ath9k doesn't clean up virtual wifis on rmmod, and crashes.

DISCUSSION Ben Greear 3 participants 9 messages Jul 3, 2010 – Jul 6, 2010 Qualcomm Atheros ATH9K wireless driver

Share & tools

Ben Greear

author

2010-07-03 06:26 UTC #0 lore raw

It seems to me that in 2.6.34, there is no code to clean up virtual wiphys in ath9k on rmmod. Also, ath9k mailing list is returning error about mis-configured DNS server.

This is with un-modified ath9k driver and is repeatable every time on my system (crash is often different, but it always crashes very quickly).

[root@atom ~]# echo add=5 > /debug/ath9k/phy1/wiphy -bash: /debug/ath9k/phy1/wiphy: No such file or directory [root@atom ~]# echo add=5 > /debug/ath9k/phy0/wiphy

Jul  2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# Jul  2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
rmmod ath9k
Jul  2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
Jul  2 23:22:24 atom kernel: ath9k: Driver unloaded
[root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
 lock: f8a476c0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
Pid: 2877, comm: iw Not tainted 2.6.34 #7
Call Trace:
 [<c0730e34>] ? printk+0xf/0x13
 [<c05710d6>] spin_bug+0x7b/0x86
 [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
 [<c0571171>] do_raw_spin_lock+0x1e/0x125
 [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
 [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
 [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
 [<c0440b59>] __queue_work+0x12/0x2f
 [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
 [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30

I'm new to hacking on this driver..but would love to test patches, and if someone wants to suggest a good point in the code to remove the virtual phys, I'll make the attempt.

Thanks,
Ben

Signature · 2 lines

Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com

Vasanthakumar Thiagarajan

2010-07-03 07:03 UTC #1 lore raw

Quoted 31 lines · Ben Greear

It seems to me that in 2.6.34, there is no code to clean up virtual wiphys in ath9k on rmmod. Also, ath9k mailing list is returning error about mis-configured DNS server.
This is with un-modified ath9k driver and is repeatable every time on my system (crash is often different, but it always crashes very quickly).
[root@atom ~]# echo add=5 > /debug/ath9k/phy1/wiphy -bash: /debug/ath9k/phy1/wiphy: No such file or directory [root@atom ~]# echo add=5 > /debug/ath9k/phy0/wiphy
Jul  2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# Jul  2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
rmmod ath9k
Jul  2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
Jul  2 23:22:24 atom kernel: ath9k: Driver unloaded
[root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
  lock: f8a476c0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0
Pid: 2877, comm: iw Not tainted 2.6.34 #7
Call Trace:
  [<c0730e34>] ? printk+0xf/0x13
  [<c05710d6>] spin_bug+0x7b/0x86
  [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
  [<c0571171>] do_raw_spin_lock+0x1e/0x125
  [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
  [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
  [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
  [<c0440b59>] __queue_work+0x12/0x2f
  [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
  [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30

Quoted 3 lines

I'm new to hacking on this driver..but would love to test patches, and if someone wants to suggest a good point in the code to remove the virtual phys, I'll make the attempt.

Can you please try this patch?

drivers/net/wireless/ath/ath9k/ath9k.h +1 -0

index 3a14630..6218890 100644
@@ -516,6 +516,7 @@ void ath_deinit_leds(struct ath_softc *sc);
 #define SC_OP_TSF_RESET              BIT(11)
 #define SC_OP_BT_PRIORITY_DETECTED   BIT(12)
 #define SC_OP_BT_SCAN		     BIT(13)
+#define SC_OP_ANI_RUN		     BIT(14)
 
 /* Powersave flags */
 #define PS_WAIT_FOR_BEACON        BIT(0)

drivers/net/wireless/ath/ath9k/main.c +10 -1

index 5af2596..41a317d 100644
@@ -451,6 +451,10 @@ static void ath_start_ani(struct ath_common *common)
 {
 	struct ath_hw *ah = common->ah;
 	unsigned long timestamp = jiffies_to_msecs(jiffies);
+	struct ath_softc *sc = (struct ath_softc *) common->priv;
+
+	if (!(sc->sc_flags & SC_OP_ANI_RUN))
+		return;
 
 	common->ani.longcal_timer = timestamp;
 	common->ani.shortcal_timer = timestamp;

@@ -766,11 +770,13 @@ static void ath9k_bss_assoc_info(struct ath_softc *sc,
 		/* Reset rssi stats */
 		sc->sc_ah->stats.avgbrssi = ATH_RSSI_DUMMY_MARKER;
 
