Bug 263505 - vlan on wlan kernel panic
Summary: vlan on wlan kernel panic
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-wireless (Nobody)
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2022-04-24 01:22 UTC by Craig Leres
Modified: 2023-05-10 14:38 UTC (History)
6 users (show)

See Also:


Attachments
kernel stack trace (2.21 KB, text/plain)
2022-04-24 01:22 UTC, Craig Leres
no flags Details
ifconfig vlan fix (399 bytes, patch)
2022-04-24 15:17 UTC, Robert Wing
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Craig Leres freebsd_committer freebsd_triage 2022-04-24 01:22:15 UTC
Created attachment 233427 [details]
kernel stack trace

A friend (Jeff Anton) reported a kernel crash when trying to configure a vlan on a wlan interface under 13.0. I did some testing with a spare amd64 box and was able to reproduce the crash with both 13.1-RC4 and 12.3-RELEASE-p5.

The rc.conf from my test setup looks like this:

    hostname="test.alameda.xse.com"
    sshd_enable="YES"
    dumpdev="AUTO"
 
    keymap="us.ctrl"
 
    wlans_iwn0="wlan0"
    ifconfig_wlan0="WPA SYNCDHCP"
 
    vlans_wlan0="vlan0"
    create_args_vlan0="vlan 1234"
 
    wpa_supplicant="YES"

(This assumes a valid wpa_supplicant.conf.)

After booting and successfully joining wifi issuing:

    ifconfig vlan0 192.168.1.1 

results in a "page fault while in kernel mode" panic. Kernel stack trace attached (13.1-RC4).
Comment 1 Robert Wing freebsd_committer freebsd_triage 2022-04-24 15:17:32 UTC
Created attachment 233451 [details]
ifconfig vlan fix

The vlan driver is calling ieee80211_output() with the wrong ifnet context and dereferencing a bad pointer.

It looks like the passed in if_softc is pointing to a struct ifvlan instead of the expected struct ieee80211_vap

Looking at vlan_output(), I wonder if the parents ifnet context should be used when calling if_output()?

I've attached a patch to show what I mean.
Comment 2 Craig Leres freebsd_committer freebsd_triage 2022-04-24 17:17:01 UTC
I tested your patch with 12.3-RELEASE-p5 and was able to set an address on vlan0.
Comment 3 Ed Maste freebsd_committer freebsd_triage 2023-05-10 14:38:32 UTC
For context see:
16cf6bdbb6cb https://reviews.freebsd.org/D21209
c7cffd65c5d8 https://reviews.freebsd.org/D26436