Panic after iwn0 controller panic

[Xin Li]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Hi,

I have seen this in the morning when I had an overnight replication
from my laptop to my storage system which transfers a lot of data.

Before the panic there was some message like:

iwn0: iwn_panicked: controller panicked, iv_state = 5; resetting...
iwn0: iwn_read_firmware: ucode rev=0x12a80601
iwn0: iwn_tx_data: m=0xfffff8001d780300: seqno (61735) (39) != ring
index (0) !

Then the panic with fault virtual address (0x1f, which seems to be
mbuf->mflags).

Call trace was:

ithread_loop -> intr_event_execute_handlers -> iwn_intr ->
iwn_notif_intr -> iwn_ampdu_tx_done at 3717 -> ieee80211_tx_complete at 3417

So looks like 'm' was NULL in ieee80211_tx_complete.  I don't have
INVARIANTS enabled or the panic should be earlier as there is an
assertion in iwn(4) right before calling ieee80211_tx_complete:

	KASSERT(m != NULL, ("no mbuf"));

I haven't looked at the issue further yet as I haven't idea how to
provoke the issue again.

Cheers,
- -- 
Xin LI <delphij at delphij.net>    https://www.delphij.net/
FreeBSD - The Power to Serve!           Live free or die
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1.0 (FreeBSD)

iQIcBAEBCgAGBQJUgPauAAoJEJW2GBstM+nsYHcP/187em+bzP6QW7jw6H+cGwI/
NMi2862SL2NfV+0eQt2zPtUd2MmQZzraT13KumAW5uZ3jOBvRxzjnxJq5Ljv6xP/
T+IwLJ/Tu1Yc+oEcWB0CucDU3Xmsbln1iOo5Wwez/Hs0nllvg+jiwMlUgd6zanxN
rxldI9xRgEKKLplCWhhIRODC7JFD4kyftPPMafxEVPXVBtgTtr5Yt0uk/1Nr5aii
Quct6QbdpT2epa9wpb2Z5VUgLfafOJ43XWpTdI0xXPxkjqQcBf6E4SoVsxoNQ6IM
33BRye/G0RBkSvWSGaSw6DlqYtSU/NG8Wx4JeEjH71Bm6wE2kk9AU3mvcE/cYGdh
INKNw4gpP4EDM1v8mhJjRQIOHON2WEaRH535+zJ16v+KERRKmA9BjDPZh/TSC8CF
zBRsHrO1SiS0A1tjccOBBOhSKBBvWwH+fVGtsYLRlmkVF/qzGZqYDnvdDskMKPF9
hAJr3ZU8lC6aja44+qKR3z6m5XxnTGqO1kgIrisQHNBydH3HW5MZLbv9Muf/PWqo
caJ04rtC1AQfE9N50l3fYsqvAyAncraCaEiaeQQ2oSNO5ruAm0OjjUQBcAq9xGw8
qEjkFHAbxrOV15y5qXSKkSV80rE5/ve1JEbQqGxhhplMc8DPrc4ZS5AIuujOeJvd
oaIMRMYo83HUraRy54SN
=0TDK
-----END PGP SIGNATURE-----