+		sc->sc_flags |= SC_OP_ANI_RUN;
 		ath_start_ani(common);
 	} else {
 		ath_print(common, ATH_DBG_CONFIG, "Bss Info DISASSOC\n");
 		common->curaid = 0;
 		/* Stop ANI */
+		sc->sc_flags &= ~SC_OP_ANI_RUN;
 		del_timer_sync(&common->ani.timer);
 	}
 }

@@ -1376,8 +1382,10 @@ static int ath9k_add_interface(struct ieee80211_hw *hw,
 
 	if (vif->type == NL80211_IFTYPE_AP    ||
 	    vif->type == NL80211_IFTYPE_ADHOC ||
-	    vif->type == NL80211_IFTYPE_MONITOR)
+	    vif->type == NL80211_IFTYPE_MONITOR) {
+		sc->sc_flags |= SC_OP_ANI_RUN;
 		ath_start_ani(common);
+	}
 
 out:
 	mutex_unlock(&sc->mutex);

@@ -1398,6 +1406,7 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
 	mutex_lock(&sc->mutex);
 
 	/* Stop ANI */
+	sc->sc_flags &= ~SC_OP_ANI_RUN;
 	del_timer_sync(&common->ani.timer);
 
 	/* Reclaim beacon resources */

Signature · 1 line

Vasanth

Ben Greear

author

2010-07-03 16:34 UTC #2 lore raw

Quoted 32 lines · Vasanthakumar Thiagarajan

Quoted 31 lines · Ben Greear
It seems to me that in 2.6.34, there is no code to clean up virtual wiphys in ath9k on rmmod. Also, ath9k mailing list is returning error about mis-configured DNS server.
This is with un-modified ath9k driver and is repeatable every time on my system (crash is often different, but it always crashes very quickly).
[root@atom ~]# echo add=5> /debug/ath9k/phy1/wiphy -bash: /debug/ath9k/phy1/wiphy: No such file or directory [root@atom ~]# echo add=5> /debug/ath9k/phy0/wiphy
Jul  2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# Jul  2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
rmmod ath9k
Jul  2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
Jul  2 23:22:24 atom kernel: ath9k: Driver unloaded
[root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
   lock: f8a476c0, .magic: 00000000, .owner:<none>/-1, .owner_cpu: 0
Pid: 2877, comm: iw Not tainted 2.6.34 #7
Call Trace:
   [<c0730e34>] ? printk+0xf/0x13
   [<c05710d6>] spin_bug+0x7b/0x86
   [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
   [<c0571171>] do_raw_spin_lock+0x1e/0x125
   [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
   [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
   [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
   [<c0440b59>] __queue_work+0x12/0x2f
   [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
   [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30

Quoted 5 lines

Quoted 3 lines
I'm new to hacking on this driver..but would love to test patches, and if someone wants to suggest a good point in the code to remove the virtual phys, I'll make the attempt.
Can you please try this patch?

It still crashes for me, and backtraces look similar.

Were you able to reproduce the crash?

Thanks,
Ben

Signature · 2 lines

Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com

Ben Greear

author

2010-07-03 17:57 UTC #3 lore raw

Just for reference, same problem on un-modified 2.6.35-rc3+ (pulled last night)

The crash below is from reproducing it with your patch included.

[root@atom ~]# ls

anaconda-ks.cfg  Documents  Music     Public     Videos
Desktop          Downloads  Pictures  Templates
[root@atom ~]# echo add > /debug/ath9k/phy0/wiphy
Jul  3 10:55:24 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'

[root@atom ~]# Jul 3 10:55:25 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready

[root@atom ~]# rmmod ath9k

BUG: unable to handle kernel NULL pointer dereference at 000000a4
IP: [<f8d65fd1>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:03.0/class
Modules linked in:

(It reboots before printing anything else to console).

