kern/132889: NDIS kernel crash on load BCM4321 AGN driver

[Miroslav Drbal]

>Number:         132889
>Category:       kern
>Synopsis:       NDIS kernel crash on load BCM4321 AGN driver
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sat Mar 21 01:40:00 UTC 2009
>Closed-Date:
>Last-Modified:
>Originator:     Miroslav Drbal
>Release:        7.2-PRERELEASE
>Organization:
Student
>Environment:
FreeBSD killer 7.2-PRERELEASE FreeBSD 7.2-PRERELEASE #2: Fri Mar 20 15:53:26 CET 2009     apoc at killer:/usr/obj/usr/src/sys/KILLER  i386

>Description:
Crash on kldload ndis driver for Broadcom 4321 AGN wireless card.

DUMP:
#0  doadump () at pcpu.h:196
#1  0xc07bb998 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:418
#2  0xc07bbc75 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:574
#3  0xc0a275e4 in trap_fatal (frame=0xea5d7810, eva=60)
    at /usr/src/sys/i386/i386/trap.c:939
#4  0xc0a27855 in trap_pfault (frame=0xea5d7810, usermode=0, eva=60)
    at /usr/src/sys/i386/i386/trap.c:852
#5  0xc0a281dd in trap (frame=0xea5d7810) at /usr/src/sys/i386/i386/trap.c:530
#6  0xc0a0d9ab in calltrap () at /usr/src/sys/i386/i386/exception.s:159
#7  0xc07ed24a in taskqueue_drain (queue=0x0, task=0xc73b05a0)
    at /usr/src/sys/kern/subr_taskqueue.c:299
#8  0xc168259f in ndis_detach (dev=0xc5e8d280)
    at /usr/src/sys/modules/if_ndis/../../dev/if_ndis/if_ndis.c:1017
#9  0xc16828ec in ndis_attach (dev=0xc5e8d280)
    at /usr/src/sys/modules/if_ndis/../../dev/if_ndis/if_ndis.c:975
#10 0xc1686432 in ndis_attach_pci (dev=0xc5e8d280)
    at /usr/src/sys/modules/if_ndis/../../dev/if_ndis/if_ndis_pci.c:330
#11 0xc07e0546 in device_attach (dev=0xc5e8d280) at device_if.h:178
#12 0xc07e1449 in device_probe_and_attach (dev=0xc5e8d280)
    at /usr/src/sys/kern/subr_bus.c:2366
#13 0xc0688a1f in pci_driver_added (dev=0xc5e8d300, driver=0xc73ae5a8)
    at /usr/src/sys/dev/pci/pci.c:2778
#14 0xc07df4c0 in devclass_add_driver (dc=0xc5c85880, driver=0xc73ae5a8)
---Type <return> to continue, or q <return> to quit---
    at bus_if.h:183
#15 0xc07e011c in driver_module_handler (mod=0xc70f5d80, what=0,
    arg=0xc73ae594) at /usr/src/sys/kern/subr_bus.c:3847
#16 0xc07ad5c6 in module_register_init (arg=0xc73ae534)
    at /usr/src/sys/kern/kern_module.c:124
#17 0xc07a6ab4 in linker_load_module (kldname=Variable "kldname" is not available.
)
    at /usr/src/sys/kern/kern_linker.c:232
#18 0xc07a6fad in kern_kldload (td=0xc66c2460,
    file=0xc5e18000 "./bcmwl5_sys.ko", fileid=0xea5d7c70)
    at /usr/src/sys/kern/kern_linker.c:1000
#19 0xc07a707f in kldload (td=0xc66c2460, uap=0xea5d7cfc)
    at /usr/src/sys/kern/kern_linker.c:1027
#20 0xc0a27b96 in syscall (frame=0xea5d7d38)
    at /usr/src/sys/i386/i386/trap.c:1090
#21 0xc0a0da10 in Xint0x80_syscall () at /usr/src/sys/i386/i386/exception.s:255
#22 0x00000033 in ?? ()

>How-To-Repeat:
Driver downloaded here: http://www.wireless-driver.com/driver/broadcom/Broadcom.4321.802.11n.rar

ndisgen bcmwl5.inf bcmwl5.sys
kldload ./bcmwl5_sys.ko

kernel crash.
>Fix:


>Release-Note:
>Audit-Trail:
>Unformatted: