[Bug 291012] iwlwifi: kernel panic on 'service netif restart' after connection lost

From: <bugzilla-noreply_at_freebsd.org>
Date: Fri, 14 Nov 2025 13:37:08 UTC
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=291012

            Bug ID: 291012
           Summary: iwlwifi: kernel panic on 'service netif restart' after
                    connection lost
           Product: Base System
           Version: 14.3-RELEASE
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: wireless
          Assignee: wireless@FreeBSD.org
          Reporter: vsasjason@gmail.com

Created attachment 265411
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=265411&action=edit
dmesg errors

I have the following network adapter:
iwlwifi0@pci0:3:0:0:    class=0x028000 rev=0x1a hdr=0x00 vendor=0x8086
device=0x2725 subvendor=0x8086 subdevice=0x0024
    vendor     = 'Intel Corporation'
    device     = 'Wi-Fi 6E(802.11ax) AX210/AX1675* 2x2 [Typhoon Peak]'
    class      = network
    cap 01[c8] = powerspec 3  supports D0 D3  current D0
    cap 05[d0] = MSI supports 1 message, 64 bit
    cap 10[40] = PCI-Express 2 endpoint max data 128(128) FLR RO NS
                 max read 128
                 link x1(x1) speed 5.0(5.0) ASPM L1(L1) ClockPM enabled
    cap 11[80] = MSI-X supports 16 messages, enabled
                 Table in map 0x10[0x2000], PBA in map 0x10[0x3000]
    ecap 0001[100] = AER 1 0 fatal 0 non-fatal 1 corrected
    ecap 0018[14c] = LTR 1
    ecap 001e[154] = L1 PM Substates 1

It connects to Mikrotik wAP ax, which has 5GHz 802.11ax 160MHz network
configured, but my system connects in 802.11ac 80MHz mode:
wlan0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
        options=0
        ether <REDACTED>
        inet 10.0.55.66 netmask 0xffffffc0 broadcast 10.0.55.127
        groups: wlan
        ssid "<REDACTED>" channel 112 (5560 MHz 11a vht/80-) bssid <REDACTED>
        regdomain ETSI country UA authmode WPA2/802.11i privacy ON
        deftxkey UNDEF AES-CCM 3:128-bit txpower 26 bmiss 7 mcastrate 6
        mgmtrate 6 scanvalid 60 -ampdutx ampdurx ampdulimit 64k
        -amsdutx amsdurx shortgi -ldpctx ldpcrx -uapsd vht vht40 vht80 vht160
        -vht80p80 wme roaming MANUAL
        parent interface: iwlwifi0
        media: IEEE 802.11 Wireless Ethernet autoselect mode 11ac
        status: associated
        nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>

