[Bug 136814] ndiswrapper invalid buffer

[Thomas Pryds]

Public bug reported:

Running Gutsy tribe 5, latest updates installed. Suddenly system beep,
thereafter no netrwork connection. dmesg shows ndiswrapper crash.

$ lspci | grep -i wireless
02:03.0 Network controller: Broadcom Corporation BCM4318 [AirForce One 54g] 802.11g Wireless LAN Controller (rev 02)

>From dmesg:

[ 3979.192000] ndiswrapper (NdisFreeBuffer:1180): invalid buffer
[ 3979.192000] BUG: unable to handle kernel NULL pointer dereference at virtual address 00000494
[ 3979.192000]  printing eip:
[ 3979.192000] c027da66
[ 3979.192000] *pde = 00000000
[ 3979.192000] Oops: 0000 [#1]
[ 3979.192000] SMP 
[ 3979.192000] Modules linked in: binfmt_misc i915 drm rfcomm l2cap bluetooth capability ppdev cpufreq_ondemand cpufreq_conservative cpufreq_powersave cpufreq_userspace cpufreq_stats freq_table battery button container video ac sbs dock ipv6 ndiswrapper parport_pc lp parport fuse joydev snd_hda_intel snd_pcm_oss snd_mixer_oss snd_pcm snd_seq_dummy snd_seq_oss pcspkr psmouse serio_raw snd_seq_midi snd_rawmidi snd_seq_midi_event iTCO_wdt iTCO_vendor_support snd_seq snd_timer snd_seq_device af_packet intel_agp snd soundcore snd_page_alloc agpgart shpchp pci_hotplug evdev ext3 jbd mbcache sg sr_mod cdrom sd_mod ata_piix ata_generic libata scsi_mod b44 mii ehci_hcd uhci_hcd usbcore thermal processor fan apparmor commoncap aamatch_pcre
[ 3979.192000] CPU:    0
[ 3979.192000] EIP:    0060:[<c027da66>]    Tainted: P       VLI
[ 3979.192000] EFLAGS: 00010206   (2.6.22-10-generic #1)
[ 3979.192000] EIP is at kfree_skb+0x6/0x30
[ 3979.192000] eax: 000003e8   ebx: df411500   ecx: 000003e8   edx: 000003e8
[ 3979.192000] esi: d668be40   edi: d668be40   ebp: df1fd02c   esp: d3ce5efc
[ 3979.192000] ds: 007b   es: 007b   fs: 00d8  gs: 0000  ss: 0068
[ 3979.192000] Process ntos_wq/0 (pid: 4168, ti=d3ce4000 task=de3fd480 task.ti=d3ce4000)
[ 3979.192000] Stack: e0464722 00000000 df411500 df1fd000 d668be40 e045720a e030e000 e030f4ac 
[ 3979.192000]        e0458b70 df1fd000 00000000 df1fd0ec df1fd000 e048b718 cfcf1200 d668be40 
[ 3979.192000]        00000000 00000000 e0458b70 d3ce5f64 e048c8aa e045a5a0 e047d10c df411500 
[ 3979.192000] Call Trace:
[ 3979.192000]  [<e0464722>] free_tx_packet+0x62/0xb0 [ndiswrapper]
[ 3979.192000]  [<e045720a>] NdisMSendComplete+0x8a/0xd0 [ndiswrapper]
[ 3979.192000]  [<e0458b70>] NdisAcquireSpinLock+0x0/0x60 [ndiswrapper]
[ 3979.192000]  [<e0458b70>] NdisAcquireSpinLock+0x0/0x60 [ndiswrapper]
[ 3979.192000]  [<e045a5a0>] kdpc_worker+0x0/0xd0 [ndiswrapper]
[ 3979.192000]  [<e0455de4>] deserialized_irq_handler+0x14/0x40 [ndiswrapper]
[ 3979.192000]  [<e045a5cc>] kdpc_worker+0x2c/0xd0 [ndiswrapper]
[ 3979.192000]  [<c0138251>] run_workqueue+0x81/0x110
[ 3979.192000]  [<c013bea0>] prepare_to_wait+0x20/0x70
[ 3979.192000]  [<c0138c50>] worker_thread+0x0/0x100
[ 3979.192000]  [<c0138cf0>] worker_thread+0xa0/0x100
[ 3979.192000]  [<c013bcf0>] autoremove_wake_function+0x0/0x50
[ 3979.192000]  [<c0138c50>] worker_thread+0x0/0x100
[ 3979.192000]  [<c013ba32>] kthread+0x42/0x70
[ 3979.192000]  [<c013b9f0>] kthread+0x0/0x70
[ 3979.192000]  [<c0105487>] kernel_thread_helper+0x7/0x10
[ 3979.192000]  =======================
[ 3979.192000] Code: 44 24 04 2c 24 39 c0 c7 04 24 fe 2b 37 c0 e8 b2 b1 ea ff e8 7d 8a e8 ff e9 f4 fe ff ff 90 8d b4 26 00 00 00 00 85 c0 89 c2 74 23 <83> b8 ac 00 00 00 01 75 0c 0f ae e8 89 f6 89 d0 e9 b5 fe ff ff 
[ 3979.192000] EIP: [<c027da66>] kfree_skb+0x6/0x30 SS:ESP 0068:d3ce5efc
[ 3979.192000] note: ntos_wq/0[4168] exited with preempt_count 2


If more info is necessary, please ask :-)

** Affects: ndiswrapper (Ubuntu)
     Importance: Undecided
         Status: New

-- 
ndiswrapper invalid buffer
https://bugs.launchpad.net/bugs/136814
You received this bug notification because you are a member of Kernel
Bugs, which is a bug contact for ndiswrapper in ubuntu.