From nobody Wed Apr 16 07:59:26 2025 X-Original-To: wireless@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4Zctht5qHQz5tFsJ for ; Wed, 16 Apr 2025 07:59:26 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R10" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4Zctht4nTdz3d3y for ; Wed, 16 Apr 2025 07:59:26 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744790366; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3m9eggaXVeGizY9+q+aMtq02v8PhibE7sQ3AGFalb8s=; b=wh/RzFACiXjr0wv39BAtnE4Fp1MgZE4k/spvHBXlMwz+WXWgkLNQ1xeexs+PECY6VIBfyj 01EbOQidcsiKPXu5IqWEbRTs1OB7PUI+RXScKQ0y/dMl9tYVD1/r+8WgT322QvPdggryvd m8H0ZqzXy1JBFAE/y1aTyZz0Lro4wO5zqaSeAfYx+R+2nbCFaVt8Gq9RUwJIuvsO60Vgw2 u1ZTM6T4FLzHVypKQUtF+vy+mYw450BzIWTRPyA30U6zqI7l2fCREDADdATS528kbr6VsU JfiTn0/uaynLToFxPwH7lakc+WVuddwM25R5Z6XILCMccYms210Z/770bZCV4A== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1744790366; a=rsa-sha256; cv=none; b=Tv6763N19W5LlVaZpuRCg4ZlqodIb2OR5kuSSKU6FjxbjSRNrQffCWGfwJDOE86LiY+wCq QJ9CO4fCzUJAQDl2JOudRh5AVpmr/b3a8+6Voj19aIezHJGkyMxzQv1iUyjjNyoIUs2JP3 p4h++SUuayi7aUIdxUMAe8hoOWZc5lsUaEZgeiSAzPMN2SFLZTZlFrYQanrgwtwdbXbm5q LbIK4ywbN/ze9jFuwZC7+FKudl8BPw26tHTuyUeB22KEu+9R1OetUPQI/IO/u3MTaV+oZ9 2wGBMnBSwrymkTUhsgfHTHEjYvkzw0aqkig4FaNBBxGeENg6+14BRbThpbWodQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1744790366; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=3m9eggaXVeGizY9+q+aMtq02v8PhibE7sQ3AGFalb8s=; b=B/dXNIJuS/OhCfQ79MB2l7wU9M67m8vgs1fBuJ21ju/iDVRf13jhyKx97kML+KScRctxIk HZKdvTNVgF12J5QEPVMcPtpzPe6pe8yePiS1V3Y786f3GtN7kuapMPjnHyvVy+/Eumt7Yt Xq7MF6HfVC2IiIS+X0zgZQc5LwnVWc3DILMrRstgfDwWVIpZ4vbNC+cOn4mdTyETpo7SKK Pgo63sgc1GwsG+OI7CU7sqLBwezWPnkBiS9lksp4tKL8wUPhZ4XQfb8w1iflmgs2JkgHxJ yL37iXHkgJs+fzqo2iru5ca5l2UFXkLC4BG5xp+hI4c2xQULlZ8RLdWwRERnTQ== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4Zctht3TbGz18yq for ; Wed, 16 Apr 2025 07:59:26 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 53G7xQv9055906 for ; Wed, 16 Apr 2025 07:59:26 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 53G7xQUU055905 for wireless@FreeBSD.org; Wed, 16 Apr 2025 07:59:26 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 286063] net80211: isieee80211_sta_join() -> ieee80211_alloc_node() -> ieee80211_chan2mode() panic Date: Wed, 16 Apr 2025 07:59:26 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: wireless X-Bugzilla-Version: 15.0-CURRENT X-Bugzilla-Keywords: crash X-Bugzilla-Severity: Affects Only Me X-Bugzilla-Who: bz@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: wireless@FreeBSD.org X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-wireless