[Bug 271979] bsdinstall(8): iwlwifi(4): system crash when authenticating for Wi-Fi: panic: lkpi_sta_auth_to_scan: lsta 0x... state not NONE: 0, nstate 1 arg 1

From: <bugzilla-noreply_at_freebsd.org>
Date: Thu, 12 Oct 2023 22:34:28 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=271979

Jean-Sébastien Pédron <dumbbell@FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dumbbell@FreeBSD.org

--- Comment #24 from Jean-Sébastien Pédron <dumbbell@FreeBSD.org> ---
Hi!

I also get this panic when running a kernel based on commit
7cff9672de44824d7d59cb562f53992a055e49cc. To be exact, I have a few more
commits on top of for upcoming updates to drm-kmod.

It's easy to reproduce: I simply use "service netif restart wlan0" (it was
skipped during boot).

Here are the few lines before the panic and the backtrace:

<6>wlan0: ieee80211_new_state_locked: pending SCAN -> AUTH transition lost
<4>Invalid TXQ id
iwl_mvm_tx_mpdu:1204: fc 0x00b0 tid 8 txq_id 65535 mvm 0xfffffe0147794408 skb
0xfffff8000b884000 { len 30 } info 0xfffffe00c83f5ce8 sta 0xfffff803c451d880
(if you see this please ro PR 274382)
panic: lkpi_sta_auth_to_scan: lsta 0xfffff8000f352000 state not NONE: 0, nstate
1 arg 1

cpuid = 6
time = 1697050125
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0147abdb70
vpanic() at vpanic+0x132/frame 0xfffffe0147abdca0
panic() at panic+0x43/frame 0xfffffe0147abdd00
lkpi_sta_auth_to_scan() at lkpi_sta_auth_to_scan+0x2c8/frame 0xfffffe0147abdd80
lkpi_iv_newstate() at lkpi_iv_newstate+0x253/frame 0xfffffe0147abddf0
ieee80211_newstate_cb() at ieee80211_newstate_cb+0x1e7/frame 0xfffffe0147abde40
taskqueue_run_locked() at taskqueue_run_locked+0xab/frame 0xfffffe0147abdec0
taskqueue_thread_loop() at taskqueue_thread_loop+0xd3/frame 0xfffffe0147abdef0
fork_exit() at fork_exit+0x82/frame 0xfffffe0147abdf30
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe0147abdf30
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
Uptime: 14m18s
Dumping 892 out of 16038 MB:..2%..11%..22%..31%..42%..51%..61%..72%..81%..92%

__curthread () at
/home/dumbbell/Documents/freebsd/src/sys/amd64/include/pcpu_aux.h:57
57              __asm("movq %%gs:%P1,%0" : "=r" (td) : "n" (offsetof(struct
pcpu,
(kgdb) bt
#0  __curthread () at
/home/dumbbell/Documents/freebsd/src/sys/amd64/include/pcpu_aux.h:57
#1  doadump (textdump=textdump@entry=1) at
/home/dumbbell/Documents/freebsd/src/sys/kern/kern_shutdown.c:405
#2  0xffffffff80b4f3e0 in kern_reboot (howto=260) at
/home/dumbbell/Documents/freebsd/src/sys/kern/kern_shutdown.c:526
#3  0xffffffff80b4f8df in vpanic (fmt=0xffffffff811e6539 "%s: lsta %p state not
NONE: %#x, nstate %d arg %d\n", ap=ap@entry=0xfffffe0147abdce0)
    at /home/dumbbell/Documents/freebsd/src/sys/kern/kern_shutdown.c:969
#4  0xffffffff80b4f683 in panic (fmt=<unavailable>) at
/home/dumbbell/Documents/freebsd/src/sys/kern/kern_shutdown.c:894
#5  0xffffffff80dd2568 in lkpi_sta_auth_to_scan (vap=0xfffffe014a16d010,
nstate=IEEE80211_S_SCAN, arg=1)
    at
/home/dumbbell/Documents/freebsd/src/sys/compat/linuxkpi/common/src/linux_80211.c:1175
#6  0xffffffff80dd9c93 in lkpi_iv_newstate (vap=0xfffffe014a16d010,
nstate=IEEE80211_S_SCAN, arg=1)
    at
/home/dumbbell/Documents/freebsd/src/sys/compat/linuxkpi/common/src/linux_80211.c:2113
#7  0xffffffff80cff027 in ieee80211_newstate_cb (xvap=0xfffffe014a16d010,
npending=<optimized out>) at
/home/dumbbell/Documents/freebsd/src/sys/net80211/ieee80211_proto.c:2546
#8  0xffffffff80bb4ecb in taskqueue_run_locked
(queue=queue@entry=0xfffff8000b21a600) at
/home/dumbbell/Documents/freebsd/src/sys/kern/subr_taskqueue.c:512
#9  0xffffffff80bb5f83 in taskqueue_thread_loop
(arg=arg@entry=0xfffffe0147798110) at
/home/dumbbell/Documents/freebsd/src/sys/kern/subr_taskqueue.c:824
#10 0xffffffff80b05452 in fork_exit (callout=0xffffffff80bb5eb0
<taskqueue_thread_loop>, arg=0xfffffe0147798110, frame=0xfffffe0147abdf40)
    at /home/dumbbell/Documents/freebsd/src/sys/kern/kern_fork.c:1160

-- 
You are receiving this mail because:
You are on the CC list for the bug.