BUG() in lbs_host_to_card_done()

[Manuel Stahl]

I got a kernel oops after loading, unloading and reloading the libertas 
driver. It can be reproduced every time. It's worth to note that the 
firmware loaded successful the first time, but then there were command 
timeouts. The crash on the second load happened before loading the 
firmware. Here is the stack trace:

libertas_sdio: Libertas SDIO driver
libertas_sdio: Copyright Pierre Ossman
libertas_sdio mmc0:0001:1: firmware: requesting sd8686_helper.bin
Unable to handle kernel NULL pointer dereference at virtual address 00000ac8
pgd = c0004000
[00000ac8] *pgd=00000000
Internal error: Oops: 17 [#1]
last sysfs file: 
/sys/devices/platform/at91_mci/mmc_host/mmc0/mmc0:0001/mmc0:0001:1/firmware/mmc0:0001:1/loading
Modules linked in: libertas_sdio(+) libertas [last unloaded: libertas_sdio]
CPU: 0    Not tainted  (2.6.32.3 #104)
PC is at lbs_host_to_card_done+0x6c/0x118 [libertas]
LR is at if_sdio_interrupt+0x104/0x990 [libertas_sdio]
pc : [<bf00074c>]    lr : [<bf03a698>]    psr: 80000093
sp : c156bf34  ip : c156bf4c  fp : c156bf48
r10: c153ca00  r9 : 7fffffff  r8 : c153ca00
r7 : c15e0000  r6 : c153c600  r5 : 00000000  r4 : 80000013
r3 : 80000093  r2 : 00000001  r1 : c1623800  r0 : 00000000
Flags: Nzcv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: c000717f  Table: 21578000  DAC: 00000017
Process ksdioirqd/mmc0 (pid: 3341, stack limit = 0xc156a260)
Stack: (0xc156bf34 to 0xc156c000)
bf20:                                              00000003 00000001 
c156bf7c
bf40: c156bf4c bf03a698 bf0006f0 00000000 c156bef4 00000000 00000000 
00000001
bf60: c153c600 00000000 c153ca00 c153ca00 c156bfc4 c156bf80 c04287f8 
bf03a5a4
bf80: 00000000 c156bf9b c153c768 00000002 c156a000 00000001 0256a000 
c156bfcc
bfa0: c154fd80 c153c600 c04286e8 00000000 00000000 00000000 c156bff4 
c156bfc8
bfc0: c0337328 c04286f8 00000000 00000000 c156bfd0 c156bfd0 00000000 
00000000
bfe0: 00000000 00000000 00000000 c156bff8 c0326898 c03372b4 00000000 
00000000
Backtrace:
[<bf0006e0>] (lbs_host_to_card_done+0x0/0x118 [libertas]) from 
[<bf03a698>] (if_sdio_interrupt+0x104/0x990 [libertas_sdio])
  r5:00000001 r4:00000003
[<bf03a594>] (if_sdio_interrupt+0x0/0x990 [libertas_sdio]) from 
[<c04287f8>] (sdio_irq_thread+0x110/0x24c)
[<c04286e8>] (sdio_irq_thread+0x0/0x24c) from [<c0337328>] 
(kthread+0x84/0x8c)
[<c03372a4>] (kthread+0x0/0x8c) from [<c0326898>] (do_exit+0x0/0x590)
  r7:00000000 r6:00000000 r5:00000000 r4:00000000
Code: eb521dc6 e10f4000 e3843080 e121f003 (e5953ac8)
---[ end trace 1424f0fa36430ab1 ]---


-- 
Dipl.-Inf. Manuel Stahl
Fraunhofer-Institut für Integrierte Schaltungen IIS
- Leistungsoptimierte Systeme -
Nordostpark 93                Telefon  +49 (0)911/58061-6419
90411 Nürnberg                Fax      +49 (0)911/58061-6398
http://www.iis.fraunhofer.de  manuel.stahl at iis.fraunhofer.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: manuel_stahl.vcf
Type: text/x-vcard
Size: 169 bytes
Desc: not available
URL: <http://lists.infradead.org/pipermail/libertas-dev/attachments/20100310/40c09f4b/attachment.vcf>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6148 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.infradead.org/pipermail/libertas-dev/attachments/20100310/40c09f4b/attachment.p7s>