Bug#451863: rt2570: issuing a "iwlist scan" causes a kernel crash

[Jon Dowland]

Package: rt2570-source
Version: 1.1.0+cvs20070927-1
Severity: normal

The following is logged when I "ifconfig rt up" ("rt" is
the interface name assigned, as a result of some udev rules)

Nov 17 12:12:49 konishi kernel: RT25usb Driver version 1.0.0
Nov 17 12:12:50 konishi kernel: ***rt2x00***: Interface goes up for the first time, activating permanent MAC
Nov 17 12:12:50 konishi kernel: ***rt2x00***: Active MAC is: 00:11:09:51:03:10.

I then attempt an "iwlist scan":

Nov 17 12:12:54 konishi kernel: divide error: 0000 [#1]
Nov 17 12:12:54 konishi kernel: SMP 
Nov 17 12:12:54 konishi kernel: Modules linked in: ppdev lp button ac battery ipv6 nls_iso8859_1 ntfs fuse firewire_sbp2 loop snd_hda_intel snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi snd_seq_midi_event snd_seq snd_timer tsdev snd_seq_device serio_raw snd hci_usb evdev ati_remote rt2570 psmouse i2c_i801 iTCO_wdt i2c_core soundcore bluetooth usb_storage usbhid hid snd_page_alloc parport_pc parport pcspkr rtc ext3 jbd mbcache dm_mirror dm_snapshot dm_mod raid1 md_mod sd_mod ide_cd cdrom ahci ata_generic ata_piix libata scsi_mod piix firewire_ohci firewire_core crc_itu_t floppy via_rhine mii generic ide_core ehci_hcd uhci_hcd usbcore thermal processor fan
Nov 17 12:12:54 konishi kernel: CPU:    0
Nov 17 12:12:54 konishi kernel: EIP:    0060:[<f8a5608f>]    Not tainted VLI
Nov 17 12:12:54 konishi kernel: EFLAGS: 00010246   (2.6.22-3-686 #1)
Nov 17 12:12:54 konishi kernel: EIP is at RTUSBMlmeHardTransmit+0x186/0x1a6 [rt2570]
Nov 17 12:12:54 konishi kernel: eax: 0000003c   ebx: dfac0420   ecx: 00000000   edx: 00000000
Nov 17 12:12:54 konishi kernel: esi: 0000003c   edi: f35a603c   ebp: 00000028   esp: f35e5e6c
Nov 17 12:12:54 konishi kernel: ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
Nov 17 12:12:54 konishi kernel: Process rtusb-mlme (pid: 4800, ti=f35e4000 task=f5109580 task.ti=f35e4000)
Nov 17 12:12:54 konishi kernel: Stack: 00000000 00000000 00000001 00000000 00000028 00000000 00000000 00000003 
Nov 17 12:12:54 konishi kernel:        00000005 0000002c 00000001 00000004 00000000 00000000 dfac0bec f35a6000 
Nov 17 12:12:54 konishi kernel:        00000002 dfac0580 dfac0588 dfac0420 00000282 f8a5640b dfac25f8 dfac0420 
Nov 17 12:12:54 konishi kernel: Call Trace:
Nov 17 12:12:54 konishi kernel:  [<f8a5640b>] RTUSBDequeueMLMEPacket+0x6f/0xbc [rt2570]
Nov 17 12:12:54 konishi kernel:  [<f8a564dc>] MiniportMMRequest+0x84/0xa4 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<f8a437f5>] ScanNextChannel+0x278/0x288 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<c02a39c7>] __sched_text_start+0x687/0x73d
Nov 17 12:12:54 konishi kernel:  [<f8a45300>] MlmeScanReqAction+0xc8/0xf0 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<f8a3dabf>] StateMachinePerformAction+0x16/0x19 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<f8a3fd6b>] MlmeHandler+0xb5/0x1c9 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<f8a3d44e>] MlmeThread+0x0/0x57 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<f8a3d487>] MlmeThread+0x39/0x57 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<f8a3d487>] MlmeThread+0x39/0x57 [rt2570]
Nov 17 12:12:54 konishi kernel:  [<c01330f2>] kthread+0x38/0x5e
Nov 17 12:12:54 konishi kernel:  [<c01330ba>] kthread+0x0/0x5e
Nov 17 12:12:54 konishi kernel:  [<c01049bf>] kernel_thread_helper+0x7/0x10
Nov 17 12:12:54 konishi kernel:  =======================
Nov 17 12:12:54 konishi kernel: Code: 24 08 01 00 00 00 89 04 24 8b 44 24 3c e8 a8 fb ff ff f7 c6 01 00 00 00 8d 55 15 0f 45 f2 0f b7 93 54 c2 01 00 89 f0 89 d1 31 d2 <f7> f1 8b 44 24 38 8d 4e 02 85 d2 0f 44 f1 89 70 10 83 8b c4 04 
Nov 17 12:12:54 konishi kernel: EIP: [<f8a5608f>] RTUSBMlmeHardTransmit+0x186/0x1a6 [rt2570] SS:ESP 0068:f35e5e6c
Nov 17 12:13:00 konishi kernel: rt: no IPv6 routers present

Very shortly after this, the machine locks up.

ii  wireless-tools 29-1           Tools for manipulating Linux Wireless Extens

I have repeated this once (for a total of two crashes)

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (990, 'unstable')
Architecture: i386 (i686)

Kernel: Linux 2.6.22-3-686 (SMP w/2 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages rt2570-source depends on:
ii  bzip2                         1.0.3-7    high-quality block-sorting file co
ii  debhelper                     5.0.60     helper programs for debian/rules
ii  module-assistant              0.10.11    tool to make module package creati

rt2570-source recommends no packages.

-- no debconf information