Bug 195937 - [urtwn] panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c
Summary: [urtwn] panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net8021...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: wireless (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Gleb Smirnoff
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-13 06:34 UTC by Dmitry Chagin
Modified: 2016-09-02 19:07 UTC (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dmitry Chagin freebsd_committer freebsd_triage 2014-12-13 06:34:27 UTC
get out usb urtwn device.


dchagin.static.corbina.net dumped core - see /var/crash/vmcore.1

Sat Dec 13 00:02:31 MSK 2014

FreeBSD dchagin.static.corbina.net 11.0-CURRENT FreeBSD 11.0-CURRENT #161 r275641+669d6a9(lemul): Tue Dec  9 17:40:17 MSK 2014     root@dchagin.static.corbina.net:/home/rootobj/home/dchagin/head/sys/YOY  amd64

panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c:1933

GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...

Unread portion of the kernel message buffer:
urtwn0: timeout waiting for MAC initialization
panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c:1933
cpuid = 6
KDB: enter: panic

Reading symbols from /boot/kernel/xhci.ko.symbols...done.
Loaded symbols for /boot/kernel/xhci.ko.symbols
Reading symbols from /boot/kernel/usb.ko.symbols...done.
Loaded symbols for /boot/kernel/usb.ko.symbols
Reading symbols from /boot/kernel/linprocfs.ko.symbols...done.
Loaded symbols for /boot/kernel/linprocfs.ko.symbols
Reading symbols from /boot/kernel/pseudofs.ko.symbols...done.
Loaded symbols for /boot/kernel/pseudofs.ko.symbols
Reading symbols from /boot/kernel/linux_common.ko.symbols...done.
Loaded symbols for /boot/kernel/linux_common.ko.symbols
Reading symbols from /boot/kernel/procfs.ko.symbols...done.
Loaded symbols for /boot/kernel/procfs.ko.symbols
Reading symbols from /boot/kernel/if_urtwn.ko.symbols...done.
Loaded symbols for /boot/kernel/if_urtwn.ko.symbols
#0  doadump (textdump=1015036432)
    at /home/dchagin/head/sys/kern/kern_shutdown.c:261
261		dumptid = curthread->td_tid;
(kgdb) #0  doadump (textdump=1015036432)
    at /home/dchagin/head/sys/kern/kern_shutdown.c:261
#1  0xffffffff803a45e8 in db_fncall_generic (addr=-2140153696, 
    rv=0xfffffe033c8039a0, nargs=0, args=0xfffffe033c8039b0)
    at /home/dchagin/head/sys/ddb/db_command.c:568
#2  0xffffffff803a42ba in db_fncall (dummy1=0, dummy2=0, 
    dummy3=-2199011875852, 
    dummy4=0xfffffe033c803a90 "ю:\200<\003ЧЪЪi0h\200\001")
    at /home/dchagin/head/sys/ddb/db_command.c:616
#3  0xffffffff803a3f34 in db_command (last_cmdp=0xffffffff810209a8, 
    cmd_table=0x0, dopager=1) at /home/dchagin/head/sys/ddb/db_command.c:440
#4  0xffffffff803a3b4d in db_command_loop ()
    at /home/dchagin/head/sys/ddb/db_command.c:493
#5  0xffffffff803a8138 in db_trap (type=3, code=0)
    at /home/dchagin/head/sys/ddb/db_main.c:251
#6  0xffffffff80759a5c in kdb_trap (type=3, code=0, tf=0xfffffe033c804130)
    at /home/dchagin/head/sys/kern/subr_kdb.c:654
#7  0xffffffff80bc1e31 in trap (frame=0xfffffe033c804130)
    at /home/dchagin/head/sys/amd64/amd64/trap.c:546
#8  0xffffffff80bc3508 in trap_check (frame=0xfffffe033c804130)
    at /home/dchagin/head/sys/amd64/amd64/trap.c:644
#9  0xffffffff80b97db2 in calltrap ()
    at /home/dchagin/head/sys/amd64/amd64/exception.S:231
#10 0xffffffff80759285 in breakpoint () at cpufunc.h:63
#11 0xffffffff80758ebf in kdb_enter (why=0xffffffff80cef26d "panic", 
    msg=0xffffffff80cef26d "panic")
