Bug 297184 - LinuxKPI: do not rate-adjust a torn-down vap on tx completion
Summary: LinuxKPI: do not rate-adjust a torn-down vap on tx completion
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: 16.0-CURRENT
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-emulation (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2026-07-31 05:04 UTC by Kim Shrier
Modified: 2026-08-01 21:00 UTC (History)
0 users

See Also:

Attachments
guard call to ieee80211_ratectl_rate (709 bytes, patch)
2026-07-31 05:04 UTC, Kim Shrier 		no flags Details | Diff
guard call to ieee80211_ratectl_rate (916 bytes, patch)
2026-08-01 21:00 UTC, Mark Linimon 		no flags Details | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Kim Shrier 2026-07-31 05:04:17 UTC 
Created attachment 273336 [details]
guard call to ieee80211_ratectl_rate

linuxkpi_ieee80211_tx_status_ext() guards its rate-control work with "ni != NULL", but then dereferences one level deeper:

	ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0);

A tx completion can be delivered from the driver's NAPI/rx-completion thread after the vap has been destroyed, once net80211 has driven it to INIT and cleared iv_bss, while frames were still in flight.  The node itself is still referenced and valid, so the existing check passes and we fault on the NULL bss node:

    panic: page fault
    ieee80211_ratectl_rate (ni=0x0)
    linuxkpi_ieee80211_tx_status_ext
    ath10k_txrx_tx_unref / ath10k_htt_t2h_msg_handler
    ath10k_pci_napi_poll / lkpi_napi_task

Confirmed in the dump: ni and ni->ni_vap valid, iv_bss NULL, and iv_state already IEEE80211_S_INIT.
Comment 1 Mark Linimon freebsd_committer freebsd_triage 2026-08-01 21:00:54 UTC 
Created attachment 273385 [details]
guard call to ieee80211_ratectl_rate

^Triage: convert to git patch (now preferred).