[Bug 195937] [urtwn] panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195937 Gleb Smirnoff gleb...@freebsd.org changed: What|Removed |Added CC||gleb...@freebsd.org Status|New |In Progress Assignee|freebsd-wirel...@freebsd.or |gleb...@freebsd.org |g | --- Comment #1 from Gleb Smirnoff gleb...@freebsd.org --- Can't reproduce with this patch: https://wiki.freebsd.org/projects/ifnet/net80211 I will close the bug once the patch makes it to head. -- You are receiving this mail because: You are the assignee for the bug. ___ freebsd-wireless@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-wireless To unsubscribe, send any mail to freebsd-wireless-unsubscr...@freebsd.org
[Bug 195937] New: [urtwn] panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=195937 Bug ID: 195937 Summary: [urtwn] panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c Product: Base System Version: 11.0-CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: wireless Assignee: freebsd-wireless@FreeBSD.org Reporter: dcha...@freebsd.org get out usb urtwn device. dchagin.static.corbina.net dumped core - see /var/crash/vmcore.1 Sat Dec 13 00:02:31 MSK 2014 FreeBSD dchagin.static.corbina.net 11.0-CURRENT FreeBSD 11.0-CURRENT #161 r275641+669d6a9(lemul): Tue Dec 9 17:40:17 MSK 2014 r...@dchagin.static.corbina.net:/home/rootobj/home/dchagin/head/sys/YOY amd64 panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c:1933 GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as amd64-marcel-freebsd... Unread portion of the kernel message buffer: urtwn0: timeout waiting for MAC initialization panic: mtx_lock() of destroyed mutex @ /home/dchagin/head/sys/net80211/ieee80211_node.c:1933 cpuid = 6 KDB: enter: panic Reading symbols from /boot/kernel/xhci.ko.symbols...done. Loaded symbols for /boot/kernel/xhci.ko.symbols Reading symbols from /boot/kernel/usb.ko.symbols...done. Loaded symbols for /boot/kernel/usb.ko.symbols Reading symbols from /boot/kernel/linprocfs.ko.symbols...done. Loaded symbols for /boot/kernel/linprocfs.ko.symbols Reading symbols from /boot/kernel/pseudofs.ko.symbols...done. Loaded symbols for /boot/kernel/pseudofs.ko.symbols Reading symbols from /boot/kernel/linux_common.ko.symbols...done. Loaded symbols for /boot/kernel/linux_common.ko.symbols Reading symbols from /boot/kernel/procfs.ko.symbols...done. Loaded symbols for /boot/kernel/procfs.ko.symbols Reading symbols from /boot/kernel/if_urtwn.ko.symbols...done. Loaded symbols for /boot/kernel/if_urtwn.ko.symbols #0 doadump (textdump=1015036432) at /home/dchagin/head/sys/kern/kern_shutdown.c:261 261dumptid = curthread-td_tid; (kgdb) #0 doadump (textdump=1015036432) at /home/dchagin/head/sys/kern/kern_shutdown.c:261 #1 0x803a45e8 in db_fncall_generic (addr=-2140153696, rv=0xfe033c8039a0, nargs=0, args=0xfe033c8039b0) at /home/dchagin/head/sys/ddb/db_command.c:568 #2 0x803a42ba in db_fncall (dummy1=0, dummy2=0, dummy3=-2199011875852, dummy4=0xfe033c803a90 ю:\200\003ЧЪЪi0h\200\001) at /home/dchagin/head/sys/ddb/db_command.c:616 #3 0x803a3f34 in db_command (last_cmdp=0x810209a8, cmd_table=0x0, dopager=1) at /home/dchagin/head/sys/ddb/db_command.c:440 #4 0x803a3b4d in db_command_loop () at /home/dchagin/head/sys/ddb/db_command.c:493 #5 0x803a8138 in db_trap (type=3, code=0) at /home/dchagin/head/sys/ddb/db_main.c:251 #6 0x80759a5c in kdb_trap (type=3, code=0, tf=0xfe033c804130) at /home/dchagin/head/sys/kern/subr_kdb.c:654 #7 0x80bc1e31 in trap (frame=0xfe033c804130) at /home/dchagin/head/sys/amd64/amd64/trap.c:546 #8 0x80bc3508 in trap_check (frame=0xfe033c804130) at /home/dchagin/head/sys/amd64/amd64/trap.c:644 #9 0x80b97db2 in calltrap () at /home/dchagin/head/sys/amd64/amd64/exception.S:231 #10 0x80759285 in breakpoint () at cpufunc.h:63 #11 0x80758ebf in kdb_enter (why=0x80cef26d panic, msg=0x80cef26d panic) at /home/dchagin/head/sys/kern/subr_kdb.c:443 #12 0x806fe077 in vpanic ( fmt=0x80cec4ae mtx_lock() of destroyed mutex @ %s:%d, ap=0xfe033c804350) at /home/dchagin/head/sys/kern/kern_shutdown.c:739 #13 0x806fda8c in kassert_panic ( fmt=0x80cec4ae mtx_lock() of destroyed mutex @ %s:%d) at /home/dchagin/head/sys/kern/kern_shutdown.c:634 #14 0x806db6de in __mtx_lock_flags (c=0xfe000348e850, opts=0, file=0x80d11ff1 /home/dchagin/head/sys/net80211/ieee80211_node.c, line=1933) at /home/dchagin/head/sys/kern/kern_mutex.c:214 #15 0x808c5a51 in ieee80211_node_table_reset (nt=0xfe000348e820, match=0xf801528b4000) at /home/dchagin/head/sys/net80211/ieee80211_node.c:1933 #16 0x808c598c in ieee80211_node_vdetach (vap=0xf801528b4000) at /home/dchagin/head/sys/net80211/ieee80211_node.c:194 #17 0x8087ee84 in ieee80211_vap_detach (vap=0xf801528b4000) at /home/dchagin/head/sys/net80211/ieee80211.c:657 #18 0x816362ee in urtwn_vap_delete (vap
urtwn panic
Hi all, Tried to send this a couple days ago, but for some reason none of my emails post to the @freebsd.org mailing lists. Thinking it's my @yahoo.com return address. If this doesn't post, I'll try the @gmail.com one. I'm getting a panic with the latest kernel (r264719) and the if_urtwn driver. It happens ~75% of the time I plug the device into a USB port, and appears to occur when the driver holds a non-sleepable mutex while calling a USB firmware loading function which goes to sleep. I have a coredump available to triage. Here's the device details (from Linux, since I can't reliably plug the thing into FreeBSD): dmesg: [330849.645998] usb 1-5: Product: 802.11n WLAN Adapter [330849.646002] usb 1-5: Manufacturer: Realtek [330849.646006] usb 1-5: SerialNumber: 00e04c01 [330849.703666] cfg80211: Calling CRDA to update world regulatory domain [330849.715428] cfg80211: World regulatory domain updated: [330849.715434] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp) [330849.715437] cfg80211: (2402000 KHz - 2472000 KHz @ 4 KHz), (300 mBi, 2000 mBm) [330849.715439] cfg80211: (2457000 KHz - 2482000 KHz @ 4 KHz), (300 mBi, 2000 mBm) [330849.715441] cfg80211: (2474000 KHz - 2494000 KHz @ 2 KHz), (300 mBi, 2000 mBm) [330849.715443] cfg80211: (517 KHz - 525 KHz @ 4 KHz), (300 mBi, 2000 mBm) [330849.715445] cfg80211: (5735000 KHz - 5835000 KHz @ 4 KHz), (300 mBi, 2000 mBm) [330849.731410] rtl8192cu: Chip version 0x10 [330849.809018] rtl8192cu: MAC address: 00:0b:81:81:54:69 [330849.809023] rtl8192cu: Board Type 0 [330849.809266] rtl_usb: rx_max_size 15360, rx_urb_num 8, in_ep 1 [330849.809317] rtl8192cu: Loading firmware rtlwifi/rtl8192cufw_TMSC.bin [330849.809506] usbcore: registered new interface driver rtl8192cu [330849.818471] ieee80211 phy0: Selected rate control algorithm 'rtl_rc' [330849.819740] rtlwifi: wireless switch is on [330849.859663] rtl8192cu: MAC auto ON okay! [330849.895265] rtl8192cu: Tx queue select: 0x05 [330850.256751] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [330850.258132] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready ajenkins@kubuntu-ajenkins:~$ sudo lsusb -v -s 