From nobody Mon Jun 8 07:18:08 2026 X-Original-To: wireless@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gYk0J3qbBz6h0DH for ; Mon, 08 Jun 2026 07:18:08 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gYk0J2P7Xz3TLy for ; Mon, 08 Jun 2026 07:18:08 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780903088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uq5dK9X6ZaXan1e3wvBKAZfwIc2oVkX1mTQ2Bg8hoUo=; b=koNEAhstItPSb1tAFrxWBDhevunGCbkpCfytvC2fbuuHDJVTGTSmwXgshJ0AkQCBrCVWVj BpcXba5lXAoOSY280uFyaxTS50VZz5sbTS5sksIcDZN07ykbxH4pH9FgD7AXSEdx8+Okvb F6mIgDFtMTVj2g8DlRNzWv3cc0Ir87WSq3aOaXuTLzT2exGEVe3tnVu5YqZPDc6Kbewvfl z0rIwBeFE4HMLqjE8npH94tsQC6FtoS80bGmMpn+cxtOIxUzwm4cJabw9XCGm6+jFEiLs+ xTbCs36GyAr2ueIGVjJEqJT8G5ntTgf3/AvbquUwek/CUnWizpaVBysjFYATyg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780903088; a=rsa-sha256; cv=none; b=QXwTen4bckdUef7jLOJmDnKSia08MOx26A5aoF3nem/ogv4Hn5DrcA979fJDGXH+9NzxWN IHPlBujf6m5T9HIGVy1FrK+Z4PxxqAy/tTWxd9FPkmC3svJ00xaiZEkzhmniKcPCOiyHnJ SbMCqq+btabjkgajUi/hLCwq5zWx/gBVuKzUo4WeWe+U/S2z9bOORTHp7czxSAVGcgJDF5 JIAsAFbQKV6wbUQpqwU8kXh5YkR6P9Mt0qJq4jJCZaBVZS+tcbrqR9qM6h8/UusEq9PRjr rRXftcnFHKNsPPbyieYT9N9J586gM1SEYMfsMt4LCgE/L80j0Pn+wNmyhRyVMQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780903088; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uq5dK9X6ZaXan1e3wvBKAZfwIc2oVkX1mTQ2Bg8hoUo=; b=KxDJbsPjKmh5Gx7wTXcEnGSk2fTPY6PTG9a/jLyMm0WDfAULqGOeiJk1H1TpfHJZRSXDSq WpFRXCu2t7iPldttAyyqVs67b2XSuBowA5cHLinQ6PpF5WtiDfA2MwDzXkMBtoKWtfgSJ6 F+cfC/pz2gdUdGAi+Fpl1TPHOPVQERCRxw3w04hSIfoybNQY6bnt1XoePHPDYifaAhk2YX 7i0DoQS7Cb0i/pSVWhALKLnm0crS9+PfjXBMUwPl/OmqS0FoHD58yOz5p9GSVPr3O3Aiwz d8P6/c8rmKCHYlyTq9qp6xlasIygOM1/QFKPm+WWV4Qskj3dK1qDRoYgQbUGfw== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4gYk0J1BlSzfN7 for ; Mon, 08 Jun 2026 07:18:08 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 6587I8ui059799 for ; Mon, 8 Jun 2026 07:18:08 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 6587I8CU059798 for wireless@FreeBSD.org; Mon, 8 Jun 2026 07:18:08 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 295928] panic: race condition in kernel in linuxkpi 802.11 Date: Mon, 08 Jun 2026 07:18:08 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: wireless X-Bugzilla-Version: 15.1-STABLE X-Bugzilla-Keywords: crash X-Bugzilla-Severity: Affects Many People X-Bugzilla-Who: jan.edhorak@seznam.cz X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: wireless@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback+ mfc-stable15? mfc-stable14? X-Bugzilla-Changed-Fields: bug_id short_desc product version rep_platform op_sys bug_status keywords bug_severity priority component assigned_to reporter flagtypes.name attachments.created Message-ID: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-wireless List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-wireless@freebsd.org Sender: owner-freebsd-wireless@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D295928 Bug ID: 295928 Summary: panic: race condition in kernel in linuxkpi 802.11 Product: Base System Version: 15.1-STABLE Hardware: amd64 OS: Any Status: