kern/178225: [bwn] kernel panic during high network activity

[Anatoly Borodin]

>Number:         178225
>Category:       kern
>Synopsis:       [bwn] kernel panic during high network activity
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Apr 28 20:40:00 UTC 2013
>Closed-Date:
>Last-Modified:
>Originator:     Anatoly Borodin
>Release:        9.1-STABLE
>Organization:
>Environment:
FreeBSD hp.home 9.1-STABLE FreeBSD 9.1-STABLE #0 r+aea715d: Fri Apr 26 01:33:44 CEST 2013     anatoly.borodin at gmail.com:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
The laptop: HP Compaq 6720s

The card:

siba_bwn0 at pci0:16:0:0:  class=0x028000 card=0x1371103c chip=0x431214e4 rev=0x02 hdr=0x00
    vendor     = 'Broadcom Corporation'
    device     = 'BCM4311 802.11a/b/g'
    class      = network

The source is from the git mirror, the most recent commit is https://github.com/freebsd/freebsd/commit/13435f0fc134223f50b51c26b7ea88b9049df465

#0  doadump (textdump=1) at pcpu.h:249
249     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump (textdump=1) at pcpu.h:249
#1  0xc0af0e32 in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:449
#2  0xc0af1125 in panic (fmt=<value optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:637
#3  0xc0f03b55 in trap_fatal (frame=0xe65f9958, eva=12)
    at /usr/src/sys/i386/i386/trap.c:1043
#4  0xc0f03c68 in trap_pfault (frame=0xe65f9958, usermode=0, eva=12)
    at /usr/src/sys/i386/i386/trap.c:895
#5  0xc0f05029 in trap (frame=0xe65f9958) at /usr/src/sys/i386/i386/trap.c:555
#6  0xc0eedb6c in calltrap () at /usr/src/sys/i386/i386/exception.s:169
#7  0xc0b53430 in m_copydata (m=0x0, off=32, len=8, cp=0xe65f9a58 "<C0><B7>*<C1>")
    at /usr/src/sys/kern/uipc_mbuf.c:812
#8  0xc0bd1f80 in ccmp_decap (k=0xc92330cc, m=0xc78fcd00, hdrlen=24)
    at /usr/src/sys/net80211/ieee80211_crypto_ccmp.c:565
#9  0xc0bd10a4 in ieee80211_crypto_decap (ni=0xc9233000, m=0xc78fcd00, 
    hdrlen=24) at /usr/src/sys/net80211/ieee80211_crypto.c:615
#10 0xc0c02c08 in sta_input (ni=0xc9233000, m=0xc78fcd00, rssi=45, nf=-62)
    at /usr/src/sys/net80211/ieee80211_sta.c:713
#11 0xc18a3250 in bwn_rxeof (mac=0xc78ea000, m=0xc78fcd00, 
    _rxhdr=<value optimized out>)
    at /usr/src/sys/modules/bwn/../../dev/bwn/if_bwn.c:9375
#12 0xc18a78cc in bwn_intrtask (arg=0xc78ea000, npending=1)
    at /usr/src/sys/modules/bwn/../../dev/bwn/if_bwn.c:8979
#13 0xc0b35642 in taskqueue_run_locked (queue=0xc78e4b40)
    at /usr/src/sys/kern/subr_taskqueue.c:312
#14 0xc0b3657c in taskqueue_thread_loop (arg=0xc6203ac0)
    at /usr/src/sys/kern/subr_taskqueue.c:501
#15 0xc0abce2f in fork_exit (callout=0xc0b364c0 <taskqueue_thread_loop>, 
    arg=0xc6203ac0, frame=0xe65f9d08) at /usr/src/sys/kern/kern_fork.c:988
#16 0xc0eedc14 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:276
>How-To-Repeat:
During high network usage, e.g. running torrents with multiple connections or sometimes browsing, the system crashes.

(I suppose it may be related to the number of connections, not the actual bit trate at the crash moment.)

It looks like the problem appeared in the last few month.
>Fix:
Unfortunately, I'm not that experienced in the kernel development to fix the problem by myself. The only thing I can see is that m_copydata() receives malformed struct mbuf*, but have no idea why.

I can provide the full crashdump info if you need.

>Release-Note:
>Audit-Trail:
>Unformatted: