BUG: weird behaviour after killing hostapd in latest CVS.

[Pavel Roskin]

On Wed, 6 Aug 2003, JuanJo Ciarlante wrote:

> On Mon, Aug 04, 2003 at 07:27:49PM -0700, Jouni Malinen wrote:
> > ...
> > Which kernel version are you using?
> > Which station firmware version are you using?
> > Did you have wlan0sta interface UP when killing hostapd? If yes, what
> > happens if you first set it down and only after that kill hostapd?
>
> Kernel 2.4.20, firmware 1.7.4 (flashed prism2.5 PCI)  forced promisc for
> hostapd+assoc_ap_addr (set_rid_word 64645 1) on a P166.

I could reproduce the panic on Linux 2.6.0-test2-bk5 with CVS HostAP.  The
sequence:

cardctl insert
hostapd hostapd.conf
ifconfig wlan0 up
killall hostapd

It's not needed to bring wlan0sta up.  wlan0ap was up already.

The panic has been captured on the serial console.  It's attached.  I'm
not sure if I'll be able to debug it soon.

It appears that the crash happens very early in prism2_rx_80211.

-- 
Regards,
Pavel Roskin
-------------- next part --------------
wlan0: enabling hostapd mode          
wlan0: Registered netdevice wlan0ap for AP management
wlan0: Registered netdevice wlan0sta for STA use     
wlan0: disabling hostapd mode                   
wlan0: Netdevice wlan0ap unregistered
wlan0: Netdevice wlan0sta unregistered
wlan0: enabling host<1>Unable to handle kernel NULL pointer dereference at virtual address
 00000060
 printing eip:
d0883772      
*pde = 00000000
Oops: 0000 [#1]
CPU:    0      
EIP:    0060:[<d0883772>]    Not tainted
EFLAGS: 00010282                        
EIP is at prism2_rx_80211+0x12/0x540 [hostap]
eax: 00000000   ebx: cf56bac4   ecx: cc5fdc20   edx: 00000000
esi: cf56bac4   edi: cf0910fc   ebp: cc5fdb08   esp: cc5fdac4
ds: 007b   es: 007b   ss: 0068                               
Process hostapd (pid: 1052, threadinfo=cc5fc000 task=ca308780)
Stack: c0289505 cfee8308 00000282 cf0b3cb0 cf0910fc cf0910fc cc5fdaf0 c0289505 
       cfee75c8 cf0b3cb0 00000000 cc5fdb08 c0289576 cf0b3cb0 cf56bac4 cf0910fc 
       cf0910fc cc5fdc00 d0884236 00000000 cf56bac4 cc5fdc20 00000001 cf56bac4 
Call Trace:                                                                    
 [<c0289505>] kfree_skbmem+0x25/0x30
 [<c0289505>] kfree_skbmem+0x25/0x30
 [<c0289576>] __kfree_skb+0x66/0xe0 
 [<d0884236>] hostap_80211_rx+0x1a6/0x1610 [hostap]
 [<c02c302a>] tcp_v4_do_rcv+0x12a/0x130            
 [<c014a944>] check_poison_obj+0x54/0x1d0
 [<c014cc3d>] __kmalloc+0x17d/0x1d0      
 [<c0289308>] alloc_skb+0x48/0xf0  
 [<d08976a9>] hostap_rx_skb+0x159/0x190 [hostap_cs]
 [<c012aeb6>] update_process_times+0x46/0x50       
 [<d08977d9>] hostap_rx_tasklet+0xf9/0x190 [hostap_cs]
 [<c0111c58>] timer_interrupt+0x88/0x220              
 [<c0126176>] tasklet_action+0x46/0x70  
 [<c0125f95>] do_softirq+0xb5/0xc0    
 [<c010c3dc>] do_IRQ+0x20c/0x350  
 [<c010a26c>] common_interrupt+0x18/0x20
 [<c023d7c9>] serial_in+0x29/0x70       
 [<c01e1814>] __delay+0x14/0x20