New Keywords: crash Severity: Affects Many People Priority: --- Component: wireless Assignee: wireless@FreeBSD.org Reporter: jan.edhorak@seznam.cz Flags: maintainer-feedback+, mfc-stable15?, mfc-stable14? Created attachment 271605 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D271605&action= =3Dedit kgdb backtrace kernel panic occurs occasionally during reassociation with AP or when reset= ting the wlan interface. Most likely it is a race condition, when deassociating = with the AP a structure is zeroed and then another kernel thread calls transmit callback, and that accesses zeroed, and possibly freed memory, where is an intrusive linked list (using linux/list.h), and because the memory is zeroe= d, the list is corrupt, and then it tries to access data at address 0xfffffffffffffff8. Should be easy to reproduce, it occurs after either wpa_cli reassociate or service netif restart wlan0. Affects the rtw89 driver, and likely also rtw88 and maybe iwlwifi. uname -a FreeBSD ntbhorak2 15.1-STABLE FreeBSD 15.1-STABLE #4 stable/15-n283828-70f682385515-dirty: Wed Jun 3 12:42:26 CEST 2026=20=20= =20=20 root@ntbhorak2:/usr/obj/usr/src/amd64.amd64/sys/GENERIC amd64 possible cause is function lkpi_lsta_remove in sys/compat/linuxkpi/common/src/linux_80211.c:826, the sta structure is prob= ably destroyed without stopping tx and flushing queues, and the function rtw89_core_tx_write gets zeroed structure, and there, list_first_entry() is used, and if the pointers are zeroed, it returns an invalid pointer, which = the function then tries to access, and there it breaks. the list_first_entry() = is not used directly, but in macro rtw89_get_designated_link() --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Mon Jun 8 07:19:13 2026 X-Original-To: wireless@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gYk1Y2wF2z6h0Kl for ; Mon, 08 Jun 2026 07:19:13 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gYk1Y2RxNz3Tb5 for ; Mon, 08 Jun 2026 07:19:13 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780903153; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9naEUhYvO3h0X/IQklXEQfY6utZ9WnFZJYgDZHlsegg=; b=RhLst08UPUjzTi+/mb2SMfwsSA0CetvaMiY6JAoP4Ljkh1t2gyw84OXJfMTwbVtetIaoED AmwiHFYRuPN7DgTJm0IC5uI+nluTIWormpSxdh1ynYJKnqF4/yy94yYLmwe28wGAs3W2fX sDENWRww6NpYozZ3zj7OD5dKG3KgfO2d5AmR+sRs6RCbbXj3LHgTzVcdyXpi4I566M6wxK DZpqkffuiea9zT1GrB3KiYqmJnbVuIK4dqckM6gDREbre57ho8XJr7sfsfjLJtlmnVTNaJ JtklBBYNZ8OqTAlg/Y6tH2GScfKTo/xJvKaCWpeHucEdEueSRrDdAX/7hy7esQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780903153; a=rsa-sha256; cv=none; b=YcO7AaqZS398toFsFa4mfyoK9MLCbSUpjIgrFhMnbbGUTCYKZctzEdGv65KgQNTfgd6pbN cGHBCYdQpsfB7yPpqwlFQ2m0kNLnsrBRY+hxmxNa6rJp2g0BD/vNX/foiXulfGKmIFAcCR R6VtdVx27p+GfDTqCWo+7YGV4nvKPh1AGjxt56TkpEWrbHOA7SJ7U5Mac02c14TzXs2v+a E4JafL3Z2Om5weGxS4K4BVafGeFc6zdsl5PXkizfkCJbwNw3wKenzkSueNED5iEn70CQMu 1HduI5UJWEn/BNKujmwed/mEVkORDOiyccaVUw2O5DIQ8L8KWtCixfDTG3AOHw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780903153; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9naEUhYvO3h0X/IQklXEQfY6utZ9WnFZJYgDZHlsegg=; b=QLJ2w+PcfEwGUlCK2homM2dYihjrDB+0VTNIP7Y3kdJfFRVLKlJ4gbnhZ+hrGLhjbdSqdW