Thanks,
Ben

Signature · 2 lines

Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com

Vasanthakumar Thiagarajan

2010-07-04 09:35 UTC #4 lore raw

In reply to Ben Greear

Quoted 37 lines · Ben Greear

Quoted 36 lines · Vasanthakumar Thiagarajan
Quoted 34 lines · Ben Greear
It seems to me that in 2.6.34, there is no code to clean up virtual wiphys in ath9k on rmmod. Also, ath9k mailing list is returning error about mis-configured DNS server.
This is with un-modified ath9k driver and is repeatable every time on my system (crash is often different, but it always crashes very quickly).
[root@atom ~]# echo add=5> /debug/ath9k/phy1/wiphy -bash: /debug/ath9k/phy1/wiphy: No such file or directory [root@atom ~]# echo add=5> /debug/ath9k/phy0/wiphy
Jul  2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# Jul  2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
rmmod ath9k
Jul  2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
Jul  2 23:22:24 atom kernel: ath9k: Driver unloaded
[root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
   lock: f8a476c0, .magic: 00000000, .owner:<none>/-1, .owner_cpu: 0
Pid: 2877, comm: iw Not tainted 2.6.34 #7
Call Trace:
   [<c0730e34>] ? printk+0xf/0x13
   [<c05710d6>] spin_bug+0x7b/0x86
   [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
   [<c0571171>] do_raw_spin_lock+0x1e/0x125
   [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
   [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
   [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
   [<c0440b59>] __queue_work+0x12/0x2f
   [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
   [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30
I'm new to hacking on this driver..but would love to test patches, and if someone wants to suggest a good point in the code to remove the virtual phys, I'll make the attempt.

Quoted 5 lines

Quoted 1 line
Can you please try this patch?
It still crashes for me, and backtraces look similar.
Were you able to reproduce the crash?

with my patch, no. Can you please give the steps to trigger this crash?

Vasanth

Ben Greear

author

2010-07-04 15:59 UTC #5 lore raw

Quoted 38 lines · Vasanthakumar Thiagarajan

Quoted 37 lines · Ben Greear
Quoted 36 lines · Vasanthakumar Thiagarajan
Quoted 34 lines · Ben Greear
It seems to me that in 2.6.34, there is no code to clean up virtual wiphys in ath9k on rmmod. Also, ath9k mailing list is returning error about mis-configured DNS server.
This is with un-modified ath9k driver and is repeatable every time on my system (crash is often different, but it always crashes very quickly).
[root@atom ~]# echo add=5> /debug/ath9k/phy1/wiphy
-bash: /debug/ath9k/phy1/wiphy: No such file or directory
[root@atom ~]# echo add=5> /debug/ath9k/phy0/wiphy
Jul  2 23:22:19 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# Jul  2 23:22:19 atom kernel: ADDRCONF(NETDEV_UP): wlan1: link is not ready
rmmod ath9k
Jul  2 23:22:24 atom kernel: ath9k 0000:05:00.0: PCI INT A disabled
Jul  2 23:22:24 atom kernel: ath9k: Driver unloaded
[root@atom ~]# BUG: spinlock bad magic on CPU#1, iw/2877
    lock: f8a476c0, .magic: 00000000, .owner:<none>/-1, .owner_cpu: 0
Pid: 2877, comm: iw Not tainted 2.6.34 #7
Call Trace:
    [<c0730e34>] ? printk+0xf/0x13
    [<c05710d6>] spin_bug+0x7b/0x86
    [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
    [<c0571171>] do_raw_spin_lock+0x1e/0x125
    [<c042f91e>] ? scheduler_tick+0xd6/0x1c9
    [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
    [<c0732a6d>] _raw_spin_lock_irqsave+0x1b/0x20
    [<c0440b59>] __queue_work+0x12/0x2f
    [<c0440b76>] ? delayed_work_timer_fn+0x0/0x30
    [<c0440ba4>] delayed_work_timer_fn+0x2e/0x30
I'm new to hacking on this driver..but would love to test patches, and if someone wants to suggest a good point in the code to remove the virtual phys, I'll make the attempt.

Quoted 8 lines

Quoted 5 lines
Quoted 1 line
Can you please try this patch?
It still crashes for me, and backtraces look similar.
Were you able to reproduce the crash?
with my patch, no. Can you please give the steps to trigger this crash?

It happens every time if I:

echo add > /debug/ath9k/phy0/wiphy
rmmod ath9k

I notice the patch applied with offsets. What kernel/driver version are you testing? I tried .34 kernel as well as the top-of-tree 2.6.35-rcX.

Thanks,
Ben

Signature · 2 lines

Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com

Ben Greear

author

2010-07-05 18:57 UTC #6 lore raw

I ran the same test on wireless-testing, and it still crashes.

It appears that the patch you sent is already in wireless-testing, so I did not apply it.

