kernel BUG at drivers/net/wireless/libertas/if_sdio.c:229

[Dan Williams]

On Tue, 2010-10-05 at 13:54 +0200, Sven Neumann wrote:
> Hi,
> 
> we are running an embedded system here based on the PXA300 platform
> using a Marvell WLAN adapter accessed via SDIO. We are using Linux
> 2.6.34.7 for a while now and things have worked smoothly. Now I've tried
> changed the kernel configuration from CONFIG_PREEMPT_NONE to
> CONFIG_PREEMPT and since this change we are hitting this bug quite
> frequently:
> 
> [  209.294552] kernel BUG at drivers/net/wireless/libertas/if_sdio.c:229!
> [  209.301073] Unable to handle kernel NULL pointer dereference at virtual address 00000000
> [  209.309111] pgd = c0004000
> [  209.311793] [00000000] *pgd=00000000
> [  209.315339] Internal error: Oops: 817 [#1] PREEMPT
> [  209.320091] last sysfs file: /sys/devices/platform/spi_gpio.0/spi0.2/value
> [  209.326914] Modules linked in: eeti_ts libertas_sdio libertas pxamci ds2760_battery w1_ds2760 wire
> [  209.335820] CPU: 0    Not tainted  (2.6.34.7 #1)
> [  209.340410] PC is at __bug+0x1c/0x28
> [  209.343956] LR is at __bug+0x18/0x28
> [  209.347510] pc : [<c0048f6c>]    lr : [<c0048f68>]    psr: 60000093
> [  209.347520] sp : c77fdf60  ip : 00004759  fp : c77fc000
> [  209.358912] r10: c7ff6800  r9 : 7fffffff  r8 : c77fdf70
> [  209.364100] r7 : 80000013  r6 : c76a4200  r5 : c7720000  r4 : 00000001
> [  209.370577] r3 : 00000000  r2 : 00000001  r1 : 60000093  r0 : 00000050
> [  209.377059] Flags: nZCv  IRQs off  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
> [  209.384407] Control: 0000397f  Table: a6810018  DAC: 00000035
> [  209.390109] Process ksdioirqd/mmc0 (pid: 1084, stack limit = 0xc77fc278)
> [  209.396761] Stack: (0xc77fdf60 to 0xc77fe000)
> [  209.401095] df60: c77fdf70 bf041104 00100100 00000000 00000000 00000000 00000000 00000001
> [  209.409227] df80: c7ff6600 00000000 c7ff6800 c0275828 00000000 c77fdfa7 c7ff6784 00000001
> [  209.417360] dfa0: 00000001 027fdfd4 c741ddfc c77fdfd4 c741ddfc c7ff6600 c0275734 00000000
> [  209.425492] dfc0: 00000000 00000000 00000000 c006ff08 00000000 00000000 c77fdfd8 c77fdfd8
> [  209.433615] dfe0: 00000000 00000000 00000000 00000000 00000000 c0046a08 00000000 00000000
> [  209.441772] [<c0048f6c>] (__bug+0x1c/0x28) from [<bf041104>] (if_sdio_interrupt+0x224/0x3b8 [libertas_sdio])
> [  209.451575] [<bf041104>] (if_sdio_interrupt+0x224/0x3b8 [libertas_sdio]) from [<c0275828>] (sdio_irq_thread+0xf4/0x218)
> [  209.462312] [<c0275828>] (sdio_irq_thread+0xf4/0x218) from [<c006ff08>] (kthread+0x78/0x80)
> [  209.470640] [<c006ff08>] (kthread+0x78/0x80) from [<c0046a08>] (kernel_thread_exit+0x0/0x8)
> [  209.478943] Code: e1a01000 e59f000c eb0d38b5 e3a03000 (e5833000) 
> [  209.485163] ---[ end trace 7a8a5d2e4fa6d6fa ]---
> [  209.489765] note: ksdioirqd/mmc0[1084] exited with preempt_count 1
> 
> 
> Is this a known problem? Has anyone else tried using libertas-sdio with
> a preemptible kernel?

Not that I know of.  Can you put some printks into the driver in
if_sdio.c around the memcpy() here?

	priv->resp_len[i] = size;
+       printk(KERN_INFO "%s: priv %p, buffer %p\n", __func__, priv, buffer);
	memcpy(priv->resp_buf[i], buffer, size);

just to see which part of that is NULL.

Dan