xg1vVg3Rh6lCep52v7C5X2gPmefbRebSZ/9DX0w2WaEFIb3PAr9y24Nt17aigafFtQ7zwk HexgiRnHysWNRNQxwHhLG6AmQW1BphGlKp1dHK2eEO3A8BCFukhyuRwgtWNncXDSij6sxB uv04JIyJFBfWxbjziBdaw2GY1tUFHLWEOFxu4J/gcp/XVckLvgiQR7JF1CRdyKs6xZUSv3 ndpt8cLNBCJVhNGm+gPxUnRWyQ3FU50lYanZ+/FJousVpM+waqraFlUvBaX+eA== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4gYk1Y22cGzdkf for ; Mon, 08 Jun 2026 07:19:13 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 6587JDpD060415 for ; Mon, 8 Jun 2026 07:19:13 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 6587JD2S060413 for wireless@FreeBSD.org; Mon, 8 Jun 2026 07:19:13 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 295928] panic: race condition in kernel in linuxkpi 802.11 Date: Mon, 08 Jun 2026 07:19:13 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: wireless X-Bugzilla-Version: 15.1-STABLE X-Bugzilla-Keywords: crash X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: jan.edhorak@seznam.cz X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: wireless@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback+ mfc-stable15? mfc-stable14? X-Bugzilla-Changed-Fields: bug_severity Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-wireless List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-wireless@freebsd.org Sender: owner-freebsd-wireless@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D295928 Jan Hor=C3=A1k changed: What |Removed |Added ---------------------------------------------------------------------------- Severity|Affects Many People |Affects Some People --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Mon Jun 8 10:35:46 2026 X-Original-To: wireless@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gYpNL2fS3z6fnfD for ; Mon, 08 Jun 2026 10:35:46 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gYpNL20SJz3skf for ; Mon, 08 Jun 2026 10:35:46 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780914946; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+x+w0qYR2EBuH6Tvloegf+sFZbvVdN8SuDuQkD0KnHk=; b=yIfb6oiwDLC68rEQ879DINs8SsLlIyvkCsuAsphTAj+WadU7oA9R0b1+oN9jH9ok+kqfBZ JuNEZ2j3Iu2aP4OFMr3WgD4xEEkf5yP3JPOmRpWubaXge8G6j/ZnaA23hY1FYbmMBTYLcP D6eoI4L1AF4+T4x9rJD/1Sy0kFZrkey/SltizXQmR5qEy7HJjchZLisHIm2wqkItFwHkRt oxcl622BtoliyRtzZk+6OU93xxFYY3wtLyYSC2FgxVUnupTvfawqtcz5Vo7Xhz+UkxKiXe GKvMeqLW8bUUNT67gycrVDbWqqwU8ps/s7SRAclmGhfPMeuFMZMn4qickff4KA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780914946; a=rsa-sha256; cv=none; b=op8fwfVNRYlmcXA7soKj1KqD2kJ6URTJfU3Ozfb9xcMU73PXM0525rma0EiQf6Cujt213M nJci8g2zFt3xTH6T314y9hYUKYxmMYxnk5MVhuyQR6xq8XMlfyge3rmr6Ls4N7krwXLt42 YS6M6yPcyzNEaEi8m3E+qLWSdvMc8znbWZMKF6kakqEBu2BSaGbMdb1coiVU2E9t4qk+Qj dq4vV/2iLT+TI+eW/XZqAU33QzisrcT1nKXFzNGaS+C2oTcepnRLSqEJYcIpfPUm6rqkJG S89LRDEybJK4i/0CBPAcX2mgSSfrPoQ0uj8lO/Jv9I1yb0nNexFnGZ5SJVNCPw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780914946; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+x+w0qYR2EBuH6Tvloegf+sFZbvVdN8SuDuQkD0KnHk=; b=RXUoOd9cFsO8ST5r6pz5JKRpVifOdE9ZJ3EOji3MS2WAeRi4RaNvFtNRTWl4g1XMjQbLT7 c+Ac15vFdRdaDKZYWh7jrBzek+aSSv36xUqnrTQqzFu6fD6rEXyhEzCq3udZ7OHyTpyMht 