List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-wireless@freebsd.org Sender: owner-freebsd-wireless@FreeBSD.org MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D286063 --- Comment #1 from Bjoern A. Zeeb --- I have another possible hint: for me ieee80211_ies_expand already failed; = and the 2nd STA goes kaboom on the channel in ddb (see very end) iwlwifi0: linuxkpi_ieee80211_connection_loss: vif 0xfffffe009ecebec0 vap 0xfffffe009eceb010 state AUTH ieee80211_ies_expand: malformed IEs! ies 0xfffffe009ed46068 { data 0xfffff800017f1e00 len 119 }: ie 222 len 2+192 > total len left 119 Fatal trap 9: general protection fault while in kernel mode cpuid =3D 2; apic id =3D 02 instruction pointer =3D 0x20:0xffffffff80cc4b00 stack pointer =3D 0x28:0xfffffe007bf889a8 frame pointer =3D 0x28:0xfffffe007bf88a30 code segment =3D base 0x0, limit 0xfffff, type 0x1b =3D DPL 0, pres 1, long 1, def32 0, gran 1 processor eflags =3D interrupt enabled, resume, IOPL =3D 0 current process =3D 357 (wpa_supplicant) rdi: c0dedeadc0dedead rsi: fffffe009ed462a5 rdx: 0000000000000001 rcx: 0000000000000011 r8: dedeadc0dedeadc0 r9: c0dedeadc0dedead rax: fffffe009ed46384 rbx: fffffe009eceb010 rbp: fffffe007bf88a30 r10: c0dedeadc0dedead r11: 000000000000002f r12: fffffe009ed46068 r13: fffffe009ed462a5 r14: fffffe009e09f000 r15: 0000000000000001 trap number =3D 9 panic: general protection fault cpuid =3D 2 time =3D 1744789360 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe007bf88= 720 vpanic() at vpanic+0x136/frame 0xfffffe007bf88850 panic() at panic+0x43/frame 0xfffffe007bf888b0 trap_fatal() at trap_fatal+0x68/frame 0xfffffe007bf888d0 calltrap() at calltrap+0x8/frame 0xfffffe007bf888d0 --- trap 0x9, rip =3D 0xffffffff80cc4b00, rsp =3D 0xfffffe007bf889a8, rbp = =3D 0xfffffe007bf88a30 --- ieee80211_chan2mode() at ieee80211_chan2mode/frame 0xfffffe007bf88a30 ieee80211_sta_join() at ieee80211_sta_join+0x256/frame 0xfffffe007bf88a80 ieee80211_ioctl_setmlme() at ieee80211_ioctl_setmlme+0xfc/frame 0xfffffe007bf88b10 ieee80211_ioctl_set80211() at ieee80211_ioctl_set80211+0x9ad/frame 0xfffffe007bf88b80 ieee80211_ioctl() at ieee80211_ioctl+0x2de/frame 0xfffffe007bf88be0 ifioctl() at ifioctl+0x973/frame 0xfffffe007bf88ce0 kern_ioctl() at kern_ioctl+0x286/frame 0xfffffe007bf88d40 sys_ioctl() at sys_ioctl+0x12f/frame 0xfffffe007bf88e00 amd64_syscall() at amd64_syscall+0x15a/frame 0xfffffe007bf88f30 fast_syscall_common() at fast_syscall_common+0xf8/frame 0xfffffe007bf88f30 --- syscall (54, FreeBSD ELF64, ioctl), rip =3D 0x2fa19ee23bfa, rsp =3D 0x2fa198cd2af8, rbp =3D 0x2fa198cd2b60 --- KDB: enter: panic [ thread pid 357 tid 100096 ] Stopped at kdb_enter+0x33: