AP mode if down panic sleeping on non-sleepable lock
bzfbd opened this issue · comments
This is FreeBSD as of 2020-05-28 with some extra debugging in the driver.
athp0: athp_vap_newstate: RUN -> INIT (is_setup=1) (is_dying=0)
athp0: failed to flush transmit queue (skip 0 ar-state 1): 0
athp0: ath10k_control_beaconing: called; enable=0
athp0: athp_node_free: called; mac=00:80:48:3d:a3:48 (0xfffffe003da7d000)
athp0: athp_node_free: delete peer for MAC 00:80:48:3d:a3:48 (0xfffffe003da7d000)
Sleeping on "tx_credits_wq" with the following non-sleepable locks held:
exclusive sleep mutex athp0_com_lock (athp0_com_lock) r = 0 (0xfffffe00326cc020) locked @ athp/sys/net80211/ieee80211_scan_sw.c:429
stack backtrace:
#0 0xffffffff80c314d1 at witness_debugger+0x71
#1 0xffffffff80c3246d at witness_warn+0x40d
#2 0xffffffff80bd0b28 at _sleep+0x58
#3 0xffffffff8234df14 at ath10k_wait_wait+0x84
#4 0xffffffff8235b9a9 at ath10k_wmi_cmd_send+0xa9
#5 0xffffffff8236c6f0 at ath10k_bss_info_changed_slottime+0xa0
#6 0xffffffff823484b0 at athp_update_slot+0x30
#7 0xffffffff80d42291 at ieee80211_reset_erp+0xa1
#8 0xffffffff80d34f2c at ieee80211_reset_bss+0x2c
#9 0xffffffff80d1ab5b at hostap_newstate+0x2fb
#10 0xffffffff80d415d6 at ieee80211_newstate_cb+0x1d6
#11 0xffffffff80c23e7a at taskqueue_run_locked+0xaa
#12 0xffffffff80c24ef4 at taskqueue_thread_loop+0x94
#13 0xffffffff80b823c0 at fork_exit+0x80
#14 0xffffffff8103e43e at fork_trampoline+0xe
Sleeping thread (tid 100142, pid 0) owns a non-sleepable lock
KDB: stack backtrace of thread 100142:
sched_switch() at sched_switch+0x5b2/frame 0xfffffe003b17f7f0
mi_switch() at mi_switch+0x155/frame 0xfffffe003b17f810
sleepq_switch() at sleepq_switch+0x11a/frame 0xfffffe003b17f850
sleepq_timedwait() at sleepq_timedwait+0x4b/frame 0xfffffe003b17f890
_sleep() at _sleep+0x26c/frame 0xfffffe003b17f930
ath10k_wait_wait() at ath10k_wait_wait+0x84/frame 0xfffffe003b17f960
ath10k_wmi_cmd_send() at ath10k_wmi_cmd_send+0xa9/frame 0xfffffe003b17f9c0
ath10k_bss_info_changed_slottime() at ath10k_bss_info_changed_slottime+0xa0/frame 0xfffffe003b17f9f0
athp_update_slot() at athp_update_slot+0x30/frame 0xfffffe003b17fa10
ieee80211_reset_erp() at ieee80211_reset_erp+0xa1/frame 0xfffffe003b17fa30
ieee80211_reset_bss() at ieee80211_reset_bss+0x2c/frame 0xfffffe003b17fa60
hostap_newstate() at hostap_newstate+0x2fb/frame 0xfffffe003b17fab0
ieee80211_newstate_cb() at ieee80211_newstate_cb+0x1d6/frame 0xfffffe003b17fb00
taskqueue_run_locked() at taskqueue_run_locked+0xaa/frame 0xfffffe003b17fb80
taskqueue_thread_loop() at taskqueue_thread_loop+0x94/frame 0xfffffe003b17fbb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b17fbf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b17fbf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
panic: sleeping thread
cpuid = 1
time = 1490243822
KDB: stack backtrace:
db_trace_self_wrapper() at db_trace_self_wrapper+0x2b/frame 0xfffffe003b1663f0
vpanic() at vpanic+0x182/frame 0xfffffe003b166440
panic() at panic+0x43/frame 0xfffffe003b1664a0
propagate_priority() at propagate_priority+0x219/frame 0xfffffe003b1664e0
turnstile_wait() at turnstile_wait+0x380/frame 0xfffffe003b166530
__mtx_lock_sleep() at __mtx_lock_sleep+0x1cc/frame 0xfffffe003b1665c0
__mtx_lock_flags() at __mtx_lock_flags+0xe5/frame 0xfffffe003b166610
ieee80211_beacon_update() at ieee80211_beacon_update+0x3b/frame 0xfffffe003b166680
ath10k_wmi_event_host_swba() at ath10k_wmi_event_host_swba+0x1e2/frame 0xfffffe003b166910
ath10k_wmi_10_2_op_rx() at ath10k_wmi_10_2_op_rx+0x2b9/frame 0xfffffe003b1669b0
ath10k_htc_rx_completion_handler() at ath10k_htc_rx_completion_handler+0x203/frame 0xfffffe003b166a40
ath10k_pci_ce_recv_data() at ath10k_pci_ce_recv_data+0xff/frame 0xfffffe003b166ac0
ath10k_ce_per_engine_service() at ath10k_ce_per_engine_service+0x8c/frame 0xfffffe003b166b00
ath10k_pci_ce_tasklet() at ath10k_pci_ce_tasklet+0x55/frame 0xfffffe003b166b20
ithread_loop() at ithread_loop+0x279/frame 0xfffffe003b166bb0
fork_exit() at fork_exit+0x80/frame 0xfffffe003b166bf0
fork_trampoline() at fork_trampoline+0xe/frame 0xfffffe003b166bf0
--- trap 0, rip = 0, rsp = 0, rbp = 0 ---
KDB: enter: panic
[ thread pid 12 tid 100137 ]
Stopped at kdb_enter+0x37: movq $0,0x10c9ad6(%rip)
This apparently was my own problem with a half-done implementation.