[Bug 268565] [patch] panic after "killall wpa_supplicant" followed by "/etc/rc.d/netif start" with rtw880

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=268565

            Bug ID: 268565
           Summary: [patch] panic after "killall wpa_supplicant" followed
                    by "/etc/rc.d/netif start" with rtw880
           Product: Base System
           Version: CURRENT
          Hardware: amd64
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: wireless
          Assignee: wireless@FreeBSD.org
          Reporter: misha@freebsd.org

Created attachment 239026
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=239026&action=edit
proposed patch

On latest current I've a crash, while executing following commands:

# killall wpa_supplicant
# /etc/rc.d/netif start

The hardware:

rtw880: <rtw_8822ce> port 0x2000-0x20ff mem 0xd0500000-0xd050ffff at device 0.0
on pci1
rtw880: successfully loaded firmware image 'rtw88/rtw8822c_fw.bin'
rtw880: Firmware version 9.9.10, H2C version 15

I also attach proposed patch.

Fatal trap 12: page fault while in kernel mode
cpuid = 5; apic id = 05
fault virtual address   = 0x68
fault code              = supervisor read data, page not present
instruction pointer     = 0x20:0xffffffff80bc7d19
stack pointer           = 0x28:0xfffffe012ed83c40
frame pointer           = 0x28:0xfffffe012ed83c80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (rtw880 net80211 tas)
rdi:               50 rsi: fffffe0131b9ce40 rdx:                0
rcx:              b93  r8:               40  r9: fffff800086fad00
rax:                1 rbx:                0 rbp: fffffe012ed83c80
r10: fffff803ffd9d200 r11: ffffffff81f334a8 r12: ffffffff813133bd
r13:              b93 r14:               68 r15: fffff80030d9d800
trap number             = 12
panic: page fault
cpuid = 5
time = 1672032240
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe012ed83a00
vpanic() at vpanic+0x151/frame 0xfffffe012ed83a50
panic() at panic+0x43/frame 0xfffffe012ed83ab0
trap_fatal() at trap_fatal+0x409/frame 0xfffffe012ed83b10
trap_pfault() at trap_pfault+0xab/frame 0xfffffe012ed83b70
calltrap() at calltrap+0x8/frame 0xfffffe012ed83b70
--- trap 0xc, rip = 0xffffffff80bc7d19, rsp = 0xfffffe012ed83c40, rbp =
0xfffffe012ed83c80 ---
__mtx_lock_flags() at __mtx_lock_flags+0x49/frame 0xfffffe012ed83c80
lkpi_ic_raw_xmit() at lkpi_ic_raw_xmit+0x2e/frame 0xfffffe012ed83cb0
ieee80211_send_probereq() at ieee80211_send_probereq+0x4fa/frame
0xfffffe012ed83d50
ieee80211_swscan_probe_curchan() at ieee80211_swscan_probe_curchan+0x71/frame
0xfffffe012ed83d90
scan_curchan() at scan_curchan+0x67/frame 0xfffffe012ed83dd0
scan_curchan_task() at scan_curchan_task+0x2c4/frame 0xfffffe012ed83e40
taskqueue_run_locked() at taskqueue_run_locked+0xaa/frame 0xfffffe012ed83ec0
taskqueue_thread_loop() at taskqueue_thread_loop+0xc2/frame 0xfffffe012ed83ef0
fork_exit() at fork_exit+0x80/frame 0xfffffe012ed83f30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe012ed83f30
--- trap 0, rip = 0xfffff8002d385fd8, rsp = 0xffffffffffff8000, rbp = 0 ---
??() at 0xfffff8002d385fd8
KDB: enter: panic

-- 
You are receiving this mail because:
You are the assignee for the bug.