From owner-freebsd-current@FreeBSD.ORG Tue Jul 13 01:54:09 2010 Return-Path: Delivered-To: freebsd-current@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id EB60B106566C for ; Tue, 13 Jul 2010 01:54:09 +0000 (UTC) (envelope-from moonlightakkiy@yahoo.ca) Received: from web51801.mail.re2.yahoo.com (web51801.mail.re2.yahoo.com [206.190.38.232]) by mx1.freebsd.org (Postfix) with SMTP id A496D8FC08 for ; Tue, 13 Jul 2010 01:54:09 +0000 (UTC) Received: (qmail 29731 invoked by uid 60001); 13 Jul 2010 01:54:08 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.ca; s=s1024; t=1278986048; bh=RucMWKr8zZ+iKRVPv3e1DWSq9wdRUys474Hqo8wNciY=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Lgva5aUAUPiTmMgfkLGZr7r49XmRovLiuT2Q5oaUFk68WN2lT2FS9oDqAJNyCgZBfKT9PI4omaG7/zzROiDk0FDlzCZ/7gMq5KF7Tez2jusXVSvAW0vvq3Hvn7PvXYJhLzzapKZMMdNXETZHSQgkaAarvDBHfSeO07lRCr0lStk= DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.ca; h=Message-ID:X-YMail-OSG:Received:X-Mailer:References:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=aGstxQjgnPtjb6NaRbWX48nbjbkkDSK+rc9Glsp8F7nBuKQKWoIEq59roEr8LBGWeijzK1ZXFoAgnwYVcWk4CjxYPlL9t7Zedrmk3e8hY139fVvccGb/Z7t67gHHSzWdO1MXLH8VK4TuoLkh0mUIuo1/viFE4u3dOYDn4uwkYzY=; Message-ID: <768329.28397.qm@web51801.mail.re2.yahoo.com> X-YMail-OSG: 0aHUVxEVM1n1Uf5SdctRgxfkbbRjf0riYvKVYyKlmA7Yojv DeF2JAQ0eTWVEAuoRRfGxqEnYkE0UH7TS8zt1q0p5v5c4anaczPVMmp9BrAg dzFv6hc3w3AXboVUAFL8rYqwNReLW9RDQqIKLq7cgN2GL6XhjILA1GYqoGvu Y3zpFkzTUPOKw269WyTeJRUyoB311uZ.xEC34HTC.epXBLPYYtww2xMVxRWc peqsry412aG.674HP7ZQjivPcTWaVJ6J5aSY951mPlHOmTteO4qECKXXCwX5 UrwqMkRq5qL5gF5QN.vVO6VbViTcPLGwWMRLrelW3uDQ- Received: from [173.183.132.20] by web51801.mail.re2.yahoo.com via HTTP; Mon, 12 Jul 2010 18:54:08 PDT X-Mailer: YahooMailRC/420.4 YahooMailWebService/0.8.104.276605 References: <201007072113.16320.hselasky@c2i.net> <201007122201.11534.hselasky@c2i.net> Date: Mon, 12 Jul 2010 18:54:08 -0700 (PDT) From: PseudoCylon To: Hans Petter Selasky , freebsd-current@freebsd.org In-Reply-To: <201007122201.11534.hselasky@c2i.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Sam Leffler , freebsd-usb@freebsd.org Subject: Re: [panic] Race in IEEE802.11 layer towards device drivers X-BeenThere: freebsd-current@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Discussions about the use of FreeBSD-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Jul 2010 01:54:10 -0000 ----- Original Message ---- > From: Hans Petter Selasky > To: freebsd-current@freebsd.org > Cc: Andrew Thompson ; Sam Leffler ; >PseudoCylon ; freebsd-usb@freebsd.org > Sent: Mon, July 12, 2010 2:01:11 PM > Subject: Re: [panic] Race in IEEE802.11 layer towards device drivers > > Hi Andrew, > > Your patch appears to be working. Can you fix this issue in the other WLAN > drivers aswell? Then send an e-mail to request testing? I had a go at it here: > > http://p4web.freebsd.org/@@180844?ac=10 > Since I wasn't able to reproduce the panic, I can only confirm the patched run(4) driver runs OK. I just want to patch hostap related fix before calling for this test. I'll ask the user if it's fixed. Should the debugging code, usb_pause_mtx(), be left in the code for testing? If the drivers don't panic to begin with, we won't know the patch really fixed the issue. AK > I found another panic issue: > > ifconfig wlan0 delete > ifconfig wlan0 destroy > > When not associate or associated. > > Backtrace (AMD64 - 9-current): > > node_free() + 0x2c > rum_tx_free() + 0x3b > which is called from the bulk tx callback > > Another thread is running an IOCTL -> rum_stop(), which causes the CANCELLED > event to be passed to USB. Can't we free any nodes at this point? > > --HPS > > > This turned out to be refcounting of the ieee80211_node struct which > > was causing this panic. vap->iv_bss can be freed at any time so all > > users of it need to bump the refcount to use it safely. > > > > This patch should fix the panic in the rum driver. > > http://people.freebsd.org/~thompsa/rum_node_refcnt.diff > > > > There are other places where it is still an issue such as the > > ieee80211_tx_mgt_timeout callout which havnt been addressed yet, and > > of course all other ieee80211 drivers. > > >