001:003 Bus 001 Device 003: ID 0bda:8176 Realtek Semiconductor Corp. RTL8188CUS 802.11n WLAN Adapter Device Descriptor: bLength18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass0 (Defined at Interface level) bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize064 idVendor 0x0bda Realtek Semiconductor Corp. idProduct 0x8176 RTL8188CUS 802.11n WLAN Adapter bcdDevice2.00 iManufacturer 1 Realtek iProduct2 802.11n WLAN Adapter iSerial 3 00e04c01 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 46 bNumInterfaces 1 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber0 bAlternateSetting 0 bNumEndpoints 4 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass255 Vendor Specific Subclass bInterfaceProtocol255 Vendor Specific Protocol iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes2 Transfer TypeBulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes2 Transfer TypeBulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x03 EP 3 OUT bmAttributes2 Transfer TypeBulk Synch Type None Usage Type Data wMaxPacketSize 0x0200 1x 512 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x84 EP 4 IN bmAttributes3 Transfer TypeInterrupt Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x
Re: urtwn panic
Anthony Jenkins wrote: I'm getting a panic with the latest kernel (r264719) and the if_urtwn driver. Might the urtwn device overheat, not return cause a panic ? My urtwn device is very small, no thermal path to dump heat. I've not tried on current, but on 10.0-RELEASE I saw my urtwn0 interface disappearing; I read parts of the driver; noticed there's mention of a temperature level, I didn't tweak it, but hung my device on a USB extension cable at 10 C outside the window, later in front of a chassis input fan at ~ 20 C room temp., I think both locations lasted longer or perhaps indefinately without urtwn0 , can't remember, I suspended pursuing it. Device picture for those who don't know how small this, other URLs via: http://www.berklix.com/~jhs/hardware/urtwn/ Cheers, Julian -- Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com Interleave replies below like a play script. Indent old text with . Google breach privacy http://berklix.com/jhs/adverts/ ___ freebsd-wireless@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-wireless To unsubscribe, send any mail to freebsd-wireless-unsubscr...@freebsd.org
Re: urtwn panic
Thanks for reply, Julian. Yes it is tiny, I hadn't considered thermal issues. Its size is why I like the thing, very unobtrusive in my laptop (while I try debugging the AR9565 problems I'm having). I'll give the dongle idea a whirl, also try it in my desktop downstairs (also running a decently recent kernel). S possibly nothing to the whole sleeping-while-holding-a-lock thing? :-) Thanks, Anthony From: Julian H. Stacey j...@berklix.com To: Anthony Jenkins scoobi_...@yahoo.com Cc: freebsd-wireless@freebsd.org Sent: Wednesday, April 23, 2014 4:38 PM Subject: Re: urtwn panic Anthony Jenkins wrote: I'm getting a panic with the latest kernel (r264719) and the if_urtwn driver. Might the urtwn device overheat, not return cause a panic ? My urtwn device is very small, no thermal path to dump heat. I've not tried on current, but on 10.0-RELEASE I saw my urtwn0 interface disappearing; I read parts of the driver; noticed there's mention of a temperature level, I didn't tweak it, but hung my device on a USB extension cable at 10 C outside the window, later in front of a