Re: current panics when Netgear WG511T ejected

Bruce M. Simpson wrote:
> Please try this patch.

slightly different this time, but it still panics. seems to be trying
to delete nonexistent addresses. should it even be here? i don't have
any multicast addrs defined, just one dhcp-assigned unicast addr.

ath0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
         ether 00:0f:b5:22:be:69
         inet 10.69.69.151 netmask 0xffffff00 broadcast 10.69.69.255
         media: IEEE 802.11 Wireless Ethernet autoselect (OFDM/54Mbps)
         status: associated
         ssid Doke channel 1 bssid 00:18:01:e4:fa:95
         authmode OPEN privacy MIXED deftxkey UNDEF wepkey 1:40-bit
         txpowmax 36 bmiss 7 protmode CTS burst bintval 100





[kali#:/boot/kernel:ttyp2] kgdb kernel.symbols /var/crash/vmcore.3
kgdb: kvm_nlist(_stopped_cpus): 
kgdb: kvm_nlist(_stoppcbs): 
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Undefined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
<5>ath0: link state changed to DOWN


Fatal trap 12: page fault while in kernel mode
fault virtual address   = 0x50
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc05ab9c9
stack pointer           = 0x28:0xc7b20b5c
frame pointer           = 0x28:0xc7b20b9c
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = interrupt enabled, resume, IOPL = 0
current process         = 25 (cbb0 event thread)
panic: from debugger
Uptime: 54s
Physical memory: 119 MB
Dumping 23 MB: 8

#0  doadump () at pcpu.h:172
172     pcpu.h: No such file or directory.
        in pcpu.h
(kgdb)  add-symbol-file /boot/kernel/if_ath.ko.symbols 0xc0791510
add symbol table from file "/boot/kernel/if_ath.ko.symbols" at
        .text_addr = 0xc0791510
(y or n) y
Reading symbols from /boot/kernel/if_ath.ko.symbols...done.
(kgdb) add-symbol-file /boot/kernel/ath_rate.ko.symbols 0xc07a1a50
add symbol table from file "/boot/kernel/ath_rate.ko.symbols" at
        .text_addr = 0xc07a1a50
(y or n) y
Reading symbols from /boot/kernel/ath_rate.ko.symbols...done.
(kgdb)  add-symbol-file /boot/kernel/wlan.ko.symbols 0xc07aaf00
add symbol table from file "/boot/kernel/wlan.ko.symbols" at
        .text_addr = 0xc07aaf00
(y or n) y
Reading symbols from /boot/kernel/wlan.ko.symbols...done.
(kgdb) bt
#0  doadump () at pcpu.h:172
#1  0xc0508fe6 in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:409
#2  0xc050934d in panic (fmt=0xc067fffe "from debugger")
    at /usr/src/sys/kern/kern_shutdown.c:563
#3  0xc042eee7 in db_panic (addr=-1067796023, have_addr=0, count=-1, 
    modif=0xc7b20908 "") at /usr/src/sys/ddb/db_command.c:433
#4  0xc042ee70 in db_command (last_cmdp=0xc06de1a4, cmd_table=0x0)
    at /usr/src/sys/ddb/db_command.c:401
#5  0xc042ef55 in db_command_loop () at /usr/src/sys/ddb/db_command.c:453
#6  0xc04311e5 in db_trap (type=12, code=0) at /usr/src/sys/ddb/db_main.c:222
#7  0xc052fda5 in kdb_trap (type=0, code=0, tf=0x0)
    at /usr/src/sys/kern/subr_kdb.c:502
#8  0xc066094c in trap_fatal (frame=0xc7b20b1c, eva=80)
    at /usr/src/sys/i386/i386/trap.c:859
#9  0xc0660625 in trap_pfault (frame=0xc7b20b1c, usermode=0, eva=80)
    at /usr/src/sys/i386/i386/trap.c:777
#10 0xc066019c in trap (frame=0xc7b20b1c) at /usr/src/sys/i386/i386/trap.c:462
#11 0xc064efab in calltrap () at /usr/src/sys/i386/i386/exception.s:139
#12 0xc05ab9c9 in rt_newmaddrmsg (cmd=-1048376320, ifma=0xc1923c00)
    at /usr/src/sys/net/rtsock.c:967
#13 0xc05a110c in if_delmulti_locked (ifp=0x0, ifma=0xc1923c00, detaching=1)
    at /usr/src/sys/net/if.c:2523
#14 0xc059cc76 in if_purgemaddrs (ifp=0xc17c0800) at /usr/src/sys/net/if.c:636
#15 0xc059cdf7 in if_detach (ifp=0xc17c0800) at /usr/src/sys/net/if.c:701
#16 0xc05a3a80 in ether_ifdetach (ifp=0xc17c0800)
    at /usr/src/sys/net/if_ethersubr.c:924
#17 0xc07ab5a2 in ieee80211_ifdetach (ic=0xc18393c8)
    at /usr/src/sys/modules/wlan/../../net80211/ieee80211.c:279
#18 0xc079220b in ath_detach (sc=0xc1839000)
    at /usr/src/sys/modules/ath/../../dev/ath/if_ath.c:669
#19 0xc079b1eb in ath_pci_detach (dev=0xc17e4500)
    at /usr/src/sys/modules/ath/../../dev/ath/if_ath_pci.c:223
#20 0xc0529a0a in device_detach (dev=0xc17e4500) at device_if.h:211
#21 0xc04549a4 in cardbus_detach_card (cbdev=0xc1755880)
    at /usr/src/sys/dev/cardbus/cardbus.c:235
#22 0xc0475509 in cbb_removal (sc=0xc1722000) at card_if.h:94
#23 0xc0475077 in cbb_event_thread (arg=0xc1722000)
    at /usr/src/sys/dev/pccbb/pccbb.c:486
#24 0xc04ecb30 in fork_exit (callout=0xc0474f20 <cbb_event_thread>, 
    arg=0xc1830c00, frame=0xc1830c00) at /usr/src/sys/kern/kern_fork.c:814
#25 0xc064f020 in fork_trampoline () at /usr/src/sys/i386/i386/exception.s:205
(kgdb) up 13
#13 0xc05a110c in if_delmulti_locked (ifp=0x0, ifma=0xc1923c00, detaching=1)
    at /usr/src/sys/net/if.c:2523
2523                    rt_newmaddrmsg(RTM_DELMADDR, ifma);
(kgdb) up
#14 0xc059cc76 in if_purgemaddrs (ifp=0xc17c0800) at /usr/src/sys/net/if.c:636
636                     if_delmulti_locked(ifp, ifma, 1);
(kgdb) l *0xc059cc76
0xc059cc76 is in if_purgemaddrs (/usr/src/sys/net/if.c:635).
630     {
631             struct ifmultiaddr *ifma;
632             struct ifmultiaddr *next;
633     
634             IF_ADDR_LOCK(ifp);
635             TAILQ_FOREACH_SAFE(ifma, &ifp->if_multiaddrs, ifma_link, next)
636                     if_delmulti_locked(ifp, ifma, 1);
637             IF_ADDR_UNLOCK(ifp);
638     }
639     
(kgdb) q
1.585u 0.151s 11:20.55 0.2%     2484+1180k 23+0io 1pf+0w