Bug 557970

Summary: b44: kernel panic on shutdown
Product: [openSUSE] openSUSE 11.2 Reporter: Stanislav Brabec <sbrabec>
Component: KernelAssignee: Brandon Philips <bphilips>
Status: VERIFIED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Major    
Priority: P2 - High CC: jeffm
Version: Final   
Target Milestone: ---   
Hardware: Other   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: b44_panic.jpg
b44_WOL_setup_one-bit-off_stack_corruption_kernel_panic_fix.patch

Description Stanislav Brabec 2009-11-24 09:43:46 UTC
Created attachment 329127 [details]
b44_panic.jpg

I experience kernel panic during the system shutdown. It happens in about 50% of all shutdowns. This is the first time it crashed with the right vt in front, so I was able to make screenshot.
Comment 1 Stanislav Brabec 2009-11-28 22:45:51 UTC
And captured wuth a serial console (kernel-desktop i586).

Shutting down (localfs) network interfaces:
    eth0      name: BCM4401 100Base-T
[ 5281.075229] b44: eth0: powering down PHY
[ 5281.080811] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: f1061bb4
[ 5281.080815] 
[ 5281.091413] Pid: 7113, comm: ip Not tainted 2.6.31.5-0.3-desktop #1
[ 5281.097929] Call Trace:
[ 5281.100519]  [<c020845a>] try_stack_unwind+0x17a/0x1a0
[ 5281.105878]  [<c020708c>] dump_trace+0x6c/0x130
[ 5281.110647]  [<c0208008>] show_trace_log_lvl+0x58/0x80
[ 5281.115997]  [<c0208056>] show_trace+0x26/0x40
[ 5281.120631]  [<c06929e3>] dump_stack+0x79/0x91
[ 5281.125263]  [<c0692a56>] panic+0x5b/0x145
[ 5281.129537]  [<c0251624>] __stack_chk_fail+0x24/0x60
[ 5281.134727]  [<f1061bb4>] b44_setup_pseudo_magicp+0x1c4/0x230 [b44]
[ 5281.141277]  [<f1061d87>] b44_setup_wol+0x167/0x180 [b44]
[ 5281.146902]  [<f1061f53>] b44_close+0xd3/0xe0 [b44]
[ 5281.151989]  [<c05c6c6b>] dev_close+0x6b/0xc0
[ 5281.156528]  [<c05c7561>] dev_change_flags+0x81/0x1a0
[ 5281.161799]  [<c05d2f00>] do_setlink+0x1e0/0x460
[ 5281.166607]  [<c05d3f68>] rtnl_newlink+0x448/0x510
[ 5281.171605]  [<c05d38e3>] rtnetlink_rcv_msg+0x1d3/0x210
[ 5281.177049]  [<c05e6ee6>] netlink_rcv_skb+0xa6/0xd0
[ 5281.182129]  [<c05d36e5>] rtnetlink_rcv+0x25/0x50
[ 5281.187023]  [<c05e6bbb>] netlink_unicast+0x27b/0x2b0
[ 5281.192281]  [<c05e7946>] netlink_sendmsg+0x1e6/0x2c0
[ 5281.197552]  [<c05b5a3e>] sock_sendmsg+0xee/0x130
[ 5281.202454]  [<c05b6788>] sys_sendmsg+0x158/0x290
[ 5281.207395]  [<c05b6fa2>] sys_socketcall+0xd2/0x290
[ 5281.212542]  [<c0204073>] sysenter_do_call+0x12/0x28
[ 5281.221548] DWARF2 unwinder stuck at sysenter_do_call+0x12/0x28
[ 5281.227739] 
[ 5281.229301] Leftover inexact backtrace:
[ 5281.229303]
Comment 2 Stanislav Brabec 2009-12-02 14:03:21 UTC
Created attachment 330500 [details]
b44_WOL_setup_one-bit-off_stack_corruption_kernel_panic_fix.patch

I sent this fix to LKML:
http://patchwork.kernel.org/patch/64261/
http://lkml.org/lkml/2009/12/2/193

Note: Even if this problem does not cause stack corruption in SLE11 and SLE10 (and maybe SLE9), this problem also affects these products.
Comment 3 Stanislav Brabec 2009-12-04 17:19:34 UTC
Michal, what exactly should be done to get this fix to openSUSE 11.2 and SLES?

If the kernel is compiled with stack-protector then it fixes stack corruption kernel panic and WakeOnLan.

If the kernel is compiled without stack-protector then it fixes WakeOnLan and possibly invisible stack corruption.
Comment 4 Michal Marek 2009-12-04 17:30:49 UTC
You posted it upstream with a Cc: stable@kernel.org. I think you don't have to do anything, it should appear a 2.6.31.y stable kernel release, which we are tracking for updates.
Comment 5 Brandon Philips 2009-12-11 00:17:20 UTC
(In reply to comment #4)
> You posted it upstream with a Cc: stable@kernel.org. 

Greg should also pick this up for 2.6.27 for SLE11. I will check back on his queue in a few days to see if it got picked up.
Comment 6 Brandon Philips 2010-03-03 19:23:27 UTC
Checked into SLE11_BRANCH. Confirmed in SLE11-SP1 via patches.kernel.org/patch-2.6.32.1-2

Greg- Any idea why this didn't get picked up for 2.6.27 -stable? Upstream this is e0188829cb724e7d12a2d4e343b368ff1d6e1471
Comment 7 Greg Kroah-Hartman 2010-03-19 00:09:28 UTC
No idea, I've now queued it up for the next .27-stable release