Date: Mon, 2 Nov 2015 22:17:17 -0800 From: Adrian Chadd <adrian@freebsd.org> To: Andriy Voskoboinyk <avos@freebsd.org> Cc: "freebsd-wireless@freebsd.org" <freebsd-wireless@freebsd.org>, Mark Felder <feld@freebsd.org> Subject: Re: bridge/wifi panic Message-ID: <CAJ-VmokVzGxK-MfN9XMHYJ=Hj1pF5mNkYoMoCOLueKAMQRSvHw@mail.gmail.com> In-Reply-To: <CAJ-Vmom4BP9XKGHS=qXK2p_Mg3aapOtVtbUVsOFRwpdgM%2BTRug@mail.gmail.com> References: <1446174922.809135.424262409.16BCE412@webmail.messagingengine.com> <CAJ-Vmon-kwdeG2nVRGMoKBE654o0Yx8G8UB9=E6%2Ba=XyvDNrmg@mail.gmail.com> <BEB3A1D6-B877-4C65-B66E-9EFA39E2912C@FreeBSD.org> <CAJ-Vmo=exW_kmX0tnjQ81o8HxgJvG=5KtWf%2B3cQeAFteLPgtHw@mail.gmail.com> <A6634DC8-90CB-40C1-8B93-747E6AAC4A3D@FreeBSD.org> <CAJ-VmonrCfB_6jvFLMrJ6fD4ma=f8mHNmhQhum86wOPmzTNdoA@mail.gmail.com> <1446474203.3014685.426732569.13D78488@webmail.messagingengine.com> <CAJ-VmokBbh6Uh6FOaKhKPH_FxbNcHu7EdxP1SSh1ZzeQKqda_Q@mail.gmail.com> <op.x7hcb1o54dikkl@localhost> <CAJ-Vmo=uZbErxRudyoq6B7AG=SRb_PmoTQ4cD8-uhVPFHzbOEQ@mail.gmail.com> <CAJ-Vmo=tc%2BHvcLAVe_APVFkLUs76SmhpYJiPZT7BAyL5Jin-EQ@mail.gmail.com> <CAJ-Vmo=LgSeD%2BViEYdp4D2kBqQ=1KNOSnTTke9SqzkgJLtEHaw@mail.gmail.com> <op.x7hwb5kl4dikkl@localhost> <CAJ-Vmom4BP9XKGHS=qXK2p_Mg3aapOtVtbUVsOFRwpdgM%2BTRug@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Ok, I've dug into it a bit more. The root bits here were more exposed from the ifnet changes that were made, but the TL;DR is that if the driver starts to transmit the frame and fails, we can't return an error. We have to free the buffer ourselves. So for ath, and maybe iwn too, we can't return an error if we decide to start encapsulating the frame. That's the point where the mbuf may change. For something like "interface is down", "queue depth is too large", etc then we can do it. So for ath, I think I have to pick a point in the output path where we won't return the mbuf. It's likely once we call ath_tx_start() then we should consume the mbuf and return no-error. Now, the bug bug here is that ath_tx_start() actually does free the mbuf, and we .. then return failure codes. We should return OK, and consume the node reference. I'll sleep on it and see :) -adrian
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAJ-VmokVzGxK-MfN9XMHYJ=Hj1pF5mNkYoMoCOLueKAMQRSvHw>