Bug 297228 - rtw89 kernel panic with kernel modules
Summary: rtw89 kernel panic with kernel modules
Status: New
Alias: None
Product: Base System
Classification: Unclassified
Component: wireless (show other bugs)
Version: 15.1-RELEASE
Hardware: amd64 Any
: --- Affects Only Me
Assignee: Bjoern A. Zeeb
URL:
Keywords: crash
Depends on:
Blocks: 273621
  Show dependency tree / graph
 
Reported: 2026-08-02 04:47 UTC by Nanap
Modified: 2026-08-02 13:56 UTC (History)
1 user (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nanap 2026-08-02 04:47:29 UTC 
Hardware: Thinkpad l14 gen2 (i5)
Module: rtw8852AE
Options: INVARIANTS iNVARIANT_SUPPORT

I'm aware that another user has reported this problem, but I didn't see any entry about what the kernel returned to me, and it says "closed."

I tried adding the "INVARIANTS" and "INVARIANT_SUPPORT" options to my FreeBSD kernel, and what I got was a kernel panic with this message:

panic: Lock &wiphy->mtx not locked /usr/src/sys/kern/kern_sx.c:178
cpuid = 7
time = 1785616894
KDB: stack backtrace:
db_trace_self_wrapper() at 0xffffffff883f5c8b = db_trace_self_wrapper+0x2b/frame 0xfffffe01316217e0
vpanic() at 0xffffffff806576d6 = vpanic+0x136/frame 0xfffffe0131621918
panic() at 0xffffffff88657593 = panic+0x43/frame 0xfffffe0131621978
_sx_assert() at 0xffffffff8066208d = _sx_assert+0x11d/frame 0xfffffe0131621988
rtw89_ops_link_info_changed() at 0xffffffff8301233b = rtw89_ops_link_info_changed+0x3b/frame 0xfffffe01316219c0
1kpi_ic_vap_create() at 0xffffffff888b2eба = 1kpi_ic_vap_create+0xa2a/frame 0xfffffe0131621a50
wlan_clone_create() at 0xffffffff887d6e5d = wlan_clone_create+0xed/frame 0xfffffe0131621aa0
if_clone_createif_nl() at 0xffffffff88793e36 = if_clone_createif_nl+0x166/frame 0xfffffe0131621b18
ifc_create_ifp() at 0xffffffff88793cb2 = ifc_create_ifp+8x182/frame 0xfffffe0131621b88
if_clone_create() at 0xffffffff887948d4 = if_clone_create+0x34/frame 0xfffffe0131621bd0
ifioctl() at 0xffffffff887900c8 = ifioctl+0xc18/frame 0xfffffe0131621cd0
kern_ioctl() at 0xffffffff886ccb71 = kern_ioct1+0x2a1/frame 0xfffffe0131621d48
sys_loctl() at 0xffffffff886cc863 = sys_ioct1+0x133/frame 0xfffffe0131621e00 amd64_syscall() at 0xffffffff88a39299 = amd64_syscall+0x169/frame 0xfffffe0131621f30
fast_syscall_common() at 0xffffffff80a0dd9b = fast_syscall_common+8xf8/frame 0xfffffe0131621f30
syscall (54, FreeBSD ELF64, ioctl), rip = 0xf58e8d6926a, rsp = 0xf58e2284e98, rbp = 0xf58e2284ee0
KDB: enter: panic
[ thread pid 355 tid 180941 ]
Stopped at
0xffffffff886a4a43 = kdb_enter+0x33: movq
$0, 0xa6b3c2(Zrip)
db>

In addition, apparently because of this same issue with MTX, I occasionally experience DNS resolution problems, forcing me to perform a "service netif restart".
Comment 1 Bjoern A. Zeeb freebsd_committer freebsd_triage 2026-08-02 13:56:06 UTC 
The other problem got fixed in stable/15 after 15.1-RELEASE but this looks different.

It seems I forgot to push a change;  I'll go and find it and rebase.

The current code still has the
/* XXX-FINISH all callers for lockdep_assert_wiphy(hw->wiphy); */
which I know I did in a branch.

Thanks for reporting!