8ZwVJl248IHsWY2k71nsZBAGn0DNKlHA/G1tyudPNKSbbYVegJ7Ok1Lf7YKVcqw29T8Whx P1ZTpFJyb0lWplLZBiWG//ck5UF3FMiepaZ881EyhGSma0KZiWa0WZLf3yk5t5jbEyG2Ha idO1k1CbTfr9NnyuM/Sq/OOwDS7Cz2SxAXQ5r95TbgojsFbfVc6hdbMGbNlfiA== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4gYpNL1bLTzlJY for ; Mon, 08 Jun 2026 10:35:46 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 658AZkrq075344 for ; Mon, 8 Jun 2026 10:35:46 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 658AZkWo075343 for wireless@FreeBSD.org; Mon, 8 Jun 2026 10:35:46 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 295928] panic: race condition in kernel in linuxkpi 802.11 Date: Mon, 08 Jun 2026 10:35:46 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: wireless X-Bugzilla-Version: 15.1-STABLE X-Bugzilla-Keywords: crash X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: jan.edhorak@seznam.cz X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: wireless@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback+ mfc-stable15? mfc-stable14? X-Bugzilla-Changed-Fields: blocked Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-wireless List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-wireless@freebsd.org Sender: owner-freebsd-wireless@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D295928 Jan Hor=C3=A1k changed: What |Removed |Added ---------------------------------------------------------------------------- Blocks| |273622 Referenced Bugs: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D273622 [Bug 273622] LinuxKPI based wireless drivers meta-bug --=20 You are receiving this mail because: You are the assignee for the bug.= From nobody Mon Jun 8 12:27:53 2026 X-Original-To: wireless@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gYrsk2wCKz6fy1X for ; Mon, 08 Jun 2026 12:27:54 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R13" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gYrsj6lSMz432v for ; Mon, 08 Jun 2026 12:27:53 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780921674; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RYlcCPEK/bOF3HQm42E6hjvF6at96vX/Km02pZJb1to=; b=tMAPy1jTDO5yPyTYrvXct1n6f3Zq54pkalUz+2XOAx+j+DHWY74G2JzaK6FLkfQcyfd1yU rRZ9Z3lGJbdrpW8Yk/1XwT1O2gbBfVN0hmp/l4akE4AR4rb34OcVkgi+PgCcthp1sqyiy5 trRpABd83swj0W9Uxc3yHgwasnLqCZ9CkoRfo01Yx+pW6e+22zsL+fo6beGzx35IcnNosW Iyaqhb3Ai7EYMgzW3umGz1J2B4oDM27+JrRGr0XgrqGEyxKid5o17KcOlSZEdiBbdr3UXW kfhnTN0rZCz2wQAsNVJwOjjKdUMI0tbJOrP4KWo/xFblCuud8+Yqxi/TFspWnw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1780921674; a=rsa-sha256; cv=none; b=ZYTycsXrn938S774Ph0i3v9hHgnwBUYwotsyvSCP8/TuVzhlxKqy7xbPBMsN4gOyKaAUF3 48wDd8eFDWIVHocrYBlAxU8e+fRBP9cQA3KGS0YKa5Hg4ZyjMOwigDw+RVnhXnQhCaVaW8 oKanxlbmX6xNTlelgfsJvSqmxZBFXlq1a6YDItrSCyxt1J9wZWB8ZjPVdDcsx39zHvAY4m Qt0SLWV24jVsMXAs5/glPzKr+5XkQ4xvGvwnd5EgqVIedFbbw8eruNXsPwivRvMJvCEDP+ BvwA/jJ+ZLrLo9YoI0WnQde8TgNZonEQEYOaUXT1xsIu6wDH2m1s/TmUqZOxxQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1780921674; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=RYlcCPEK/bOF3HQm42E6hjvF6at96vX/Km02pZJb1to=; b=HOS6Wf5JS+Bs16W35gGDyOYtpvjzEv2HJn+QHYjSaPSrGMXz4sZMCQJRV7vuM3poT+SNJ8 