Date: Sat, 18 Nov 2017 00:29:16 -0500 From: Farhan Khan <khanzf@gmail.com> To: freebsd-hackers@freebsd.org Subject: Tracking down null pointer reference via kgdb Message-ID: <407cc5f0-fbd8-5e35-1f1d-2e34a5f8e219@gmail.com>
next in thread | raw e-mail | index | archive | help
Hi all,
I am working on a driver and getting a kernel panic in an unexpected
place. A quick kgdb shows me that the panic occurs at line #9, called by
rtwn_fw_loadpage. Looking up rtwn_fw_load shows a function pointer calle
that is essentially sc->sc_fw_write_block.
While this is where the bug triggers, I see that in line
r92ce_iq_calib_chain the sc pointer becomes 0x0. However, I have not
been able to trace down what caused this. Moreover, I traced the code,
but cannot even find a connection from r92ce_iq_calib_run (the calling
function) to r92ce_iq_calib_chain, where the sc variable appears to
become corrupted.
My printf debugging clearly shows that it is set at one point, but then
later becomes 0x0.
Is there a way to track this down, either in kgdb or ddb?
Thanks,
Farhan
-------------------
(kgdb) where
#0 __curthread () at ./machine/pcpu.h:232
#1 doadump (textdump=1) at /usr/src/sys/kern/kern_shutdown.c:318
#2 0xffffffff80a64d15 in kern_reboot (howto=260) at
/usr/src/sys/kern/kern_shutdown.c:386
#3 0xffffffff80a65306 in vpanic (fmt=<optimized out>,
ap=0xfffffe0119c49480)
at /usr/src/sys/kern/kern_shutdown.c:779
#4 0xffffffff80a65353 in panic (fmt=<unavailable>) at
/usr/src/sys/kern/kern_shutdown.c:710
#5 0xffffffff80ef0add in trap_fatal (frame=0xfffffe0119c49720, eva=0)
at /usr/src/sys/amd64/amd64/trap.c:799
#6 0xffffffff80ef0b52 in trap_pfault (frame=0xfffffe0119c49720,
usermode=0) at /usr/src/sys/amd64/amd64/trap.c:653
#7 0xffffffff80ef0315 in trap (frame=0xfffffe0119c49720) at
/usr/src/sys/amd64/amd64/trap.c:420
#8 <signal handler called>
#9 0x0000000000000000 in ?? ()
#10 0xffffffff82c23004 in rtwn_fw_loadpage (sc=0x0, buf=<optimized out>,
len=0, page=<optimized out>)
at /usr/src/sys/dev/rtwn/if_rtwn_fw.c:66
#11 rtwn_load_firmware (sc=<optimized out>) at
/usr/src/sys/dev/rtwn/if_rtwn_fw.c:182
#12 0xffffffff82c47c91 in r92ce_iq_calib_write_results (sc=0x0, tx=0x0,
rx=0xfffffe00092d9000,
chain=<optimized out>) at
/usr/src/sys/dev/rtwn/rtl8192c/pci/r92ce_calib.c:325
#13 0xffffffff82c474a3 in r92ce_iq_calib_chain (sc=0x0,
tx=0xfffffe0100c49a60, rx=0xfffffe01191fe000,
chain=<optimized out>) at
/usr/src/sys/dev/rtwn/rtl8192c/pci/r92ce_calib.c:117
#14 r92ce_iq_calib_run (sc=<optimized out>, n=<optimized out>,
tx=<optimized out>, rx=<optimized out>,
vals=<optimized out>) at
/usr/src/sys/dev/rtwn/rtl8192c/pci/r92ce_calib.c:225
#15 r92ce_iq_calib (sc=<optimized out>) at
/usr/src/sys/dev/rtwn/rtl8192c/pci/r92ce_calib.c:368
#16 0xffffffff82c47329 in r92ce_iq_calib_run (sc=<optimized out>,
n=<optimized out>, tx=<optimized out>,
rx=<optimized out>, vals=<optimized out>) at
/usr/src/sys/dev/rtwn/rtl8192c/pci/r92ce_calib.c:218
#17 r92ce_iq_calib (sc=0x219c49afc) at
/usr/src/sys/dev/rtwn/rtl8192c/pci/r92ce_calib.c:368
#18 0xffffffff80a29af9 in intr_event_execute_handlers (p=<optimized
out>, ie=0xfffff80004cce000)
at /usr/src/sys/kern/kern_intr.c:1336
#19 0xffffffff80a2a1e6 in ithread_execute_handlers (ie=<optimized out>,
p=<optimized out>)
at /usr/src/sys/kern/kern_intr.c:1349
#20 ithread_loop (arg=0xfffff80004cb7040) at
/usr/src/sys/kern/kern_intr.c:1430
#21 0xffffffff80a26ef4 in fork_exit (callout=0xffffffff80a2a130
<ithread_loop>, arg=0xfffff80004cb7040,
frame=0xfffffe0119c49c00) at /usr/src/sys/kern/kern_fork.c:1044
#22 <signal handler called>
-------------------
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?407cc5f0-fbd8-5e35-1f1d-2e34a5f8e219>