[Bug 273985] iwlwifi: AX201: crash (kernel panic) on ifconfig wlan0 destroy

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273985

Cheng Cui <cc@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |cc@FreeBSD.org

--- Comment #8 from Cheng Cui <cc@FreeBSD.org> ---
Also hit this crash reliably.

root@n1_iwl_vm:~ # uname -a
FreeBSD n1_iwl_vm 15.0-CURRENT FreeBSD 15.0-CURRENT #19 main-488bc7e9a: Tue Nov
21 11:42:00 EST 2023    
root@n1_iwl_vm:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64
root@n1_iwl_vm:~ # 
root@n1_iwl_vm:~ # ifconfig wlan0 destroy


Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x20:0xffffffff80b2a5c8
stack pointer           = 0x28:0xfffffe0074741a40
frame pointer           = 0x28:0xfffffe0074741a80
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1139 (ifconfig)
rdi: deadc0dedeadc0f6 rsi: fffff8000598d740 rdx: 0000000000000000
rcx: 0000000000000865  r8: 0000000000000001  r9: 0000000000010000
rax: 0000000000000001 rbx: deadc0dedeadc10e rbp: fffffe0074741a80
r10: 0000000000000001 r11: 0000000000010000 r12: 0000000000000865
r13: deadc0dedeadc0de r14: deadc0dedeadc10e r15: ffffffff8116aaf8
trap number             = 9
panic: general protection fault
cpuid = 0
time = 1702316103
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0074741780
vpanic() at vpanic+0x132/frame 0xfffffe00747418b0
panic() at panic+0x43/frame 0xfffffe0074741910
trap_fatal() at trap_fatal+0x40c/frame 0xfffffe0074741970
calltrap() at calltrap+0x8/frame 0xfffffe0074741970
--- trap 0x9, rip = 0xffffffff80b2a5c8, rsp = 0xfffffe0074741a40, rbp =
0xfffffe0074741a80 ---
__mtx_lock_flags() at __mtx_lock_flags+0x48/frame 0xfffffe0074741a80
_ieee80211_free_node() at _ieee80211_free_node+0x34/frame 0xfffffe0074741ac0
ieee80211_node_vdetach() at ieee80211_node_vdetach+0x2b/frame
0xfffffe0074741ae0
ieee80211_vap_detach() at ieee80211_vap_detach+0x612/frame 0xfffffe0074741b20
lkpi_ic_vap_delete() at lkpi_ic_vap_delete+0xae/frame 0xfffffe0074741b50
wlan_clone_destroy() at wlan_clone_destroy+0x12/frame 0xfffffe0074741b60
if_clone_destroyif_flags() at if_clone_destroyif_flags+0x6a/frame
0xfffffe0074741ba0
if_clone_destroy() at if_clone_destroy+0x100/frame 0xfffffe0074741be0
ifioctl() at ifioctl+0x8a5/frame 0xfffffe0074741cd0
kern_ioctl() at kern_ioctl+0x286/frame 0xfffffe0074741d30
sys_ioctl() at sys_ioctl+0x152/frame 0xfffffe0074741e00
amd64_syscall() at amd64_syscall+0x153/frame 0xfffffe0074741f30
fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0074741f30
--- syscall (54, FreeBSD ELF64, ioctl), rip = 0x3c753c0388a, rsp =
0x3c74f4a9a38, rbp = 0x3c74f4a9a70 ---
KDB: enter: panic
[ thread pid 1139 tid 100090 ]
Stopped at      kdb_enter+0x32: movq    $0,0xe2ab23(%rip)
db> dump
Dumping 338 out of 6111 MB:..5%..15%..24%..34%..43%..53%..62%..71%..81%..95%
Dump complete
db>

-- 
You are receiving this mail because:
You are the assignee for the bug.