LOR: if_ath vs vm_map

This one occured in RELENG_6 from yesterday:

Sep 27 16:28:22 booky kernel: lock order reversal
Sep 27 16:28:22 booky kernel: 1st 0xc1885d30 ath0 (network driver) _at_
/usr/src/sys/dev/ath/if_ath.c:4641
Sep 27 16:28:22 booky kernel: 2nd 0xc150c620 user map (user map) _at_
/usr/src/sys/vm/vm_map.c:2997
Sep 27 16:28:22 booky kernel: KDB: stack backtrace:
Sep 27 16:28:22 booky kernel:
kdb_backtrace(0,ffffffff,c07e2d60,c07e3d28,c07a538c) at kdb_backtrace+0x29
Sep 27 16:28:22 booky kernel:
witness_checkorder(c150c620,9,c0774e40,bb5) at witness_checkorder+0x564
Sep 27 16:28:22 booky kernel: _sx_xlock(c150c620,c0774e40,bb5) at
_sx_xlock+0x50Sep 27 16:28:22 booky kernel:
_vm_map_lock_read(c150c5dc,c0774e40,bb5,277d0a2,c1624480) at
_vm_map_lock_read+0x37
Sep 27 16:28:22 booky kernel:
vm_map_lookup(dca3ba74,805d000,2,dca3ba78,dca3ba68) at vm_map_lookup+0x28
Sep 27 16:28:22 booky kernel: vm_fault(c150c5dc,805d000,2,8,c1628480) at
vm_fault+0x65
Sep 27 16:28:22 booky kernel: trap_pfault(dca3bb38,0,805d000) at
trap_pfault+0xce
Sep 27 16:28:22 booky kernel:
trap(dca30008,c06a0028,c1890028,805d000,c189f000)
at trap+0x331
Sep 27 16:28:22 booky kernel: calltrap() at calltrap+0x5
Sep 27 16:28:22 booky kernel: --- trap 0xc, eip = 0xc0706d9e, esp =
0xdca3bb78,
ebp = 0xdca3bbb0 ---
Sep 27 16:28:22 booky kernel:
generic_copyout(c187e800,c1892d80,c1885aac,c0286938,0) at
generic_copyout+0x36
Sep 27 16:28:22 booky kernel:
ieee80211_ioctl(c18851ac,c0286938,c1892d80,c1892d80,c18851ac) at
ieee80211_ioctl+0xc1
Sep 27 16:28:22 booky kernel:
ath_ioctl(c187e800,c0286938,c1892d80,dca3bc38,c055978c) at ath_ioctl+0x17c
Sep 27 16:28:22 booky kernel:
ifhwioctl(c0286938,c187e800,c1892d80,c1628480,dca3bc88) at ifhwioctl+0xa40
Sep 27 16:28:22 booky kernel:
ifioctl(c1953858,c0286938,c1892d80,c1628480,0) at
ifioctl+0xc3
Sep 27 16:28:22 booky kernel:
soo_ioctl(c18cd1b0,c0286938,c1892d80,c1501d00,c1628480) at soo_ioctl+0x2db
Sep 27 16:28:22 booky kernel: ioctl(c1628480,dca3bd04,3,2,292) at
ioctl+0x370
Sep 27 16:28:22 booky kernel: syscall(3b,3b,3b,805c028,6) at syscall+0x22f
Sep 27 16:28:22 booky kernel: Xint0x80_syscall() at Xint0x80_syscall+0x1f
Sep 27 16:28:22 booky kernel: --- syscall (54, FreeBSD ELF32, ioctl),
eip = 0x280c7b57, esp = 0xbfbfe8ac, ebp = 0xbfbfe8c8 ---

booky is "Thinkpad R40" with kernel:
FreeBSD 6.0-BETA5 FreeBSD 6.0-BETA5 #0: Mon Sep 26 22:44:40 CEST 2005
    i386

Martin