From owner-freebsd-stable@FreeBSD.ORG Wed Apr 27 06:08:51 2011 Return-Path: Delivered-To: freebsd-stable@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0D7641065670 for ; Wed, 27 Apr 2011 06:08:51 +0000 (UTC) (envelope-from bschmidt@techwires.net) Received: from mail-fx0-f54.google.com (mail-fx0-f54.google.com [209.85.161.54]) by mx1.freebsd.org (Postfix) with ESMTP id A013D8FC12 for ; Wed, 27 Apr 2011 06:08:50 +0000 (UTC) Received: by fxm11 with SMTP id 11so1305931fxm.13 for ; Tue, 26 Apr 2011 23:08:49 -0700 (PDT) Received: by 10.223.57.86 with SMTP id b22mr514288fah.95.1303884529614; Tue, 26 Apr 2011 23:08:49 -0700 (PDT) Received: from jessie.localnet (p5B2ECEF3.dip0.t-ipconnect.de [91.46.206.243]) by mx.google.com with ESMTPS id t2sm116863faa.47.2011.04.26.23.08.44 (version=SSLv3 cipher=OTHER); Tue, 26 Apr 2011 23:08:45 -0700 (PDT) Sender: Bernhard Schmidt From: Bernhard Schmidt To: Gardner Bell Date: Wed, 27 Apr 2011 08:07:51 +0200 User-Agent: KMail/1.13.5 (Linux/2.6.32-31-generic; KDE/4.4.5; i686; ; ) References: In-Reply-To: MIME-Version: 1.0 Content-Type: Text/Plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Message-Id: <201104270807.51592.bschmidt@freebsd.org> Cc: freebsd-stable@freebsd.org Subject: Re: Fatal trap 12: page fault while in kernel mode X-BeenThere: freebsd-stable@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: bschmidt@freebsd.org List-Id: Production branch of FreeBSD source code List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 27 Apr 2011 06:08:51 -0000 On Tuesday, April 26, 2011 17:35:32 Gardner Bell wrote: > On Tue, Apr 26, 2011 at 04:25:26PM +0200, Bernhard Schmidt wrote: > > On Tuesday, April 26, 2011 15:15:45 Gardner Bell wrote: > > > On Tue, Apr 26, 2011 at 4:12 AM, Bernhard Schmidt wrote: > > > > On Tuesday, April 26, 2011 01:09:42 Gardner Bell wrote: > > > >> Downloading a torrent with many peers on a toshiba satellite notebook > > > >> using an Atheros AR5006 wireless nic caused the following panic. This > > > >> is an i386 system running 8.2-STABLE from around April 06. > > > > > > > > Can you reproduce that? > > > > > > So far I've not been able to reproduce this. > > > > Ok. I assume this only happens when loosing the connection and trying > > to re-associate. At least that is the only possible scenario I can > > think of where a timeout for mgmt frames is involved. Probably we > > aren't bumping a refcount correctly or something. Actually that sounds > > rather plausible as it panics exactly when trying to access ni which > > should, for a station, always point to iv_bss, which can in turn be > > free'd almost unconditionally if someone's telling net80211 to > > associate to another (or even the same) network. Hmm.. tracing refcount > > it is. > > > > Were you running wpa_supplicant at that point? Any messages before > > the panic happened? > > > > Yes, I'm running wpa_supplicant with the following settings: > > network={ > ssid="xxxxx" > psk="xxxxx" > } > > Other settings for the wireless card I have in rc.conf: > > wlans_ath0="wlan0" > ifconfig_wlan0="WPA DHCP" > ifconfig_wlan0_alias0="inet 192.168.0.12 netmask 0xffffffff" > > > The last messages seen on the console before the panic are wlan0: > ieee80211_new_state_locked: pending SCAN -> AUTH transition lost > and several UP/DOWN events. That's what I expected, thanks. I'll try to come up with something. -- Bernhard