Bug 203875 - Kernel panic when destroying wlan0 iwn 6205
Summary: Kernel panic when destroying wlan0 iwn 6205
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: wireless (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-wireless (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-10-19 18:15 UTC by tim
Modified: 2015-10-23 17:08 UTC (History)
0 users

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description tim 2015-10-19 18:15:30 UTC
Kernel panics when I do "ifconfig wlan0 destroy". running 11-CURRENT r289562 on a Thinkpad x220t. Panic happens both when wlan0 is part of lagg interface or when it is not.
 
Also wpa_supplicant won't work unless I wait for 10sec after creating the interface.

core.txt.1:

http://tim.tek42.de/core.txt.1

And I get this lock order reversal message when creating a lagg interface:

wlan0: Ethernet address: a0:88:b4:97:62:b8
Created wlan(4) interfaces: wlan0.
Created clone interfaces: lagg0.
iwn0: iwn_read_firmware: ucode rev=0x12a80601
lock order reversal:
lagg0: link state changed to DOWN
 1st 0xfffff80010f6fa08 if_lagg rmlock (if_lagg rmlock) @ /usr/src/sys/modules/if_lagg/../../net/if_lagg.c:1445
 2nd 0xfffff80010f73190 if_addr_lock (if_addr_lock) @ /usr/src/sys/modules/if_lagg/../../net/if_lagg.c:1549
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe046272f5f0
witness_checkorder() at witness_checkorder+0xe79/frame 0xfffffe046272f670
_rw_wlock_cookie() at _rw_wlock_cookie+0x6e/frame 0xfffffe046272f6b0
lagg_ether_cmdmulti() at lagg_ether_cmdmulti+0x5c/frame 0xfffffe046272f6f0
lagg_ioctl() at lagg_ioctl+0x1175/frame 0xfffffe046272f7d0
ifioctl() at ifioctl+0x10c6/frame 0xfffffe046272f860
kern_ioctl() at kern_ioctl+0x230/frame 0xfffffe046272f8c0
sys_ioctl() at sys_ioctl+0x17e/frame 0xfffffe046272f9a0
amd64_syscall() at amd64_syscall+0x2de/frame 0xfffffe046272fab0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe046272fab0
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x8011f316a, rsp = 0x7fffffffe3d8, rbp = 0x7fffffffe450 ---
iwn0: iwn_read_firmware: ucode rev=0x12a80601
lock order reversal:
 1st 0xfffff80010f6fa08 if_lagg rmlock (if_lagg rmlock) @ /usr/src/sys/modules/if_lagg/../../net/if_lagg.c:1498
 2nd 0xfffffe0000f576c0 em0 (EM Core Lock) @ /usr/src/sys/dev/e1000/if_em.c:1223
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe046272f010
witness_checkorder() at witness_checkorder+0xe79/frame 0xfffffe046272f090
__mtx_lock_flags() at __mtx_lock_flags+0xa4/frame 0xfffffe046272f0e0
em_ioctl() at em_ioctl+0x94/frame 0xfffffe046272f120
lagg_port_ioctl() at lagg_port_ioctl+0xde/frame 0xfffffe046272f190
if_addmulti() at if_addmulti+0x253/frame 0xfffffe046272f210
lagg_ether_cmdmulti() at lagg_ether_cmdmulti+0x158/frame 0xfffffe046272f250
lagg_ioctl() at lagg_ioctl+0xed/frame 0xfffffe046272f330
if_addmulti() at if_addmulti+0x253/frame 0xfffffe046272f3b0
in6_mc_join_locked() at in6_mc_join_locked+0x1a6/frame 0xfffffe046272f440
in6_joingroup() at in6_joingroup+0x75/frame 0xfffffe046272f480
in6_update_ifa() at in6_update_ifa+0x1228/frame 0xfffffe046272f620
in6_ifattach() at in6_ifattach+0x45a/frame 0xfffffe046272f7d0
ifioctl() at ifioctl+0xf2b/frame 0xfffffe046272f860
kern_ioctl() at kern_ioctl+0x230/frame 0xfffffe046272f8c0
sys_ioctl() at sys_ioctl+0x17e/frame 0xfffffe046272f9a0
amd64_syscall() at amd64_syscall+0x2de/frame 0xfffffe046272fab0
Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfffffe046272fab0
--- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x8011f316a, rsp = 0x7fffffffe448, rbp = 0x7fffffffe4a0 ---
Starting Network: lo0 em0 wlan0 lagg0.

-----------

/boot/loader.conf:

autoboot_delay="3"
zfs_load="YES"
i915kms_load="YES"
usb_quirk_load="YES"
kern.vty="vt"
hint.p4tcc.0.disabled=1
hint.p4tcc.1.disabled=1
hint.acpi_throttle.0.disabled=1
hint.acpi_throttle.1.disabled=1
kern.hz=100
drm.i915.enable_rc6=7
hint.ahcich.0.pm_level=5
hint.ahcich.1.pm_level=5
#hint.ehci.0.wake=1
#hint.ehci.1.wake=1
vfs.zfs.arc_max="8192M"
acpi_ibm_load="YES"
cuse4bsd_load="YES"
hint.psm.0.flags="0x3000"
hw.psm.synaptics_support=1


----------


root@xolotl:~ # uname -a
FreeBSD xolotl.youpr0n.org 11.0-CURRENT FreeBSD 11.0-CURRENT #0 r289562: Mon Oct 19 15:59:05 CEST 2015     root@xolotl.youpr0n.org:/usr/obj/usr/src/sys/GENERIC  amd64
Comment 1 tim 2015-10-23 17:08:46 UTC
Hi,

The wpa_supplicant not working unless waiting for 10secs after creating the wlan interface issue seems to be fixed in r289718

The kernel panic issue when destroying the wlan interface however does persist, not always though, when the system had been up for hours I have not been able to reproduce it at all, when I had just booted it, it crashed at every try.

Fatal trap 9: general protection fault while in kernel mode
cpuid = 0; apic id = 00
instruction pointer     = 0x20:0xffffffff80b3ff48
stack pointer           = 0x28:0xfffffe0460f20940
frame pointer           = 0x28:0xfffffe0460f20960
code segment            = base rx0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, long 1, def32 0, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 0 (iwn0 net80211 taskq)

Please excuse my English and many thanks
Tim Beikuefner