Periodically system stops to send traffic for 30-60 seconds (often actually,
like even dozen times per day), then continues normally. But between couple of
weeks and a month being up, connection may go down with errors in kernel
messages (attached dmesg_errors). When this happens, 'service netif restart'
usually restores operation, however sometimes it results in panic:
Nov 14 13:58:08 jnb kernel: [2139599] rcx: 0000000000000000  r8:
0000000000000001  r9: 00000000000000b1
Nov 14 13:58:08 jnb kernel: [2139599] rax: fffff80006cec740 rbx:
0000000000000000 rbp: fffffe01929abd80
Nov 14 13:58:08 jnb kernel: [2139599] r10: fffff80001893000 r11:
ffffffff836830e0 r12: fffffe022956b000
Nov 14 13:58:08 jnb kernel: [2139599] r13: 0000000000000000 r14:
fffff80006cec740 r15: fffffe01946af480
Nov 14 13:58:08 jnb kernel: [2139599] trap number               = 12
Nov 14 13:58:08 jnb kernel: [2139599] panic: page fault
Nov 14 13:58:08 jnb kernel: [2139599] cpuid = 5
Nov 14 13:58:08 jnb kernel: [2139599] time = 1763120149
Nov 14 13:58:08 jnb kernel: [2139599] KDB: stack backtrace:
Nov 14 13:58:08 jnb kernel: [2139599] #0 0xffffffff80705b33 at
kdb_backtrace+0x63
Nov 14 13:58:08 jnb kernel: [2139599] #1 0xffffffff806c02bf at vpanic+0x15f
Nov 14 13:58:08 jnb kernel: [2139599] #2 0xffffffff806c0153 at panic+0x43
Nov 14 13:58:08 jnb kernel: [2139599] #3 0xffffffff80993802 at
trap_pfault+0x2d2
Nov 14 13:58:08 jnb kernel: [2139599] #4 0xffffffff8096d09e at calltrap+0x8
Nov 14 13:58:08 jnb kernel: [2139599] #5 0xffffffff8368f526 at
lkpi_iv_newstate+0x316
Nov 14 13:58:08 jnb kernel: [2139599] #6 0xffffffff8354c7be at
ieee80211_newstate_cb+0x12e
Nov 14 13:58:08 jnb kernel: [2139599] #7 0xffffffff8071a167 at
taskqueue_run_locked+0x167
Nov 14 13:58:08 jnb kernel: [2139599] #8 0xffffffff8071b072 at
taskqueue_thread_loop+0xb2
Nov 14 13:58:08 jnb kernel: [2139599] #9 0xffffffff8068b318 at fork_exit+0x78
Nov 14 13:58:08 jnb kernel: [2139599] #10 0xffffffff8096e08e at
fork_trampoline+0xe
Nov 14 13:58:08 jnb kernel: [2139599] Uptime: 24d18h19m59s

kgdb backtrace:
#0  __curthread () at /usr/src/sys/amd64/include/pcpu_aux.h:57
#1  doadump (textdump=<optimized out>) at /usr/src/sys/kern/kern_shutdown.c:405
#2  0xffffffff806bfe09 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:523
#3  0xffffffff806c0317 in vpanic (fmt=0xffffffff80a60e99 "%s",
ap=ap@entry=0xfffffe01929abc10) at /usr/src/sys/kern/kern_shutdown.c:967
#4  0xffffffff806c0153 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:891
#5  0xffffffff80993802 in trap_fatal (frame=<optimized out>, eva=<optimized
out>) at /usr/src/sys/amd64/amd64/trap.c:1000
#6  0xffffffff80993802 in trap_pfault (frame=0xfffffe01929abc70,
usermode=<optimized out>, signo=<optimized out>, ucode=<optimized out>)
#7  <signal handler called>
#8  lkpi_sta_auth_to_scan (vap=<optimized out>, nstate=<optimized out>,
arg=<optimized out>) at
/usr/src/sys/compat/linuxkpi/common/src/linux_80211.c:2364
#9  0xffffffff8368f526 in lkpi_iv_newstate (vap=0xfffffe022956b010,
nstate=IEEE80211_S_INIT, arg=<optimized out>) at
/usr/src/sys/compat/linuxkpi/common/src/linux_80211.c:3476
#10 0xffffffff8354c7be in ieee80211_newstate_cb (xvap=0xfffffe022956b010,
npending=<optimized out>) at /usr/src/sys/net80211/ieee80211_proto.c:2610
#11 0xffffffff8071a167 in taskqueue_run_locked
(queue=queue@entry=0xfffff8000674bc00) at
/usr/src/sys/kern/subr_taskqueue.c:518
#12 0xffffffff8071b072 in taskqueue_thread_loop (arg=<optimized out>) at
/usr/src/sys/kern/subr_taskqueue.c:830
#13 0xffffffff8068b318 in fork_exit (callout=0xffffffff8071afc0
<taskqueue_thread_loop>, arg=0xfffffe01946b3110, frame=0xfffffe01929abf40) at
/usr/src/sys/kern/kern_fork.c:1153
#14 <signal handler called>

-- 
You are receiving this mail because:
You are the assignee for the bug.