NetBSD Problem Report #35168

From www@NetBSD.org  Sat Dec  2 12:16:21 2006
Return-Path: <www@NetBSD.org>
Received: by narn.NetBSD.org (Postfix, from userid 31301)
	id 35C7A63B90D; Sat,  2 Dec 2006 12:16:21 +0000 (UTC)
Message-Id: <20061202121621.35C7A63B90D@narn.NetBSD.org>
Date: Sat,  2 Dec 2006 12:16:21 +0000 (UTC)
From: degroote@enseirb.fr
Reply-To: degroote@enseirb.fr
To: gnats-bugs@NetBSD.org
Subject: probable double free panic in net80211
X-Send-Pr-Version: www-1.0

>Number:         35168
>Category:       kern
>Synopsis:       probable double free panic in net80211
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Dec 02 12:20:00 +0000 2006
>Last-Modified:  Sun Jan 28 18:25:41 +0000 2007
>Originator:     Arnaud Degroote
>Release:        NetBSD-current
>Organization:
>Environment:
>Description:
Using a kernel with KMEMSTATS and DIAGNOSTIC, the net80211 stack quickly panics with the following message :
panic : free 2 : inuse 0: probable double free.

The backtrace is:
panic
free
node_free
_ieee80211_free_node
ieee80211_free_allnodes_locked
ieee80211_node_table_reset
wpi_newstate
ieee80211_next_scan
ieee80211_end_scan
wpi_intr
intr_biglock_wrapper



>How-To-Repeat:
Compile a kernel with KMEMSTATS options and DIAGNOSTIC option.
I don't know if it is related to the wpi driver or the 80211 stack.
>Fix:
Don't know for moment. 
I have first suspected the call of ieee802111_free_node from
ieee80211_node-delucastkey but it doesn't seem to solve the issue
if I remove it ( there are only two consummers for this function :
first node_cleanup which is called from node_free, and
ieee80211_ioctl_key ( which call ieee80211_node_free just after
the call to ieee80211_node_delucastkey ).

I will continue to investigate about this panic.

Take cares.

>Release-Note:

>Audit-Trail:

>Unformatted:

Home	PR Database Search