From owner-freebsd-bugs@FreeBSD.ORG Tue Sep 8 13:50:01 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0EAD51065672 for ; Tue, 8 Sep 2009 13:50:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id D9F9D8FC16 for ; Tue, 8 Sep 2009 13:50:00 +0000 (UTC) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id n88Do01P074745 for ; Tue, 8 Sep 2009 13:50:00 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id n88Do0Rh074744; Tue, 8 Sep 2009 13:50:00 GMT (envelope-from gnats) Resent-Date: Tue, 8 Sep 2009 13:50:00 GMT Resent-Message-Id: <200909081350.n88Do0Rh074744@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Paul Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 1E3BB106568D for ; Tue, 8 Sep 2009 13:45:09 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 0DDD58FC14 for ; Tue, 8 Sep 2009 13:45:09 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id n88Dj88j014357 for ; Tue, 8 Sep 2009 13:45:08 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id n88Dj8KY014353; Tue, 8 Sep 2009 13:45:08 GMT (envelope-from nobody) Message-Id: <200909081345.n88Dj8KY014353@www.freebsd.org> Date: Tue, 8 Sep 2009 13:45:08 GMT From: Paul To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/138632: race at vap destroy X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 08 Sep 2009 13:50:01 -0000 >Number: 138632 >Category: kern >Synopsis: race at vap destroy >Confidential: no >Severity: critical >Priority: high >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Tue Sep 08 13:50:00 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Paul >Release: FreeBSD 9.0-CURRENT >Organization: >Environment: FreeBSD dhcppc3 9.0-CURRENT FreeBSD 9.0-CURRENT #2 r196918M: Mon Sep 7 22:22:16 UTC 2009 root@dhcppc3:/usr/obj/usr/src/sys/kernel i386 >Description: Regression introduced with ndisulator being ported to VAP. ndis_scan function may be started after ndis vap have been destroyed. db:0:kdb.enter.unknown> bt Tracing pid 11 tid 100005 td 0xc3d07690 ieee80211_scan_done(0,c05e3712,f8,0,c3d07690,...) at ieee80211_scan_done+0xb ndis_scan(c4642800,0,c061e422,176,c068c974,...) at ndis_scan+0x38d softclock(c068c940,c3aa7cc8,c049873d,c0690680,c3d03938,...) at softclock+0x242 intr_event_execute_handlers(c3d05aa0,c3d03900,c06188e0,4fc,c3d03970,...) at intr_event_execute_handlers+0x10f ithread_loop(c3d49110,c3aa7d38,c0618636,343,c3d05aa0,...) at ithread_loop+0x98 fork_exit(c0483f41,c3d49110,c3aa7d38) at fork_exit+0xb8 fork_trampoline() at fork_trampoline+0x8 --- trap 0, eip = 0, esp = 0xc3aa7d70, ebp = 0 --- >How-To-Repeat: # ifconfig wlan0 create wlandev ndis0 # ifconfig wlan0 up && ifconfig wlan0 destroy >Fix: --- if_ndis.c (revision 196964)+++ if_ndis.c (working copy) @@ -1012,7 +1012,12 @@ ndis_vap_delete(struct ieee80211vap *vap) { struct ndis_vap *nvp = NDIS_VAP(vap); + struct ieee80211com *ic = vap->iv_ic; + struct ifnet *ifp = ic->ic_ifp; + struct ndis_softc *sc = ifp->if_softc; + ndis_stop(sc); + callout_drain(&sc->ndis_scan_callout); ieee80211_vap_detach(vap); free(nvp, M_80211_VAP); } >Release-Note: >Audit-Trail: >Unformatted: