NetBSD Problem Report #60665

From www@netbsd.org  Sat Aug 29 01:07:14 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 099831A923B
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 29 Aug 2026 01:07:14 +0000 (UTC)
Message-Id: <20260829010712.B23271A923C@mollari.NetBSD.org>
Date: Sat, 29 Aug 2026 01:07:12 +0000 (UTC)
From: coypu@sdf.org
Reply-To: coypu@sdf.org
To: gnats-bugs@NetBSD.org
Subject: run: hot-plugging USB wifi crashes due to use of if_attach
X-Send-Pr-Version: www-1.0
X-From4GNATS: "coypu@sdf.org via gnats" <gnats-admin@NetBSD.org>

>Number:         60665
>Category:       kern
>Synopsis:       run: hot-plugging USB wifi crashes due to use of if_attach
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          needs-pullups
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 29 01:10:01 +0000 2026
>Closed-Date:    
>Last-Modified:  Sat Aug 29 02:02:21 +0000 2026
>Originator:     coypu
>Release:        NetBSD 11.0_BETA
>Organization:
>Environment:
NetBSD  11.0_BETA NetBSD 11.0_BETA (GENERIC) #0: Mon Oct 20 14:11:07 UTC 2025  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64

>Description:
Note: this is clearly an issue that affects multiple USB wifi adapters.
I have plugged a run(4) device after booting, with wpa_supplicant/dhcpcd already running.
It attempted to use the driver immediately as it was published, before some structs were initialized, causing a null deref crash with the following backtrace:

mutex_enter() at netbsd:mutex_enter+0xc
run_ioctl() at netbsd:run_ioctl+0x87
doifioctl() at netbsd:doifioctl+0xad3
sys_ioctl() at netbsd;sys_ioctl+0x1fa
syscall() at netbsd:syscall+0x9d
--- syscall (number 54) ---
netbsd:syscall+0x9d:

hot-pluggable wifi probably can't get away with the use of if_attach at all.
Drivers that don't have this issue (e.g. urtwn) split the calls:

if_initialize
ieee80211_ifattach
... finish initializing ...
if_register
>How-To-Repeat:
Hot plug a run(4) with wpa_supplicant running.
>Fix:

>Release-Note:

>Audit-Trail:
From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60665 CVS commit: src/sys/dev/usb
Date: Sat, 29 Aug 2026 01:15:46 +0000

 Module Name:	src
 Committed By:	maya
 Date:		Sat Aug 29 01:15:46 UTC 2026

 Modified Files:
 	src/sys/dev/usb: if_run.c

 Log Message:
 run: don't expose us to userland until things are fully initialized.

 Fixes crash seen when hot-plugging run(4) with a running wpa_supplicant.
 PR kern/60665: run: hot-plugging USB wifi crashes due to use of if_attach


 To generate a diff of this commit:
 cvs rdiff -u -r1.42 -r1.43 src/sys/dev/usb/if_run.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Maya Rashish" <maya@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/60665 CVS commit: src/sys/dev/usb
Date: Sat, 29 Aug 2026 01:59:51 +0000

 Module Name:	src
 Committed By:	maya
 Date:		Sat Aug 29 01:59:51 UTC 2026

 Modified Files:
 	src/sys/dev/usb: if_atu.c if_otus.c if_rum.c if_upgt.c if_ural.c
 	    if_urtw.c if_zyd.c

 Log Message:
 don't expose us to userland until things are fully initialized.

 Same class of bugs that run(4) had in other USB drivers.

 PR kern/60665: run: hot-plugging USB wifi crashes due to use of if_attach


 To generate a diff of this commit:
 cvs rdiff -u -r1.78 -r1.79 src/sys/dev/usb/if_atu.c
 cvs rdiff -u -r1.45 -r1.46 src/sys/dev/usb/if_otus.c
 cvs rdiff -u -r1.71 -r1.72 src/sys/dev/usb/if_rum.c
 cvs rdiff -u -r1.33 -r1.34 src/sys/dev/usb/if_upgt.c
 cvs rdiff -u -r1.67 -r1.68 src/sys/dev/usb/if_ural.c
 cvs rdiff -u -r1.27 -r1.28 src/sys/dev/usb/if_urtw.c
 cvs rdiff -u -r1.61 -r1.62 src/sys/dev/usb/if_zyd.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->needs-pullups
State-Changed-By: maya@NetBSD.org
State-Changed-When: Sat, 29 Aug 2026 02:02:21 +0000
State-Changed-Why:
Bug is fixed in -current


>Unformatted:

Home	PR Database Search