Panic with wlan when switching from adhoc to infrastructure

[Kostik Belousov]

On the up-to-date RELENG_7 system, I have configured ath0 in the adhoc
mode. After that, I tried to switch the interface into the hostap
mode. I got the consistent error message "Interface not
configured". After several attempts, I got the following page fault.
The second argument to the ieee80211_ht_adjust_channel, chan, is NULL.

Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x0
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc2ed21c8
stack pointer           = 0x28:0xd5da4a18
frame pointer           = 0x28:0xd5da4a28
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 1418 (ifconfig)
trap number             = 12
panic: page fault
KDB: stack backtrace:
db_trace_self_wrapper(c06f679d,d5da48ac,c04b8a1a,c06f4b26,c0759780,...) at 0xc044b256 = db_trace_self_wrapper+0x26
kdb_backtrace(c06f4b26,c0759780,c06edbd0,d5da48b8,d5da48b8,...) at 0xc04de839 = kdb_backtrace+0x29
panic(c06edbd0,c0711148,c34e2220,1,1,...) at 0xc04b8a1a = panic+0xaa
trap_fatal(c31e9bc8,0,1,0,18d5,...) at 0xc06cce33 = trap_fatal+0x353
trap_pfault(369e99,0,c34e2000,0,c,...) at 0xc06cd09b = trap_pfault+0x25b
trap(d5da49d8) at 0xc06cdac2 = trap+0x3d2
calltrap() at 0xc06b664b = calltrap+0x6
--- trap 0xc, eip = 0xc2ed21c8, esp = 0xd5da4a18, ebp = 0xd5da4a28 ---
ieee80211_ht_adjust_channel(c2f4e22c,0,2,533,2,...) at 0xc2ed21c8 = ieee80211_ht_adjust_channel+0x38
adhoc_pick_bss(c2eee000,c2f4e22c,c2ed7538,1ec,c2f2b2a7,...) at 0xc2ef8f6f = adhoc_pick_bss+0x1ff
ieee80211_check_scan(c2f4e22c,10002,7fffffff,1,c2f4f210,...) at 0xc2ed06c4 = ieee80211_check_scan+0x244
ieee80211_newstate(c2f4e22c,1,ffffffff,0,d5da4b10,...) at 0xc2ecef08 = ieee80211_newstate+0x508
ath_init(c2f4e000,0,c2f1300c,16dd,c35448e0,...) at 0xc2f0cb86 = ath_init+0x1a6
ath_ioctl(c29cdc00,80206910,c35448e0,c334e708,d5da4b8c,...) at 0xc2f118d8 = ath_ioctl+0x138
ifhwioctl(c34e1210,c330a18c,c10be238,c10416c8,85,...) at 0xc0548c97 = ifhwioctl+0x417
ifioctl(c330a18c,80206910,c35448e0,c34e1210,3,...) at 0xc054bb1c = ifioctl+0x3bc
soo_ioctl(c2b0baf8,80206910,c35448e0,c3340500,c34e1210,...) at 0xc04f20f2 = soo_ioctl+0x5a2
kern_ioctl(c34e1210,3,80206910,c35448e0,8cbc,...) at 0xc04eac91 = kern_ioctl+0x351
ioctl(c34e1210,d5da4cfc,c,d5da4cb0,c06d786e,...) at 0xc04eadff = ioctl+0x13f
syscall(d5da4d38) at 0xc06cd425 = syscall+0x365
Xint0x80_syscall() at 0xc06b66b0 = Xint0x80_syscall+0x20
--- syscall (54, FreeBSD ELF32, ioctl), eip = 0x281697f3, esp = 0xbfbfe44c, ebp = 0xbfbfe488 ---
Uptime: 55m50s

(gdb) list *(ieee80211_ht_adjust_channel+0x38)
0x211c8 is in ieee80211_ht_adjust_channel (/usr/bsd/src/sys/modules/wlan/../../net80211/ieee80211_ht.c:818).
813                     } else if (!IEEE80211_IS_CHAN_HT20(chan)) {
814                             c = findhtchan(ic, chan, IEEE80211_CHAN_HT20);
815                             if (c != NULL)
816                                     chan = c;
817                     }
818             } else if (IEEE80211_IS_CHAN_HT(chan)) {
819                     /* demote to legacy, HT use is disabled */
820                     c = ieee80211_find_channel(ic, chan->ic_freq,
821                         chan->ic_flags &~ IEEE80211_CHAN_HT);
822                     if (c != NULL)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 187 bytes
Desc: not available
Url : http://lists.freebsd.org/pipermail/freebsd-net/attachments/20071125/81100688/attachment.pgp