[root@atom ~]# uname -a
Linux atom 2.6.35-rc3-wl+ #1 SMP Mon Jul 5 11:36:08 PDT 2010 i686 i686 i386 GNU/Linux [root@atom ~]# echo add > /debug/ath9k/phy0/wiphy

Jul  5 11:54:59 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# rmmod ath9k
BUG: unable to handle kernel NULL pointer dereference at 000000a4
IP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:00.0/net/wlan1/flags
Modules linked in: xt_CT iptable_raw ipt_addrtype xt_DSCP xt_dscp xt_string xt_owner xt_NFQUEUE xt_mul]

Pid: 5817, comm: rmmod Not tainted 2.6.35-rc3-wl+ #1 To be filled by O.E.M./To Be Filled By O.E.M.
EIP: 0060:[<f8d455d6>] EFLAGS: 00010046 CPU: 0
EIP is at ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
EAX: 00000000 EBX: 00000000 ECX: c08de3bc EDX: f705ec78
ESI: f705ec78 EDI: 00000010 EBP: f4563e70 ESP: f4563e6c
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process rmmod (pid: 5817, ti=f4562000 task=f4504550 task.ti=f4562000)

Stack:
 00000000 f4563e88 f8de3cb4 00000010 f6aab6c0 00000282 00000010 f4563ea8
<0> c046d228 f705ec78 00000282 c08de3bc 00000010 c08de380 f705ec78 f4563ebc
<0> c046d28f f705ec78 f7113000 f8f00000 f4563ed0 f8dea27f f7113000 f8def9a8
Call Trace:
 [<f8de3cb4>] ? ath_isr+0x25/0x189 [ath9k]
 [<c046d228>] ? __free_irq+0x11e/0x15e
 [<c046d28f>] ? free_irq+0x27/0x3a
 [<f8dea27f>] ? ath_pci_remove+0x2f/0x54 [ath9k]
 [<c05816da>] ? pci_device_remove+0x19/0x39
 [<c06036d6>] ? __device_release_driver+0x59/0x9d
 [<c0603781>] ? driver_detach+0x67/0x85
 [<c0602c9d>] ? bus_remove_driver+0x69/0x85
 [<c0603b92>] ? driver_unregister+0x4b/0x52
 [<c05818a9>] ? pci_unregister_driver+0x2d/0x6e
 [<f8dea171>] ? ath_pci_exit+0xd/0xf [ath9k]
 [<f8dec664>] ? ath9k_exit+0x8/0x2f [ath9k]
 [<c0455232>] ? sys_delete_module+0x16f/0x1c0
 [<c07458dc>] ? do_page_fault+0x26a/0x2c5
 [<c074590a>] ? do_page_fault+0x298/0x2c5
 [<c0402fdc>] ? sysenter_do_call+0x12/0x28
Code: 80 4b 06 10 31 c9 83 c4 68 89 c8 5b 5e 5f 5d c3 55 b9 0c 00 00 00 89 e5 53 8b 98 94 00 00 00 ff
EIP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw] SS:ESP 0068:f4563e6c
CR2: 00000000000000a4
---[ end trace 43bc6f57caff1689 ]---

Killed
Jul 5 1

Signature · 2 lines

Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com

Rajkumar Manoharan

2010-07-06 08:36 UTC #7 lore raw

Quoted 49 lines · Ben Greear

I ran the same test on wireless-testing, and it still crashes.
It appears that the patch you sent is already in wireless-testing, so I did not apply it.
[root@atom ~]# uname -a
Linux atom 2.6.35-rc3-wl+ #1 SMP Mon Jul 5 11:36:08 PDT 2010 i686 i686 i386 GNU/Linux [root@atom ~]# echo add > /debug/ath9k/phy0/wiphy
Jul  5 11:54:59 atom kernel: phy1: Selected rate control algorithm 'ath9k_rate_control'
[root@atom ~]# rmmod ath9k
BUG: unable to handle kernel NULL pointer dereference at 000000a4
IP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
*pde = 00000000
Oops: 0000 [#1] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:1e.0/0000:05:00.0/net/wlan1/flags
Modules linked in: xt_CT iptable_raw ipt_addrtype xt_DSCP xt_dscp xt_string xt_owner xt_NFQUEUE xt_mul]
Pid: 5817, comm: rmmod Not tainted 2.6.35-rc3-wl+ #1 To be filled by O.E.M./To Be Filled By O.E.M.
EIP: 0060:[<f8d455d6>] EFLAGS: 00010046 CPU: 0
EIP is at ath9k_hw_intrpend+0x6/0x49 [ath9k_hw]
EAX: 00000000 EBX: 00000000 ECX: c08de3bc EDX: f705ec78
ESI: f705ec78 EDI: 00000010 EBP: f4563e70 ESP: f4563e6c
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process rmmod (pid: 5817, ti=f4562000 task=f4504550 task.ti=f4562000)
Stack:
  00000000 f4563e88 f8de3cb4 00000010 f6aab6c0 00000282 00000010 f4563ea8
<0> c046d228 f705ec78 00000282 c08de3bc 00000010 c08de380 f705ec78 f4563ebc
<0> c046d28f f705ec78 f7113000 f8f00000 f4563ed0 f8dea27f f7113000 f8def9a8
Call Trace:
  [<f8de3cb4>] ? ath_isr+0x25/0x189 [ath9k]
  [<c046d228>] ? __free_irq+0x11e/0x15e
  [<c046d28f>] ? free_irq+0x27/0x3a
  [<f8dea27f>] ? ath_pci_remove+0x2f/0x54 [ath9k]
  [<c05816da>] ? pci_device_remove+0x19/0x39
  [<c06036d6>] ? __device_release_driver+0x59/0x9d
  [<c0603781>] ? driver_detach+0x67/0x85
  [<c0602c9d>] ? bus_remove_driver+0x69/0x85
  [<c0603b92>] ? driver_unregister+0x4b/0x52
  [<c05818a9>] ? pci_unregister_driver+0x2d/0x6e
  [<f8dea171>] ? ath_pci_exit+0xd/0xf [ath9k]
  [<f8dec664>] ? ath9k_exit+0x8/0x2f [ath9k]
  [<c0455232>] ? sys_delete_module+0x16f/0x1c0
  [<c07458dc>] ? do_page_fault+0x26a/0x2c5
  [<c074590a>] ? do_page_fault+0x298/0x2c5
  [<c0402fdc>] ? sysenter_do_call+0x12/0x28
Code: 80 4b 06 10 31 c9 83 c4 68 89 c8 5b 5e 5f 5d c3 55 b9 0c 00 00 00 89 e5 53 8b 98 94 00 00 00 ff
EIP: [<f8d455d6>] ath9k_hw_intrpend+0x6/0x49 [ath9k_hw] SS:ESP 0068:f4563e6c
CR2: 00000000000000a4
---[ end trace 43bc6f57caff1689 ]---

Quoted 1 line

Killed

Can you please try this patch?

drivers/net/wireless/ath/ath9k/init.c +1 -1

index fe730cb..243c177 100644
@@ -787,12 +787,12 @@ void ath9k_deinit_device(struct ath_softc *sc)
 		ieee80211_unregister_hw(aphy->hw);
 		ieee80211_free_hw(aphy->hw);
 	}
-	kfree(sc->sec_wiphy);
 
 	ieee80211_unregister_hw(hw);
 	ath_rx_cleanup(sc);
 	ath_tx_cleanup(sc);
 	ath9k_deinit_softc(sc);
+	kfree(sc->sec_wiphy);
 }
 
 void ath_descdma_cleanup(struct ath_softc *sc,

drivers/net/wireless/ath/ath9k/main.c +7 -2

index 4c0831f..a6b6af2 100644
@@ -1264,6 +1264,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 	struct ath_softc *sc = aphy->sc;
 	struct ath_hw *ah = sc->sc_ah;
 	struct ath_common *common = ath9k_hw_common(ah);
+	int i;
 
 	mutex_lock(&sc->mutex);

@@ -1276,11 +1277,15 @@ static void ath9k_stop(struct ieee80211_hw *hw)
 	cancel_work_sync(&sc->paprd_work);
 	cancel_work_sync(&sc->hw_check_work);
 
-	if (!sc->num_sec_wiphy) {
+	for (i = 0; i < sc->num_sec_wiphy; i++) {
+		if (sc->sec_wiphy[i])
+			break;
+	}
+
+	if (i == sc->num_sec_wiphy) {
 		cancel_delayed_work_sync(&sc->wiphy_work);
 		cancel_work_sync(&sc->chan_work);
 	}
-
 	if (sc->sc_flags & SC_OP_INVALID) {
 		ath_print(common, ATH_DBG_ANY, "Device not present\n");
 		mutex_unlock(&sc->mutex);

---
Rajkumar

Ben Greear

author

2010-07-06 12:05 UTC #8 lore raw

Quoted 7 lines · Rajkumar Manoharan

Quoted 4 lines · Ben Greear
I ran the same test on wireless-testing, and it still crashes.
It appears that the patch you sent is already in wireless-testing, so I did not apply it.
Can you please try this patch?

That patch appears to fix the problem. I was able to rmmod ath9k after adding a virtual phy and no crashes. It used to immediately crash every time.

I'll do some more testing later today if all goes according to plan.

Thanks!
Ben

Signature · 2 lines

Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com