ARF2nD9gT3WFhev/Vob8NfkcVYCvnRuK1kUzsj6gbpdcxTNQ9DrLyAUygNXvkyCzyiI+MC ZWFCRJQYT7CxPybd5IxE2Hq65uDBnnZqQHVk1Ig21QYqX2A4v7s/Xqee5ILyYa5gGMIGQs QU5odL7zS/44KSCoJQfWnIC0F68KMNjCjyU6spvByOMDnvTp4XaNP6KIed6PXC+AZYFCij Jk7g9yxxevzLLMgGo7Raf/q1fGA4n0uZAVa7d5xx34dq3cWdEoZSwRO38oloSA== Received: from kenobi.freebsd.org (kenobi.freebsd.org [IPv6:2610:1c1:1:606c::50:1d]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4gYrsj5v0YzpJX for ; Mon, 08 Jun 2026 12:27:53 +0000 (UTC) (envelope-from bugzilla-noreply@freebsd.org) Received: from kenobi.freebsd.org ([127.0.1.5]) by kenobi.freebsd.org (8.15.2/8.15.2) with ESMTP id 658CRrea040900 for ; Mon, 8 Jun 2026 12:27:53 GMT (envelope-from bugzilla-noreply@freebsd.org) Received: (from www@localhost) by kenobi.freebsd.org (8.15.2/8.15.2/Submit) id 658CRre3040899 for wireless@FreeBSD.org; Mon, 8 Jun 2026 12:27:53 GMT (envelope-from bugzilla-noreply@freebsd.org) X-Authentication-Warning: kenobi.freebsd.org: www set sender to bugzilla-noreply@freebsd.org using -f From: bugzilla-noreply@freebsd.org To: wireless@FreeBSD.org Subject: [Bug 295928] panic: race condition in kernel in linuxkpi 802.11 Date: Mon, 08 Jun 2026 12:27:53 +0000 X-Bugzilla-Reason: AssignedTo X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: Base System X-Bugzilla-Component: wireless X-Bugzilla-Version: 15.1-STABLE X-Bugzilla-Keywords: crash X-Bugzilla-Severity: Affects Some People X-Bugzilla-Who: bz@FreeBSD.org X-Bugzilla-Status: New X-Bugzilla-Resolution: X-Bugzilla-Priority: --- X-Bugzilla-Assigned-To: wireless@FreeBSD.org X-Bugzilla-Flags: maintainer-feedback+ mfc-stable15? mfc-stable14? X-Bugzilla-Changed-Fields: cc see_also Message-ID: In-Reply-To: References: Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="UTF-8" X-Bugzilla-URL: https://bugs.freebsd.org/bugzilla/ Auto-Submitted: auto-generated List-Id: Discussions List-Archive: https://lists.freebsd.org/archives/freebsd-wireless List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-wireless@freebsd.org Sender: owner-freebsd-wireless@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D295928 Bjoern A. Zeeb changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |bz@FreeBSD.org See Also| |https://bugs.freebsd.org/bu | |gzilla/show_bug.cgi?id=3D2= 958 | |09 --- Comment #1 from Bjoern A. Zeeb --- This is not a race condition in LinuxKPI; this is net80211 creating/using a new ni (sta) for a next packet without tearing down the previous sta proper= ly or letting us setup the new one. iwlwifi seems to be able to deal with this at the current stage but rtw8x a= nd mt76 go kaboom. I believe there's at least another two PRs open related to this (or maybe i= t's just in my head as I've seen it) and the release notes for 15.1 indicate problems with certain rtw8x chipsets. I can think of a possible work around in LinuxKPI 802.11 but after all the years I got tired of implementing workarounds and the real fix is to get net80211 right now but that does not happen over night. --=20 You are receiving this mail because: You are the assignee for the bug.=