chassis input fan at ~ 20 C room temp., I think both locations lasted longer or perhaps indefinately without urtwn0 , can't remember, I suspended pursuing it. Device picture for those who don't know how small this, other URLs via: http://www.berklix.com/~jhs/hardware/urtwn/ Cheers, Julian -- Julian Stacey, BSD Unix Linux C Sys Eng Consultant, Munich http://berklix.com Interleave replies below like a play script. Indent old text with . Google breach privacy http://berklix.com/jhs/adverts/ ___ freebsd-wireless@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-wireless To unsubscribe, send any mail to freebsd-wireless-unsubscr...@freebsd.org ___ freebsd-wireless@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-wireless To unsubscribe, send any mail to freebsd-wireless-unsubscr...@freebsd.org
Re: urtwn panic
From: Kevin Lo ke...@freebsd.org To: Anthony Jenkins scoobi_...@yahoo.com Sent: Wednesday, April 23, 2014 10:28 PM Subject: Re: urtwn panic Anthony Jenkins wrote: I'm getting a panic with the latest kernel (r264719) and the if_urtwn driver. I have a coredump available to triage. Could you try attached patch? Thanks. Kevin Nice, several insertions/extractions and no panics! Unfortunately the !@#$ dongle's so small I just now managed to separate the device from the metal sleeve...grrr. Should be able to fix tho, and it's still functional. Many thanks! Anthony patch-urtwn Description: Binary data ___ freebsd-wireless@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-wireless To unsubscribe, send any mail to freebsd-wireless-unsubscr...@freebsd.org
Re: urtwn panic
Anthony Jenkins wrote: From: Kevin Lo ke...@freebsd.org To: Anthony Jenkins scoobi_...@yahoo.com Sent: Wednesday, April 23, 2014 10:28 PM Subject: Re: urtwn panic Anthony Jenkins wrote: I'm getting a panic with the latest kernel (r264719) and the if_urtwn driver. I have a coredump available to triage. Could you try attached patch? Thanks. Kevin Nice, several insertions/extractions and no panics! Cool! Fixed in *r264864, thanks. *** http://svnweb.freebsd.org/base?view=revisionrevision=264864 Unfortunately the !@#$ dongle's so small I just now managed to separate the device from the metal sleeve...grrr. Should be able to fix tho, and it's still functional. Many thanks! Anthony Kevin ___ freebsd-wireless@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-wireless To unsubscribe, send any mail to freebsd-wireless-unsubscr...@freebsd.org
urtwn panic
I'm getting a panic with the latest kernel (r264719) and the if_urtwn driver. I have a coredump available to triage. [root@ajenkins-hplaptop /usr/src]# kgdb /usr/obj/usr/src/sys/MYKERNEL/kernel.debug /var/crash/vmcore.last GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type show copying to see the conditions. There is absolutely no warranty for GDB. Type show warranty for details. This GDB was configured as amd64-marcel-freebsd... Unread portion of the kernel message buffer: Sleeping on fwload with the following non-sleepable locks held: exclusive sleep mutex urtwn0 (network driver) r = 0 (0xfe00175fe348) locked @ /usr/src/sys/dev/usb/usb_request.c:722 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfe0447e095e0 kdb_backtrace() at kdb_backtrace+0x39/frame 0xfe0447e09690 witness_warn() at witness_warn+0x4b5/frame 0xfe0447e09750 _sleep() at _sleep+0x70/frame 0xfe0447e097f0 firmware_get() at firmware_get+0x13a/frame 0xfe0447e09850 urtwn_init_locked() at urtwn_init_locked+0x18cd/frame 0xfe0447e09910 urtwn_ioctl() at urtwn_ioctl+0x12a/frame 0xfe0447e09960 taskqueue_run_locked() at taskqueue_run_locked+0xf0/frame 0xfe0447e099c0 taskqueue_thread_loop() at taskqueue_thread_loop+0x9b/frame 0xfe0447e099f0 fork_exit() at fork_exit+0x84/frame 0xfe0447e09a30 fork_trampoline() at fork_trampoline+0xe/frame 0xfe0447e09a30 --- trap 0, rip = 0, rsp = 0xfe0447e09af0, rbp = 0 --- Sleeping thread (tid 100892, pid 0) owns a non-sleepable lock KDB: stack backtrace of thread 100892: sched_switch() at sched_switch+0x47f/frame 0xfe0447e096a0 mi_switch() at mi_switch+0x179/frame 0xfe0447e096e0 sleepq_switch() at sleepq_switch+0x152/frame 0xfe0447e09720 sleepq_wait() at sleepq_wait+0x43/frame 0xfe0447e09750 _sleep() at _sleep+0x366/frame 0xfe0447e097f0 firmware_get() at firmware_get+0x13a/frame 0xfe0447e09850 urtwn_init_locked() at urtwn_init_locked+0x18cd/frame 0xfe0447e09910 urtwn_ioctl() at urtwn_ioctl+0x12a/frame 0xfe0447e09960 taskqueue_run_locked() at taskqueue_run_locked+0xf0/frame 0xfe0447e099c0 taskqueue_thread_loop() at taskqueue_thread_loop+0x9b/frame 0xfe0447e099f0 fork_exit() at fork_exit+0x84/frame 0xfe0447e09a30 fork_trampoline() at fork_trampoline+0xe/frame 0xfe0447e09a30 --- trap 0, rip = 0, rsp = 0xfe0447e09af0, rbp = 0 --- panic: sleeping thread cpuid = 3 KDB: stack backtrace: db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfe0447e814b0 kdb_backtrace() at kdb_backtrace+0x39/frame 0xfe0447e81560 vpanic() at vpanic+0x124/frame 0xfe0447e815a0 panic() at panic+0x43/frame 0xfe0447e81600 propagate_priority() at propagate_priority+0x2fd/frame 0xfe0447e81640 turnstile_wait() at turnstile_wait+0x34f/frame 0xfe0447e81690 __mtx_lock_sleep() at __mtx_lock_sleep+0x1b6/frame 0xfe0447e81710 __mtx_lock_flags() at __mtx_lock_flags+0x102/frame 0xfe0447e81760 urtwn_ioctl() at urtwn_ioctl+0x41/frame 0xfe0447e817b0 ifioctl() at ifioctl+0x8f5/frame 0xfe0447e81870 kern_ioctl() at kern_ioctl+0x22b/frame 0xfe0447e818d0 sys_ioctl() at sys_ioctl+0x13c/frame 0xfe0447e81920 amd64_syscall() at amd64_syscall+0x25a/frame 0xfe0447e81a30 Xfast_syscall() at Xfast_syscall+0xfb/frame 0xfe0447e81a30 --- syscall (54, FreeBSD ELF64, sys_ioctl), rip = 0x800fa342a, rsp = 0x7fffdc88, rbp = 0x7fffe500 --- KDB: enter: panic Reading symbols from /boot/kernel/zfs.ko.symbols...done. Loaded symbols for /boot/kernel/zfs.ko.symbols Reading symbols from /boot/kernel/opensolaris.ko.symbols...done. Loaded symbols for /boot/kernel/opensolaris.ko.symbols ... #0 doadump (textdump=0) at pcpu.h:219 219pcpu.h: No such file or directory. in pcpu.h (kgdb) where #0 doadump (textdump=0) at pcpu.h:219 #1 0x802fb8ae in db_dump (dummy=value optimized out, dummy2=0, dummy3=0, dummy4=0x0) at /usr/src/sys/ddb/db_command.c:543 #2 0x802fb34d in db_command (cmd_table=0x0) at /usr/src/sys/ddb/db_command.c:449 #3 0x802fb0c4 in db_command_loop () at /usr/src/sys/ddb/db_command.c:502 #4 0x802fda90 in db_trap (type=value optimized out, code=0) at /usr/src/sys/ddb/db_main.c:231 #5 0x80628289 in kdb_trap (type=3, code=0, tf=value optimized out) at /usr/src/sys/kern/subr_kdb.c:656 #6 0x808ad8ae in trap (frame=0xfe0447e81490) at /usr/src/sys/amd64/amd64/trap.c:573 #7 0x80892262 in calltrap () at /usr/src/sys/amd64/amd64/exception.S:231 #8 0x806279ee in kdb_enter (why=0x809d5a90 panic, msg=value optimized out) at cpufunc.h:63 #9 0x805f0594 in vpanic (fmt=value optimized out, ap=value optimized out) at /usr/src/sys/kern/kern_shutdown.c:749 #10