    at /home/dchagin/head/sys/kern/subr_kdb.c:443
#12 0xffffffff806fe077 in vpanic (
    fmt=0xffffffff80cec4ae "mtx_lock() of destroyed mutex @ %s:%d", 
    ap=0xfffffe033c804350) at /home/dchagin/head/sys/kern/kern_shutdown.c:739
#13 0xffffffff806fda8c in kassert_panic (
    fmt=0xffffffff80cec4ae "mtx_lock() of destroyed mutex @ %s:%d")
    at /home/dchagin/head/sys/kern/kern_shutdown.c:634
#14 0xffffffff806db6de in __mtx_lock_flags (c=0xfffffe000348e850, opts=0, 
    file=0xffffffff80d11ff1 "/home/dchagin/head/sys/net80211/ieee80211_node.c", line=1933) at /home/dchagin/head/sys/kern/kern_mutex.c:214
#15 0xffffffff808c5a51 in ieee80211_node_table_reset (nt=0xfffffe000348e820, 
    match=0xfffff801528b4000)
    at /home/dchagin/head/sys/net80211/ieee80211_node.c:1933
#16 0xffffffff808c598c in ieee80211_node_vdetach (vap=0xfffff801528b4000)
    at /home/dchagin/head/sys/net80211/ieee80211_node.c:194
#17 0xffffffff8087ee84 in ieee80211_vap_detach (vap=0xfffff801528b4000)
    at /home/dchagin/head/sys/net80211/ieee80211.c:657
#18 0xffffffff816362ee in urtwn_vap_delete (vap=0xfffff801528b4000)
    at /home/dchagin/head/sys/modules/usb/urtwn/../../../dev/usb/wlan/if_urtwn.c:630
#19 0xffffffff808962b0 in wlan_clone_destroy (ifp=0xfffff8014f688800)
    at /home/dchagin/head/sys/net80211/ieee80211_freebsd.c:160
#20 0xffffffff8084f464 in ifc_simple_destroy (ifc=0xfffff80003db8280, 
    ifp=0xfffff8014f688800) at /home/dchagin/head/sys/net/if_clone.c:676
#21 0xffffffff8084f2cb in if_clone_destroyif (ifc=0xfffff80003db8280, 
    ifp=0xfffff8014f688800) at /home/dchagin/head/sys/net/if_clone.c:324
#22 0xffffffff8084f0c8 in if_clone_destroy (name=0xfffffe033c804880 "wlan0")
    at /home/dchagin/head/sys/net/if_clone.c:284
#23 0xffffffff80847b48 in ifioctl (so=0xfffff8000aa76000, cmd=2149607801, 
    data=0xfffffe033c804880 "wlan0", td=0xfffff8000a746000)
    at /home/dchagin/head/sys/net/if.c:2686
#24 0xffffffff8079c8c4 in soo_ioctl (fp=0xfffff8000a32d230, cmd=2149607801, 
    data=0xfffffe033c804880, active_cred=0xfffff8000a541c00, 
    td=0xfffff8000a746000) at /home/dchagin/head/sys/kern/sys_socket.c:222
#25 0xffffffff8078fdbc in fo_ioctl (fp=0xfffff8000a32d230, com=2149607801, 
    data=0xfffffe033c804880, active_cred=0xfffff8000a541c00, 
    td=0xfffff8000a746000) at file.h:319
#26 0xffffffff8078fc5d in kern_ioctl (td=0xfffff8000a746000, fd=3, 
    com=2149607801, data=0xfffffe033c804880 "wlan0")
    at /home/dchagin/head/sys/kern/sys_generic.c:809
#27 0xffffffff8078f8de in sys_ioctl (td=0xfffff8000a746000, 
    uap=0xfffffe033c804a58) at /home/dchagin/head/sys/kern/sys_generic.c:718
#28 0xffffffff80bc3f28 in syscallenter (td=0xfffff8000a746000, 
    sa=0xfffffe033c804a48) at subr_syscall.c:133
#29 0xffffffff80bc38df in amd64_syscall (td=0xfffff8000a746000, traced=0)
    at /home/dchagin/head/sys/amd64/amd64/trap.c:991
#30 0xffffffff80b9809b in Xfast_syscall ()
    at /home/dchagin/head/sys/amd64/amd64/exception.S:390
#31 0x00000008011c7efa in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
(kgdb)
Comment 1 Gleb Smirnoff freebsd_committer freebsd_triage 2015-06-12 16:09:07 UTC
Can't reproduce with this patch:

https://wiki.freebsd.org/projects/ifnet/net80211

I will close the bug once the patch makes it to head.
Comment 2 Andriy Voskoboinyk freebsd_committer freebsd_triage 2016-09-02 19:07:19 UTC
The patch ( https://wiki.freebsd.org/projects/ifnet/net80211 ) was merged in r287197; feel free to reopen if the panic will be reproduced again.