usb/144423: if_run panic with USB-N13

[Hans Petter Selasky]

On Friday 05 March 2010 12:40:05 PseudoCylon wrote:
> ----- Original Message ----
> 
> > From: Hans Petter Selasky <hselasky at c2i.net>
> > To: PseudoCylon <moonlightakkiy at yahoo.ca>
> > Cc: bug-followup at freebsd.org; jhanna at pangolin-systems.com;
> > freebsd-usb at freebsd.org; freebsd-gnats-submit at freebsd.org Sent: Fri,
> > March 5, 2010 2:42:41 AM
> > Subject: Re: usb/144423: if_run panic with USB-N13
> >
> > On Friday 05 March 2010 10:31:35 PseudoCylon wrote:
> > > >The files seem a little far from the current I am running, I just used
> > > >the updates to the usbdevs file and the unlock-lock around the
> > > > firmware load in if_run.c.
> > >
> > > Yes, there are some bits added to support RT3572 chipsets. It would be
> > >  greately appreciated if you try that file if it's not too mutch
> > > trouble.
> > >
> > > >The ASUS-N13 does work when a child wlan device is created with it,
> > > >but if just "ifconfig run0 up" is done there is a page fault. I do
> > > >not know if that is expected. This occurs with or without runfw.ko
> > > >being loaded beforehand.
> > >
> > > Yes, "ifconfig run0 up" will cause page fault. The wlanN interface is
> > >  should be created as an instance of the parent interface and used for
> > >  actual communication. This is new feature to 8.0 and 9-current. My
> > >  understanding is that if you create wlan and "ifconfig *wlan0* up", it
> > >  works, but if you "ifconfig *run0* up", it causes panic. (Of cource
> > >  without *. I'm trying to enphasize the point in plain text messeage.)
> > > That is what should happen. (Actually, result of "ifconfig *run0* up"
> > > is undefined.) "run0" should only be used when creating wlan.
> > >
> > > If "ifconfig *wlan0* ..." is causing problem, please let us know.
> >
> > What is the backtrace of the panic?
> 
> KDB: stack backtrace:
> db_trace_self_wrapper() at db_trace_self_wrapper+0x2a
> _witness_debugger() at _witness_debugger+0x2e
> witness_warn() at witness_warn+0x2c2
> trap() at trap+0x2f5
> calltrap() at calltrap+0x8
> --- trap 0xc, rip = 0xffffffff80c5cfd7, rsp = 0xffffff8021f76880, rbp =
>  0xffffff8021f768c0 --- run_stop() at run_stop+0x67
> run_init_locked() at run_init_locked+0x33
> run_ioctl() at run_ioctl+0xad
> ifioctl() at ifioctl+0xde4
> kern_ioctl() at kern_ioctl+0xc5
> ioctl() at ioctl+0xf0
> syscall() at syscall+0x1af
> Xfast_syscall() at Xfast_syscall+0xe1
> --- syscall (54, FreeBSD ELF64, ioctl), rip = 0x800b8286c, rsp =
>  0x7fffffffe2f8, rbp = 0x7fffffffe300 ---
> 
> There are number of places refers uninitialized value in run_stop() and
>  run_init() if vap hasn't created, so it will cause page fault. I can move
>  those instructions to other places (maybe vap_delete). It won't panic but
>  device won't work without vap.
> 

Can't you add a NULL pointer check?

It should not panic.

--HPS