[Bug 286063] iflwifi: isieee80211_sta_join() -> ieee80211_alloc_node() -> ieee80211_chan2mode() panic

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=286063

            Bug ID: 286063
           Summary: iflwifi: isieee80211_sta_join() ->
                    ieee80211_alloc_node() -> ieee80211_chan2mode()  panic
           Product: Base System
           Version: 15.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: wireless
          Assignee: wireless@FreeBSD.org
          Reporter: rm@FreeBSD.org

After booting kernel 680d34896c with patch for panic in PR 285729 applied from
https://reviews.freebsd.org/D49791 I got this panic just once, at first boot
with this patch. Then I wasn't able to get it. As for getting
ieee80211_sta_join+0x256 value you requested - how can I do that? And can I
somehow do that with what I have in /var/crash?:

-rw-r--r--   1 root wheel     2 Apr 12 18:33 bounds
-rw-r--r--   1 root wheel    30 Apr  1 01:20 core.txt.0
-rw-r--r--   1 root wheel    30 Apr 12 18:33 core.txt.1
-rw-------   1 root wheel   489 Apr  1 01:20 info.0
-rw-------   1 root wheel   477 Apr 12 18:33 info.1
lrwxr-xr-x   1 root wheel     6 Apr 12 18:33 info.last -> info.1
-rw-r--r--   1 root wheel     5 Dec 23  2021 minfree
-rw-------   1 root wheel 36864 Apr  1 01:20 textdump.tar.0
-rw-------   1 root wheel 31744 Apr 12 18:33 textdump.tar.1
lrwxr-xr-x   1 root wheel    14 Apr 12 18:33 textdump.tar.last ->
textdump.tar.1




> <118>Created wlan(4) interfaces: wlan0.
> <6>lo0: link state changed to UP
> <118>Starting wpa_supplicant.
> <118>Starting dhclient.
> <118>wlan0: no link ......
> <6>wlan0: link state changed to UP
> <118> got link
> <118>DHCPREQUEST on wlan0 to 255.255.255.255 port 67
> <6>wlan0: link state changed to DOWN
> <118>DHCPREQUEST on wlan0 to 255.255.255.255 port 67
> <118>wlan0 link state up -> down
> iwlwifi0: Not associated and the session protection is over already...
> iwlwifi0: linuxkpi_ieee80211_connection_loss: vif 0xfffffe0115d5cec0 vap 0xfffffe0115d5c010 state AUTH
> 
> 
> Fatal trap 9: general protection fault while in kernel mode
> cpuid = 0; apic id = 00
> instruction pointer	= 0x20:0xffffffff80cd64e0
> stack pointer	        = 0x28:0xfffffe01121409a8
> frame pointer	        = 0x28:0xfffffe0112140a30
> code segment		= base 0x0, limit 0xfffff, type 0x1b
> 			= DPL 0, pres 1, long 1, def32 0, gran 1
> processor eflags	= interrupt enabled, resume, IOPL = 0
> current process		= 389 (wpa_supplicant)
> rdi: c0dedeadc0dedead rsi: fffffe011611e2a5 rdx: 0000000000000001
> rcx: 0000000000000011  r8: dedeadc0dedeadc0  r9: c0dedeadc0dedead
> rax: fffffe011611e384 rbx: fffffe0115d5c010 rbp: fffffe0112140a30
> r10: c0dedeadc0dedead r11: 0000000000000001 r12: fffffe011611e068
> r13: fffffe011611e2a5 r14: fffffe0112621000 r15: 0000000000000001
> trap number		= 9
> panic: general protection fault
> cpuid = 0
> time = 1744471792
> KDB: stack backtrace:
> db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe0112140720
> vpanic() at vpanic+0x136/frame 0xfffffe0112140850
> panic() at panic+0x43/frame 0xfffffe01121408b0
> trap_fatal() at trap_fatal+0x68/frame 0xfffffe01121408d0
> calltrap() at calltrap+0x8/frame 0xfffffe01121408d0
> --- trap 0x9, rip = 0xffffffff80cd64e0, rsp = 0xfffffe01121409a8, rbp = 0xfffffe0112140a30 ---
> ieee80211_chan2mode() at ieee80211_chan2mode/frame 0xfffffe0112140a30
> ieee80211_sta_join() at ieee80211_sta_join+0x256/frame 0xfffffe0112140a80
> ieee80211_ioctl_setmlme() at ieee80211_ioctl_setmlme+0xfc/frame 0xfffffe0112140b10
> ieee80211_ioctl_set80211() at ieee80211_ioctl_set80211+0x9ad/frame 0xfffffe0112140b80
> ieee80211_ioctl() at ieee80211_ioctl+0x2de/frame 0xfffffe0112140be0
> ifioctl() at ifioctl+0x973/frame 0xfffffe0112140ce0
> kern_ioctl() at kern_ioctl+0x286/frame 0xfffffe0112140d40
> sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe0112140e00
> amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe0112140f30
> fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe0112140f30
> --- syscall (54, FreeBSD ELF64, ioctl), rip = 0x60c96590b0a, rsp = 0x60c8f6dbfd8, rbp = 0x60c8f6dc040 ---
> KDB: enter: panic
>

-- 
You are receiving this mail because:
You are the assignee for the bug.