>> b43-phy0: Loading firmware version 410.2160 (2007-05-26 15:32:10)
>> b43-phy0: Loading firmware version 410.2160 (2007-05-26 15:32:10)
>> ......
>> b43-phy0 ERROR: DMA RX buffer too small (len: 42390, buffer: 2352,
>> nr-dropped: 19)
>> b43-phy0 ERROR: DMA RX buffer too small (len: 25505, buffer: 2352,
>> nr-dropped: 11)
>> b43-phy0 ERROR: DMA RX buffer too small (len: 19022, buffer: 2352,
>> nr-dropped: 9)
>> b43-phy0 ERROR: DMA RX buffer too small (len: 4189, buffer: 2352,
>> nr-dropped: 2)
>> b43-phy0 ERROR: DMA RX buffer too small (len: 37381, buffer: 2352,
>> nr-dropped: 16)
>> skb_over_panic: text:80c9a408 len:2378 put:2378 head:80eef000
>> data:80eef040 tail:0x80eef98a end:0x80eef980 dev:<NULL>
>> Kernel bug detected[#1]:
>> Cpu 0
>> $ 0   : 00000000 1000b800 0000007c 00000001
>> $ 4   : 80293498 000020ed ffffffff 000020ed
>> $ 8   : 00004000 00000000 00000001 ffffffff
>> $12   : 0000000f 80253c78 ffffffff 00000000
>> $16   : 00eef040 0000092c 80eef040 819e0740
>> $20   : 81b3cb00 0000001e a1b4a1e0 80c9f978
>> $24   : 00000002 80166250
>> $28   : 81a46000 81a47db0 00000020 801a3d24
>> Hi    : 00000000
>> Lo    : 00000077
>> epc   : 801a3d24 0x801a3d24
>>     Not tainted
>> ra    : 801a3d24 0x801a3d24
>> Status: 1000b803    KERNEL EXL IE
>> Cause : 00800024
>> PrId  : 00029029 (Broadcom BCM3302)
>> Modules linked in: xt_IMQ nf_nat_tftp nf_conntrack_tftp nf_nat_irc
>> nf_conntrack_irc nf_nat_ftp nf_conntrack_ftp xt_HL xt_hl xt_MARK ipt_ECN
>> xt_CLASSIFY xt_time xt_tcpmss xt_statistic xt_mark xt_length ipt_ecn
>> xt_DSCP xt_dscp xt_string xt_layer7 ipt_MASQUERADE iptable_nat nf_nat
>> xt_CONNMARK xt_recent xt_helper xt_conntrack xt_connmark xt_connbytes
>> xt_NOTRACK iptable_raw xt_state nf_conntrack_ipv4 nf_defrag_ipv4
>> nf_conntrack pppoe pppox ipt_REJECT xt_TCPMSS ipt_LOG xt_comment
>> xt_multiport xt_mac xt_limit iptable_mangle iptable_filter ip_tables
>> xt_tcpudp x_tables ppp_async ppp_generic slhc b43legacy sch_red b43
>> sch_sfq sch_hfsc cls_fw imq mac80211 ts_fsm ts_bm ts_kmp crc_ccitt
>> cfg80211 compat_firmware_class compat arc4 aes_generic deflate ecb cbc
>> switch_robo switch_core diag
>> Process irq/5-b43 (pid: 895, threadinfo=81a46000, task=81ab45d0,
>> tls=00000000)
>> Stack : 00000000 80c9a408 0000094a 0000094a 80eef000 80eef040 80eef98a
>> 80eef980
>>         8026e09c 0000001e a1b4a1e0 80c9a408 80c17ad4 00ff0000 000000e6
>> 00010000
>>         819e2400 819e2400 80d31568 00ff0000 80c9f978 00010000 00010000
>> 819e2400
>>         00008000 00010000 81b3ca24 00010000 802ce8c0 00000000 802953b4
>> 80c872cc
>>         00010000 802ce8c0 80292f28 8001ce0c 819ea138 819ea138 80292f28
>> 8001eba0
>>         ...
>> Call Trace:[<80c9a408>] 0x80c9a408
>> [<80c9a408>] 0x80c9a408
>> [<80c872cc>] 0x80c872cc
>> [<8001ce0c>] 0x8001ce0c
>> [<8001eba0>] 0x8001eba0
>> [<8001cef8>] 0x8001cef8
>> [<80190bf4>] 0x80190bf4
>> [<80c87424>] 0x80c87424
>> [<80057480>] 0x80057480
>> [<8000af98>] 0x8000af98
>> [<80057304>] 0x80057304
>> [<80057304>] 0x80057304
>> [<8003db30>] 0x8003db30
>> [<8000f86c>] 0x8000f86c
>> [<8003dab4>] 0x8003dab4
>> [<8000f85c>] 0x8000f85c
>>
>>
>> Code: afab001c  0c0028ff  afa20020<0200000d>  08068f4a  00000000
>> 8fbf002c  01201021  03e00008
>> Disabling lock debugging due to kernel taint
>> exiting task "irq/5-b43" (895) is an active IRQ thread (irq 5)
>>
>>
>> Call Trace from an other report:
>>
>> Jan  1 04:03:40 OpenWrt user.warn kernel: Call Trace:
>> Jan  1 04:03:40 OpenWrt user.warn kernel: [<8019bc10>] skb_put+0x74/0x90
>> Jan  1 04:03:40 OpenWrt user.warn kernel: [<8051a3e8>]
>> b43_dma_rx+0x294/0x378 [b43]
>> Jan  1 04:03:40 OpenWrt user.warn kernel: [<805072b8>]
>> b43_controller_restart+0x7a8/0x97c [b43]
>> Jan  1 04:03:40 OpenWrt user.warn kernel: Code: afab001c  0c0028c2
>> afa20020<0200000d>  08066f05  00000000  8fbf002c  01201021  03e00008
>> Jan  1 04:03:40 OpenWrt user.warn kernel: Disabling lock debugging due
>> to kernel taint
>> Jan  1 04:03:40 OpenWrt user.err kernel: exiting task "irq/5-b43" (763)
>> is an active IRQ thread (irq 5)
>
> This sounds like duplicate of:
> https://bugzilla.kernel.org/show_bug.cgi?id=32042
>
> Larry fixed this issue, also CC-ing stable at kernel. I believe updating
> kernel or applying c85ce65ecac078ab1a1835c87c4a6319cf74660a manually
> will help :)

This may not be the same issue as the buffer lengths in the panic message are 
very large.

For the record, John Linville fixed that issue.

Larry