Workqueue locking...

[Arnd Bergmann]

On Tuesday 22 May 2007, David Woodhouse wrote:
> libertas: libertas_remove_mesh():1042 enter
> libertas: libertas_remove_mesh():1059 leave
> libertas: libertas_remove_card():985 enter

here we stop the queues

> libertas: wake_pending_cmdnodes():968 enter
> libertas: libertas_prepare_and_send_command():1423 leave, ret 0

here we unregister the netdev

> libertas: wlan_associate():135 leave, ret 0                                      

now, wlan_remove_card blocks until the assoc_work finishes running,
and the timer is removed

> libertas: assoc_helper_essid():120 leave, ret 0                                 
> libertas: ASSOC: assoication attempt unsuccessful, not connected.               
> libertas: ASSOC: reconfiguration attempt unsuccessful: -1                       
> libertas: libertas_association_worker():643 leave                               
> libertas: libertas_association_worker():473 enter                               
> libertas: #### Association Request: libertas_association_worker                 
>        flags:      0x00000012                                                   
>        SSID:       'media lab 802.11'                                           
>        channel:    11                                                           
>        band:       0                                                            
>        mode:       2                                                            
>        BSSID:      00:00:00:00:00:00                                            
>        Encryption:                                                              
>        auth:       1                                                            
> libertas: assoc_helper_mode():193 enter                                         
> libertas: assoc_helper_mode():212 leave, ret 0                                  
> libertas: assoc_helper_essid():72 enter                                         
> libertas: New SSID requested: media lab 802.11                                  
> libertas: libertas_send_specific_SSID_scan():1446 enter                         
> libertas: wlan_scan_networks():796 enter                                        
> libertas: Scan: Creating full region channel list                               
> Unable to handle kernel paging request for data at address 0x0000002c           
> Faulting instruction address: 0xc952dba0                                        
> Oops: Kernel access of bad area, sig: 11 [#1]                                   
>                                                                                 
> Modules linked in: usb8xxx(U) libertas(U) autofs4(U) hidp(U) rfcomm(U) l2cap(U))
> NIP: C952DBA0 LR: C952DB90 CTR: C0254700                                        
> REGS: c11dbc60 TRAP: 0300   Not tainted  (2.6.21-1.3167.fc7)                    
> MSR: 00009032 <EE,ME,IR,DR>  CR: 42002022  XER: 00000000                        
> DAR: 0000002C, DSISR: 20000000                                                  
> TASK = c113c6d0[1787] 'libertas_assoc' THREAD: c11da000                         
> GPR00: 0000002C C11DBD10 C113C6D0 00000000 C1105E69 00000001 00000000 00000017  
> GPR08: C0579800 00000001 00000017 C0254700 2E2B8A40 7FEFFFFF 00000001 0000000E  
> GPR16: 00000001 C1859600 C1105000 00000000 00000002 00000000 C3F7A740 00000000  
> GPR24: 0000000B C3F7A760 C11A7400 00000000 C11DBD9C 00000000 C1105D4C C185964E  
> NIP [C952DBA0] wlan_scan_networks+0x684/0xbc8 [libertas]                        
> LR [C952DB90] wlan_scan_networks+0x674/0xbc8 [libertas]                         
> Call Trace:                                                                     
> [C11DBD10] [C952DB88] wlan_scan_networks+0x66c/0xbc8 [libertas] (unreliable)    

And here, the workqueue accesses the netdev that was already removed.

I'd say the solution is to move the cancel_delayed_work() to the top of
wlan_remove_card.

	Arnd <><