From owner-freebsd-bugs@FreeBSD.ORG Sun Nov 4 16:50:01 2007 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id A555316A41B for ; Sun, 4 Nov 2007 16:50:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 7851B13C49D for ; Sun, 4 Nov 2007 16:50:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.1/8.14.1) with ESMTP id lA4Go1tP067020 for ; Sun, 4 Nov 2007 16:50:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.1/8.14.1/Submit) id lA4Go1wV067019; Sun, 4 Nov 2007 16:50:01 GMT (envelope-from gnats) Resent-Date: Sun, 4 Nov 2007 16:50:01 GMT Resent-Message-Id: <200711041650.lA4Go1wV067019@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Christian Spiel Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E5E0116A4C4 for ; Sun, 4 Nov 2007 16:48:46 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id D397513C491 for ; Sun, 4 Nov 2007 16:48:46 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.1/8.14.1) with ESMTP id lA4GmacS005118 for ; Sun, 4 Nov 2007 16:48:36 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.1/8.14.1/Submit) id lA4GmalT005117; Sun, 4 Nov 2007 16:48:36 GMT (envelope-from nobody) Message-Id: <200711041648.lA4GmalT005117@www.freebsd.org> Date: Sun, 4 Nov 2007 16:48:36 GMT From: Christian Spiel To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/117820: rum related kernel panic X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 04 Nov 2007 16:50:01 -0000 >Number: 117820 >Category: kern >Synopsis: rum related kernel panic >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Nov 04 16:50:01 UTC 2007 >Closed-Date: >Last-Modified: >Originator: Christian Spiel >Release: 7.0-CURRENT >Organization: Vienna University of Technology >Environment: amd64 >Description: Using the rum driver with WPA enabled the kernel panics within a few minutes when downloading stuff. I have backtraced the problem using the coredump and kgdb. It shows that in if_rum.c at line 842 a null pointer dereference occurs. 842: if (data->m->m_flags & M_TXCB) 843: ieee80211_process_callback(data->ni, data->m, 844: status == USBD_NORMAL_COMPLETION ? 0 : ETIMEDOUT); data is NULL because the function rum_txeof was called with priv==NULL. >How-To-Repeat: Easily repeatable >Fix: I have added a check against null pointer in this function and it improves the stability of the system considerably although that is of course not the correct solution. >Release-Note: >Audit-Trail: >Unformatted: