Bug 278655 - net80211: psq cleanup bug
Summary: net80211: psq cleanup bug
Status: Open
Alias: None
Product: Base System
Classification: Unclassified
Component: wireless (show other bugs)
Version: 14.0-RELEASE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: freebsd-wireless (Nobody)
URL:
Keywords:
Depends on:
Blocks: 277512
  Show dependency treegraph
 
Reported: 2024-04-30 04:12 UTC by Vladimir Grbić
Modified: 2024-05-07 15:46 UTC (History)
3 users (show)

See Also:


Attachments
Image showing the output. (609.31 KB, image/jpeg)
2024-04-30 04:12 UTC, Vladimir Grbić
no flags Details
After running my "panic.sh" script several times I hit the cb run after lock is destroyed. (88.00 KB, text/plain)
2024-05-07 15:46 UTC, Doug Ambrisko
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Vladimir Grbić 2024-04-30 04:12:38 UTC
Created attachment 250296 [details]
Image showing the output.

I installed FreeBSD 14.0 RELEASE on my Geekom Mini IT 12 (specs: https://www.geekompc.com/geekom-mini-it12-mini-pc/) using only the wired connection. Post installation, I updated everything to the latest repository branch and was able to set up the wireless connection following this guide:

https://docs.freebsd.org/en/books/handbook/network/#network-wireless

However, I am experiencing something weird. Once I set it up, if I am to run `# service netif restart`, the service does restart but I get that message about "Fatal trap 12: page fault while in kernel mode..." and when dumping is done (gets to 100%), the system reboots. (See the attached image.)

Also, it might be worth noting that the speeds I was getting were a lot slower than my other devices on the same network. Most of my WiFi devices had about 300 Mbps up and down. On that mini pc, I was getting only 30 up and 15 down.

From a little digging and a conversation with people who have more experience, my guess is that the psq handler was destroyed by ieee80211_psq_cleanup called in node_free. But, ieee80211_node_psq_drain tried to get a reference to this handler.

File of interest: sys/net80211/ieee80211_power.c
Comment 1 Bjoern A. Zeeb freebsd_committer freebsd_triage 2024-05-02 20:27:19 UTC
I've had a private report from Doug about this a few weeks ago and had a quick look based on his findings.

For him it happened with suspend/resume and another worksround helped to sort it out there for now.

I had asked him to open a PR to track this in the end as I didn't have the time to sort it out on the spot.  @ambrisko maybe you can add all your debugging/tracing to here?
Comment 2 Adrian Chadd freebsd_committer freebsd_triage 2024-05-02 21:58:41 UTC
oh lord, the psq / node bug stuff again. I recognise this stuff :(
Comment 3 Adrian Chadd freebsd_committer freebsd_triage 2024-05-02 21:58:47 UTC
oh lord, the psq / node bug stuff again. I recognise this stuff :(
Comment 4 Doug Ambrisko freebsd_committer freebsd_triage 2024-05-07 15:46:46 UTC
Created attachment 250517 [details]
After running my "panic.sh" script several times I hit the cb run after lock is destroyed.

The script I use to trigger the panic is
#!/bin/sh

set -x 

sync; sync; sync
sudo /bin/echo || exit 1

sudo /etc/rc.d/dhclient stop wlan0
sudo /etc/rc.d/wpa_supplicant stop wlan0
sleep 1
sudo killall -9 wpa_supplicant
sleep 2
sudo ifconfig wlan0 destroy
if kldstat | grep iwlwifi
then
        sudo devctl detach `pciconf -l | awk '/iwlwifi/ { print $1 }' | sed -e 's/:$//' -e 's/^.*@//'`
fi
sudo kldunload if_iwlwifi.ko 
sudo kldload if_iwlwifi.ko
sudo ifconfig wlan0 create wlandev iwlwifi0 wlanmode sta regdomain FCC country US
sleep 1
sudo /etc/rc.d/wpa_supplicant restart wlan0
sleep 1
ifconfig wlan0
sleep 1
ifconfig wlan0
sleep 10

It doesn't happen every time.  I added debug printf's to trace where the call back gets registered and run after the lock is destroyed.

I've also seen what appears to be leaking in that the init for the psq lock is called more then the clean up.  I don't have that printf enabled in this log.