stable/10 panic; _ieee80211_crypto_delkey() likely involved

[David Wolfskill]

I was reading some recent commits to stable/10 after just having issued
"service netif restart iwn0" in an effort to get wlan0 to re-associate,
and my laptop panicked:

Fri Apr 24 15:28:37 PDT 2015

FreeBSD localhost 10.1-STABLE FreeBSD 10.1-STABLE #46  r281921M/281927:1001512: Fri Apr 24 04:24:32 PDT 2015     root at g1-254.catwhisker.org:/common/S1/obj/usr/src/sys/CANARY  i386

panic: page fault
...
Unread portion of the kernel message buffer:

Fatal trap 12: page fault while in kernel mode
cpuid = 5; apic id = 05
fault virtual address   = 0x18
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc0bceff2
stack pointer           = 0x28:0xc650f754
frame pointer           = 0x28:0xc650f7a4
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 3493 (wpa_supplicant)
trap number             = 12
panic: page fault
cpuid = 5
KDB: stack backtrace:
#0 0xc0b1fd52 at kdb_backtrace+0x52
#1 0xc0ae13cf at panic+0x11f
#2 0xc0f65804 at trap_fatal+0x324
#3 0xc0f65b65 at trap_pfault+0x355
#4 0xc0f65224 at trap+0x674
#5 0xc0f5059c at calltrap+0x6
#6 0xc0bceede at ieee80211_crypto_delkey+0x1e
#7 0xc0be43a6 at ieee80211_ioctl_delkey+0x76
#8 0xc0be3115 at ieee80211_ioctl_set80211+0x585
#9 0xc0c0d8b1 at in_control+0x221
#10 0xc0bac060 at ifioctl+0x1460
#11 0xc0b40848 at soo_ioctl+0x2e8
#12 0xc0b38768 at kern_ioctl+0x258
#13 0xc0b3846c at sys_ioctl+0xec
#14 0xc0f662c6 at syscall+0x4a6
#15 0xc0f50631 at Xint0x80_syscall+0x21
Uptime: 7h2m17s
Physical memory: 3270 MB
...
#0  doadump (textdump=-824728192) at pcpu.h:233
233     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb) #0  doadump (textdump=-824728192) at pcpu.h:233
#1  0xc0ae103d in kern_reboot (howto=260)
    at /usr/src/sys/kern/kern_shutdown.c:452
#2  0xc0ae140d in panic (fmt=<value optimized out>)
    at /usr/src/sys/kern/kern_shutdown.c:759
#3  0xc0f65804 in trap_fatal (frame=<value optimized out>, 
    eva=<value optimized out>) at /usr/src/sys/i386/i386/trap.c:1023
#4  0xc0f65b65 in trap_pfault (frame=0x0, usermode=<value optimized out>, 
    eva=0) at /usr/src/sys/i386/i386/trap.c:835
#5  0xc0f65224 in trap (frame=0xc650f714) at /usr/src/sys/i386/i386/trap.c:532
#6  0xc0f5059c in calltrap () at /usr/src/sys/i386/i386/exception.s:170
#7  0xc0bceff2 in _ieee80211_crypto_delkey ()
    at /usr/src/sys/net80211/ieee80211_crypto.c:105
#8  0xc0bceede in ieee80211_crypto_delkey (vap=0xd46a0000, key=0xd46a0670)
    at /usr/src/sys/net80211/ieee80211_crypto.c:461
#9  0xc0be43a6 in ieee80211_ioctl_delkey (vap=0xd46a0000, 
    ireq=<value optimized out>)
    at /usr/src/sys/net80211/ieee80211_ioctl.c:1252
#10 0xc0be3115 in ieee80211_ioctl_set80211 ()
    at /usr/src/sys/net80211/ieee80211_ioctl.c:2814
#11 0xc0c0d8b1 in in_control (so=<value optimized out>, cmd=Cannot access memory at address 0xfffffffb
)
    at /usr/src/sys/netinet/in.c:308
#12 0xc0bac060 in ifioctl (so=0xd46a0000, cmd=2149345770, 
    data=<value optimized out>, td=<value optimized out>)
    at /usr/src/sys/net/if.c:2751
#13 0xc0b40848 in soo_ioctl (fp=0xd00fd348, cmd=<value optimized out>, 
    data=0xc650fa40, active_cred=0xd000de80, td=0xd46a0000)
    at /usr/src/sys/kern/sys_socket.c:212
#14 0xc0b38768 in kern_ioctl (td=<value optimized out>, 
    fd=<value optimized out>, com=<value optimized out>) at file.h:320
#15 0xc0b3846c in sys_ioctl (uap=<value optimized out>)
    at /usr/src/sys/kern/sys_generic.c:718
#16 0xc0f662c6 in syscall (frame=<value optimized out>) at subr_syscall.c:134
#17 0xc0f50631 in Xint0x80_syscall ()
    at /usr/src/sys/i386/i386/exception.s:270
#18 0x00000033 in ?? ()
Previous frame inner to this frame (corrupt stack?)
Current language:  auto; currently minimal
(kgdb) 
....

I have the crash dump & text dumps available, and can put the latter
up on my Web server for a bit if that would be useful.

Peace,
david
-- 
David H. Wolfskill				david at catwhisker.org
Those who murder in the name of God or prophet are blasphemous cowards.

See http://www.catwhisker.org/~david/publickey.gpg for my public key.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 949 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-stable/attachments/20150424/003a6088/attachment.sig>