From phk: .. ath0: <Atheros 5418> mem 0xf2500000-0xf250ffff irq 16 at device 0.0 on pci2 ath0: AR5418 mac 12.10 RF5133 phy 8.1 ath0: 2GHz radio: 0x0000; 5GHz radio: 0x00c0 .. wlan0: Ethernet address: 00:15:af:13:7c:5e ath0: ath_start: sc_inreset_cnt > 0; bailing drm0: <Mobile Intel® GM45 Express Chipset> on vgapci0 info: [drm] MSI enabled 1 message(s) info: [drm] AGP at 0xd0000000 256MB info: [drm] Initialized i915 1.6.0 20080730 wlan0: scan_task: OOPS! scan cancelled during driver call! ath0: ath_start: sc_inreset_cnt > 0; bailing ath0: ath_start: sc_inreset_cnt > 0; bailing ath0: ath_start: sc_inreset_cnt > 0; bailing ath0: ath_start: sc_inreset_cnt > 0; bailing ath0: ath_start: sc_inreset_cnt > 0; bailing ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA ath0: ath_start: sc_inreset_cnt > 0; bailing ath0: ath_start: sc_inreset_cnt > 0; bailing ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA ath0: ath_start: sc_inreset_cnt > 0; bailing ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA wlan0: link state changed to DOWN wlan0: link state changed to UP ath0: ath_start: sc_inreset_cnt > 0; bailing ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA ath0: ath_start: sc_inreset_cnt > 0; bailing ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA ath0: ath_start: sc_inreset_cnt > 0; bailing ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA ath0: ath_start: sc_inreset_cnt > 0; bailing ar5416PerCalibrationN: NF calibration didn't finish; delaying CCA ath0: ath_rx_proc: kickpcu; handled 94 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 38 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 2 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 3 packets ath0: ath_rx_proc: kickpcu; handled 3 packets ath0: ath_rx_proc: kickpcu; handled 2 packets ath0: ath_rx_proc: kickpcu; handled 1 packets .. ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 2 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 3 packets ath0: ath_rx_proc: kickpcu; handled 3 packets ath0: ath_rx_proc: kickpcu; handled 2 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 2 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets Memory modified after free 0xfffffe00064f1000(2048) val=2c4208 @ 0xfffffe00064f1000 Memory modified after free 0xfffffe0006523000(2048) val=2c4208 @ 0xfffffe0006523000 Memory modified after free 0xfffffe0088220000(2048) val=80 @ 0xfffffe0088220000 Memory modified after free 0xfffffe0006b25800(2048) val=2c4208 @ 0xfffffe0006b25800 ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 2 packets Memory modified after free 0xfffffe0006aef800(2048) val=2c4208 @ 0xfffffe0006aef800 ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets Memory modified after free 0xfffffe00064f1000(2048) val=80 @ 0xfffffe00064f1000 ath0: ath_rx_proc: kickpcu; handled 0 packets Memory modified after free 0xfffffe0065f8e000(2048) val=80 @ 0xfffffe0065f8e000 ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets Memory modified after free 0xfffffe000653a000(2048) val=80 @ 0xfffffe000653a000 ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 0 packets Memory modified after free 0xfffffe0065fae000(2048) val=80 @ 0xfffffe0065fae000 Memory modified after free 0xfffffe000655a800(2048) val=80 @ 0xfffffe000655a800 ath0: ath_rx_proc: kickpcu; handled 1 packets Memory modified after free 0xfffffe000656f800(2048) val=80 @ 0xfffffe000656f800 ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets Memory modified after free 0xfffffe0006ae5000(2048) val=80 @ 0xfffffe0006ae5000 ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets Memory modified after free 0xfffffe0006b1d800(2048) val=80 @ 0xfffffe0006b1d800 ath0: ath_rx_proc: kickpcu; handled 1 packets ath0: ath_rx_proc: kickpcu; handled 0 packets Fix: Not sure yet. It could be a few things: * Are we somehow running multiple RX procs? (eg with rx + reset.) * is the hardware still DMAing stuff (eg from the FIFO) even once the RXEOL is posted? Even after stoppcurecv/stoprecvdma is called? How-To-Repeat: Not sure yet.
Responsible Changed From-To: freebsd-bugs->freebsd-wireless Over to maintainer(s).
batch change: For bugs that match the following - Status Is In progress AND - Untouched since 2018-01-01. AND - Affects Base System OR Documentation DO: Reset to open status. Note: I did a quick pass but if you are getting this email it might be worthwhile to double check to see if this bug ought to be closed.