movq $0,0x105c922(%rip) db> show all vaps iwlwifi0: com 0xfffffe009e09f000 vaps: wlan0(0xfffffe009eceb010) db> show com /a 0xfffffe009e09f000 COM: 0xfffffe009e09f000: wlan0(0xfffffe009eceb010) softc 0xfffffe009ebbe200 name iwlwifi0 comlock 0xfffffe009e09f010 txlock 0xfffffe009e09f040 fflock 0xfffffe009e09f070 headroom 0 phytype 2 opmode STA inact 0xfffffe009e09f0d0 flags=3D42400 flags_ext=3D2480002 flags_ht=3D1080000 flags_ven=3D0 caps=3D581c001 cryptocaps=3D1a =20=20=20=20=20=20=20 htcaps=3D519ef =20=20=20=20=20=20=20 vhtcaps=3D39071f6 curmode 1 promisc 0 allmulti 0 nrunning 1 bintval 100 lintval 100 holdover 0 txpowlimit 100 nchans 207 curchan [5180 (36) flags=3D140 maxreg 17 maxpow 34 minpo= w 0 state 0x0 extieee 0] bsschan [5180 (36) flags=3D140 maxreg 17 maxpow 34 minpo= w 0 state 0x0 extieee 0] prevchan regdomain 0xfffffe009e0a4518 csa_newchan csa_count 0dfs 0xfffffe009e0a4548 scan 0xfffffe009ece7000 lastdata 2147424719 lastscan 2147425169 max_keyix 0 hash_key 0x595bc728 wme 0xfffffe009e0a57c8 stageq@0xfffffe009e0a5780: lock 0xfffffe009e0a5780 len 0 maxlen 0 drops 0 head 0 tail 0 station@0xfffffe009e0a5610: nodelock 0xfffffe009e0a5618 inact_init 2 keyixmax 0 keyixma= p 0 protmode 0 curhtprotmode 0x0 htprotmode 2 superg 0 montaps 0 th 0xfffffe009ebbe220 txchan 0xfffffe009ebbe22a rh 0xfffffe009ebbe230 rxchan 0xfffffe009ebbe242 ic_vap_create : lkpi_ic_vap_create ic_vap_delete : lkpi_ic_vap_delete ic_newassoc : 0 ic_getradiocaps : lkpi_ic_getradiocaps ic_setregdomain : null_setregdomain ic_send_mgmt : ieee80211_send_mgmt ic_raw_xmit : lkpi_ic_raw_xmit ic_updateslot : 0 ic_update_mcast : lkpi_ic_update_mcast ic_update_promisc : lkpi_ic_update_promisc ic_node_alloc : lkpi_ic_node_alloc ic_node_free : lkpi_ic_node_free ic_node_cleanup : lkpi_ic_node_cleanup ic_node_getrssi : node_getrssi ic_node_getsignal : node_getsignal ic_node_getmimoinfo : node_getmimoinfo ic_scan_start : lkpi_ic_scan_start ic_scan_end : lkpi_ic_scan_end ic_set_channel : lkpi_ic_set_channel ic_scan_curchan : lkpi_ic_scan_curchan ic_scan_mindwell : lkpi_ic_scan_mindwell ic_recv_action : lkpi_ic_recv_action ic_send_action : lkpi_ic_send_action ic_addba_request : lkpi_ic_addba_request ic_addba_response : lkpi_ic_addba_response ic_addba_stop : lkpi_ic_addba_stop SCAN 0xfffffe009ece7000: vap 0xfffffe009eceb010 ic 0xfffffe009e09f000 ss_ops 0xffffffff813730f0 (default) ss_priv 0xfffff80017356800 scan_attach : sta_attach scan_detach : sta_detach scan_start : sta_start scan_restart : sta_restart scan_cancel : sta_cancel scan_end : sta_pick_bss scan_flush : sta_flush scan_pickchan : 0 scan_add : sta_add scan_age : sta_age scan_assoc_fail : sta_assoc_fail scan_assoc_success : sta_assoc_success scan_iterate : sta_iterate scan_spare0 : 0 scan_spare1 : 0 scan_spare2 : 0 scan_spare3 : 0 ss_flags 42 ss_nssid 1 ss_nssid[0]"" ss_chans: ss_next 1 ss_last 0 ss_mindwell 2 ss_maxdwell 20 VAP 0xfffffe009eceb010: bss 0xfffffe009ecfa000 myaddr 74:13:ea:6e:de:c1 opmode STA state 0 INIT ifp 0xfffff80001956800(wlan0) ic 0xfffffe009e09f000 media 0xfffffe009eceb010 bpf_if 0xfffff8000194d200 mgtsend 0xfffffe009eceb4a0 iv_nstate 0 INIT iv_nstate_b 5 iv_nstate_n 0 [0] iv_nstates 0x2 AUTH _task 0xfffffe009eceb380 _args 192 [1] iv_nstates 0x3 ASSOC _task 0xfffffe009eceb3a0 _args 0 [2] iv_nstates 0x5 RUN _task 0xfffffe009eceb3c0 _args 16 [3] iv_nstates 0x2 AUTH _task 0xfffffe009eceb3e0 _args 4288 [4] iv_nstates 0 INIT _task 0xfffffe009eceb400 _args 0 [5] iv_nstates 0x5 RUN _task 0xfffffe009eceb420 _args 16 [6] iv_nstates 0x2 AUTH _task 0xfffffe009eceb440 _args 4288 [7] iv_nstates 0 INIT _task 0xfffffe009eceb460 _args 0 debug=3D10000000 flags=3D42842410 flags_ext=3D2480002 =20=20=20=20=20=20=20 flags_ht=3Dddba0000 flags_ven=3D0 caps=3D580c001 htcaps=3D519ef =20=20=20=20=20=20=20 vhtcap=3D39071f6 inact_init 2 inact_auth 12 inact_run 20 inact_probe 2 des_nssid 0 des_bssid 00:00:00:00:00:00 des_mode 0 des_chan bgscanidle 2500 bgscanintvl 30000 scanvalid 6000 scanreq_duration 0 scanreq_mindwell 0 scanreq_maxdwell 0 scanreq_flags 0x0 scanreq_nssid 0 roaming 2 roamparms[11a] rssi 7 rate 12 roamparms[11b] rssi 7 rate 1 roamparms[11g] rssi 7 rate 5 roamparms[11na] rssi 7 rate MCS1 roamparms[11ng] rssi 7 rate MCS1 roamparms[11ac] rssi 7 rate MCS1 bmissthreshold 7 bmiss_max 0 bmiss_max 2 swbmiss_count 4 swbmiss_period 0 swbmiss 0xfffffe009eceb600 ampdu_rxmax 0 ampdu_density 0 ampdu_limit 0 amsdu_limit 2048 max_aid 128 aid_bitmap 0 sta_assoc 0 ps_sta 0 ps_pending 0 tim_len 0 tim_bitmap 0 dtim_period 192 dtim_count 0 set_tim 0 csa_count 0 rtsthreshold 2346 fragthreshold 2346 inact_timer 0 txparms[11a] ucastrate mcastrate 6 mgmtrate 6 maxretry 6 txparms[11b] ucastrate mcastrate 1 mgmtrate 1 maxretry 6 txparms[11g] ucastrate mcastrate 1 mgmtrate 1 maxretry 6 txparms[11na] ucastrate mcastrate 6 mgmtrate 6 maxretry 6 txparms[11ng] ucastrate mcastrate 1 mgmtrate 1 maxretry 6 txparms[11ac] ucastrate mcastrate 6 mgmtrate 6 maxretry 6 appie_wpa [XXX] wpa_ie 0xfffffxxxx max_keyix 4 def_txkey 65535 nw_keys[0] NULL 65535:0-bit nw_keys[1] NULL 65535:0-bit nw_keys[2] NULL 65535:0-bit nw_keys[3] NULL 65535:0-bit auth 0xffffffff81372800(wlan_internal) ec 0 acl 0 as 0 sta_assoc 0 ht_sta_assoc 0 ht40_sta_assoc 0 nonerpsta 0 longslotsta 0 lastnonerp 0 lastnonht 0 iv_rate 0xffffffff8136f9b0 iv_rs 0xfffff8001802b070 ir_name amrr ir_attach : 0 ir_detach : 0 ir_init : amrr_init ir_deinit : amrr_deinit ir_node_init : amrr_node_init ir_node_deinit : amrr_node_deinit ir_rate : amrr_rate ir_tx_complete : amrr_tx_complete ir_tx_update : amrr_tx_update ir_setinterval : amrr_setinterval ir_node_stats : amrr_node_stats iv_key_alloc : null_key_alloc iv_key_delete : lkpi_iv_key_delete iv_key_set : lkpi_iv_key_set iv_key_update_begin : lkpi_iv_key_update_begin iv_key_update_end : lkpi_iv_key_update_end iv_opdetach : sta_vdetach iv_input : sta_input iv_recv_mgmt : sta_recv_mgmt iv_deliver_data : ieee80211_deliver_data iv_bmiss : sta_beacon_miss iv_reset : default_reset iv_update_beacon : null_update_beacon iv_newstate : lkpi_iv_newstate iv_output : ether_output STA: 0xfffffe009ecfa000: mac 74:13:ea:6e:de:c1 refcnt 2 vap 0xfffffe009eceb010 wdsvap 0 ic 0xfffffe009e09f000 table 0xfffffe009e0a5610 flags=3D0 authmode 1 ath_flags 0x0 ath_defkeyix 32767 associd 0x0 txpower 100 vlan 0 jointime 0 (16 secs) challenge 0 ies: data 0 len 0 [wpa_ie 0 rsn_ie 0 wme_ie 0 ath_ie 0 htcap_ie 0 htinfo_ie 0] vhtcap_ie 0 vhtopmode_ie 0 vhtpwrenv_ie 0] txseq 0 rxseq 0 fragno 0 rxfragstamp 0 rxfrag[0] 0 rxfrag[1] 0 rxfrag[2] 0 ucastkey NULL 65535:0-bit avgrssi 0x7f (rssi 1) noise 0 intval 100 capinfo 0 bssid 00:00:00:00:00:00 essid "" channel erp 0 dtim_period 0 dtim_count 0 htcap 0 htparam 0x0 htctlchan 0 ht2ndchan 0 htopmode 0x0 htstbc 0x0 chw 0 (BW_20) inact 2 inact_reload 2 txrate type 0 rate 0 meshid "" mlstate 0 mllid 0x0 mlpid 0x0 mlrcnt 0 mltval 0 vhtcap 0 vht_basicmcs 000000 vht_tx_map 000000 vht_mcsinfo: { rx_mcs_map 000000 rx_highest 000000 tx_mcs_map 000000 tx_highest 000000 } vht_chan1/chan2 0/0 vht_chanwidth 0000 vht_pad1 0000 vht_spare { 0 0 0 0 0 0 0 0 } ni_tx_superg[] =3D { 0 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,= } ni_rctls =3D 0 ni_drv_data =3D 0xfffff80001d78800 ni_spare[3] =3D { 0 0 0 } STA: 0xfffffe009ed46000: mac 9e:9d:7e:76:6f:fa refcnt 1 vap 0xfffffe009eceb010 wdsvap 0 ic 0xfffffe009e09f000 table 0xfffffe009e0a5610 flags=3D20000 authmode 1 ath_flags 0x0 ath_defkeyix 32767 associd 0x0 txpower 100 vlan 0 jointime 0 (16 secs) challenge 0 ies: data 0xfffff800017f1e00 len 119 [wpa_ie 0 rsn_ie 0 wme_ie 0 ath_ie 0 htcap_ie 0 htinfo_ie 0] vhtcap_ie 0 vhtopmode_ie 0 vhtpwrenv_ie 0] txseq 0 rxseq 0 fragno 0 rxfragstamp 0 rxfrag[0] 0 rxfrag[1] 0 rxfrag[2] 0 ucastkey NULL 65535:0-bit avgrssi 0x80 (rssi 1) noise -96 intval 100 capinfo 11 bssid 9e:9d:7e:76:6f:fa essid "SSID" channelKDB: reentering ^^^^ STA kaputt --=20 You are receiving this mail because: You are the assignee for the bug.=