[Bug 136814] Re: ndiswrapper invalid buffer

[Jason Rothfuss]

I also have encountered this problem in Gutsy Tribe5 amd64.

# lspci -vv | grep -i wireless
06:02.0 Network controller: Broadcom Corporation BCM4318 [AirForce One 54g] 802.11g Wireless LAN Controller (rev 02)

Information from /var/log/syslog below:

kernel: [51868.249251] ndiswrapper (NdisFreeBuffer:1180): invalid buffer
kernel: [51868.249275] Unable to handle kernel NULL pointer dereference at 00000000000005f5 RIP: 
kernel: [51868.249278]  [kfree_skb+5/48] kfree_skb+0x5/0x30
kernel: [51868.249286] PGD ccc8067 PUD 1d5de067 PMD 0 
kernel: [51868.249289] Oops: 0000 [1] SMP 
kernel: [51868.249292] CPU 0 
kernel: [51868.249293] Modules linked in: binfmt_misc rfcomm l2cap bluetooth capability nfsd exportfs fglrx(P) ppdev ipv6 powernow_k8 cpufreq_powersave cpufreq_stats cpufreq_userspace cpufreq_ondemand cpufreq_conservative freq_table video battery container sbs button dock ac nfs lockd sunrpc af_packet tun ndiswrapper sbp2 parport_pc lp parport fuse joydev snd_atiixp snd_seq_dummy snd_seq_oss snd_seq_midi snd_rawmidi pcmcia snd_atiixp_modem snd_ac97_codec snd_seq_midi_event tifm_7xx1 tifm_core ac97_bus snd_pcm_oss snd_mixer_oss snd_pcm sdhci mmc_core snd_seq snd_timer snd_seq_device pcspkr yenta_socket rsrc_nonstatic pcmcia_core psmouse serio_raw snd soundcore snd_page_alloc k8temp i2c_piix4 i2c_core shpchp pci_hotplug evdev reiserfs ide_cd cdrom 8139cp ide_disk atiixp ide_core 8139too mii ohci1394 ieee1394 ata_generic libata scsi_mod ehci_hcd ohci_hcd usbcore dm_mirror dm_snapshot dm_mod thermal processor fan apparmor commoncap aamatch_pcre
kernel: [51868.249340] Pid: 3744, comm: ntos_wq/0 Tainted: P       2.6.22-10-generic #1
kernel: [51868.249343] RIP: 0010:[kfree_skb+5/48]  [kfree_skb+5/48] kfree_skb+0x5/0x30
kernel: [51868.249348] RSP: 0018:ffff81003763dd38  EFLAGS: 00010206
kernel: [51868.249352] RAX: 0000000000000246 RBX: ffff81003d0e1780 RCX: ffffffff80534ee8
kernel: [51868.249355] RDX: ffffffff80534ee8 RSI: 0000000000000086 RDI: 0000000000000511
kernel: [51868.249358] RBP: ffffffff8831a160 R08: 0000000000000000 R09: 0000000000000000
kernel: [51868.249361] R10: 0000000000000000 R11: 0000000000000006 R12: ffff81003d2e11a0
kernel: [51868.249364] R13: ffff8100217a9400 R14: 0000000000000000 R15: ffff8100217a9768
kernel: [51868.249368] FS:  00002b3f7bb32360(0000) GS:ffffffff80561000(0000) knlGS:00000000f7596b70
kernel: [51868.249371] CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
kernel: [51868.249374] CR2: 00000000000005f5 CR3: 000000001de23000 CR4: 00000000000006e0
kernel: [51868.249378] Process ntos_wq/0 (pid: 3744, threadinfo ffff81003763c000, task ffff81003d280000)
kernel: [51868.249380] Stack:  ffffffff883243de 0000000000000000 ffff81003d2e1000 ffffffff8831a160
kernel: [51868.249386]  ffff81003d2e11a0 ffff81003e005a88 0000000000000000 0000000000000000
kernel: [51868.249390]  ffffffff8832854b ffff81003d2e1048 ffff8100217a9400 ffffc2000081c3f0
kernel: [51868.249395] Call Trace:
kernel: [51868.249430]  [_end+130838614/2130324600] :ndiswrapper:free_tx_packet+0x6e/0x170
kernel: [51868.249449]  [_end+130797016/2130324600] :ndiswrapper:kdpc_worker+0x0/0xd0
kernel: [51868.249470]  [_end+130855363/2130324600] :ndiswrapper:win2lin3+0x11/0x14
kernel: [51868.249487]  [thread_return+0/1737] thread_return+0x0/0x6c9
kernel: [51868.249505]  [_end+130778988/2130324600] :ndiswrapper:deserialized_irq_handler+0x14/0x30
kernel: [51868.249527]  [_end+130855386/2130324600] :ndiswrapper:win2lin4+0x14/0x17
kernel: [51868.249545]  [_end+130797062/2130324600] :ndiswrapper:kdpc_worker+0x2e/0xd0
kernel: [51868.249563]  [_end+130809032/2130324600] :ndiswrapper:ntos_work_worker+0x0/0xf0
kernel: [51868.249570]  [run_workqueue+127/272] run_workqueue+0x7f/0x110
kernel: [51868.249575]  [worker_thread+0/304] worker_thread+0x0/0x130
kernel: [51868.249578]  [worker_thread+197/304] worker_thread+0xc5/0x130
kernel: [51868.249584]  [autoremove_wake_function+0/48] autoremove_wake_function+0x0/0x30
kernel: [51868.249589]  [worker_thread+0/304] worker_thread+0x0/0x130
kernel: [51868.249594]  [worker_thread+0/304] worker_thread+0x0/0x130
kernel: [51868.249598]  [kthread+75/128] kthread+0x4b/0x80
kernel: [51868.249605]  [child_rip+10/18] child_rip+0xa/0x12
kernel: [51868.249618]  [kthread+0/128] kthread+0x0/0x80
kernel: [51868.249622]  [child_rip+0/18] child_rip+0x0/0x12
kernel: [51868.249626] 
kernel: [51868.249627] 
kernel: [51868.249628] Code: 83 bf e4 00 00 00 01 75 08 0f ae e8 e9 9a fe ff ff 90 ff 8f 
kernel: [51868.249636] RIP  [kfree_skb+5/48] kfree_skb+0x5/0x30
kernel: [51868.249640]  RSP <ffff81003763dd38>
kernel: [51868.249642] CR2: 00000000000005f5
kernel: [51868.249645] note: ntos_wq/0[3744] exited with preempt_count 2

-- 
ndiswrapper invalid buffer
https://bugs.launchpad.net/bugs/136814
You received this bug notification because you are a member of Kernel
Bugs, which is a bug contact for ndiswrapper in ubuntu.