Panic in rum(4) on 8.0-BETA2

Since upgrading from 7.2-RELEASE to 8.0-BETA2, I've been experiencing the
following panic on a regular basis:

: flz_at_cream:/var/crash; sudo kgdb -c vmcore.1 /boot/kernel/kernel.symbols
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are

welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd"...

Unread portion of the kernel message buffer:
Kernel page fault with the following non-sleepable locks held:
exclusive sleep mutex rum0 (network driver) r = 0 (0xc4ad29a4) locked _at_
/usr/src/sys/dev/usb/wlan/if_rum.c:1278
exclusive sleep mutex rum0_com_lock (rum0_com_lock) r = 0 (0xc4b06014)
locked _at_ /usr/src/sys/net80211/ieee80211_scan.c:683
KDB: stack backtrace:
db_trace_self_wrapper(c0c6baf4,f3694a60,c08bc995,c0c7edcd,2ab,...) at
db_trace_self_wrapper+0x26
kdb_backtrace(c0c7edcd,2ab,ffffffff,c0efbc54,f3694a98,...) at
kdb_backtrace+0x29
_witness_debugger(c0c6df35,f3694aac,4,1,0,...) at _witness_debugger+0x25
witness_warn(5,0,c0ca1b88,80246,c0db9aa0,...) at witness_warn+0x1fd
trap(f3694b38) at trap+0x173
calltrap() at calltrap+0x6
--- trap 0xc, eip = 0xc093f0e8, esp = 0xf3694b78, ebp = 0xf3694b94 ---
ieee80211_crypto_encap(c592d000,c4a0ca00,c0c58b19,4b3,c0efbc60,...) at
ieee80211_crypto_encap+0xa8
rum_start(c4ad2000,f3694c1c,c09232cf,c4ad2000,0,...) at rum_start+0x358
if_start(c4ad2000,0,c0c778c5,c01,52,...) at if_start+0x12
if_transmit(c4ad2000,c4a11100,c4a0b700,a4,c4b06000,...) at if_transmit+0x13f

ieee80211_start(c4691800,f3694ca4,c096918e,c4691800,5,...) at
ieee80211_start+0x661
if_start(c4691800,5,10,654,f3694ca4,...) at if_start+0x12
ieee80211_newstate_cb(c8cf9000,1,c0c6d2f0,54,c4ace8dc,...) at
ieee80211_newstate_cb+0x20e
taskqueue_run(c4ace8c0,c4ace8dc,0,c0c5e82b,0,...) at taskqueue_run+0x10b
taskqueue_thread_loop(c4b06074,f3694d38,c0c63ebc,342,c0db9aa0,...) at
taskqueue_thread_loop+0x68
fork_exit(c08b5b10,c4b06074,f3694d38) at fork_exit+0xb8
fork_trampoline() at fork_trampoline+0x8
--- trap 0, eip = 0, esp = 0xf3694d70, ebp = 0 ---


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address    = 0x20
fault code        = supervisor read, page not present
instruction pointer    = 0x20:0xc093f0e8
stack pointer            = 0x28:0xf3694b78
frame pointer            = 0x28:0xf3694b94
code segment        = base 0x0, limit 0xfffff, type 0x1b
            = DPL 0, pres 1, def32 1, gran 1
processor eflags    = interrupt enabled, resume, IOPL = 0
current process        = 0 (rum0 taskq)
panic: from debugger
cpuid = 0
Uptime: 40m53s
Physical memory: 1007 MB
Dumping 155 MB: 140 124 108 92 76 60 44 28 12

Reading symbols from /boot/kernel/snd_emu10kx.ko...Reading symbols from
/boot/kernel/snd_emu10kx.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/snd_emu10kx.ko
Reading symbols from /boot/kernel/sound.ko...Reading symbols from
/boot/kernel/sound.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/sound.ko
Reading symbols from /boot/kernel/atapicam.ko...Reading symbols from
/boot/kernel/atapicam.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/atapicam.ko
Reading symbols from /boot/kernel/fdescfs.ko...Reading symbols from
/boot/kernel/fdescfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/fdescfs.ko
Reading symbols from /boot/kernel/linprocfs.ko...Reading symbols from
/boot/kernel/linprocfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linprocfs.ko
Reading symbols from /boot/kernel/linux.ko...Reading symbols from
/boot/kernel/linux.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linux.ko
Reading symbols from /boot/kernel/linsysfs.ko...Reading symbols from
/boot/kernel/linsysfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/linsysfs.ko
Reading symbols from /boot/kernel/zfs.ko...Reading symbols from
/boot/kernel/zfs.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/zfs.ko
Reading symbols from /boot/kernel/opensolaris.ko...Reading symbols from
/boot/kernel/opensolaris.ko.symbols...done.
done.
Loaded symbols for /boot/kernel/opensolaris.ko
#0  doadump () at pcpu.h:246
246    pcpu.h: No such file or directory.
    in pcpu.h
(kgdb) doadump
Undefined command: "doadump".  Try "help".
(kgdb) help
List of classes of commands:

aliases -- Aliases of other commands
breakpoints -- Making program stop at certain points
data -- Examining data
files -- Specifying and examining files
internals -- Maintenance commands
obscure -- Obscure features
running -- Running the program
stack -- Examining the stack
status -- Status inquiries
support -- Support facilities
tracepoints -- Tracing of program execution without stopping the program
user-defined -- User-defined commands

Type "help" followed by a class name for a list of commands in that class.
Type "help" followed by command name for full documentation.
Command name abbreviations are allowed if unambiguous.
(kgdb) bt
#0  doadump () at pcpu.h:246
#1  0xc087ba2e in boot (howto=260) at /usr/src/sys/kern/kern_shutdown.c:419
#2  0xc087bd02 in panic (fmt=Variable "fmt" is not available.
) at /usr/src/sys/kern/kern_shutdown.c:575
#3  0xc04caf57 in db_panic (addr=Could not find the frame base for
"db_panic".
) at /usr/src/sys/ddb/db_command.c:478
#4  0xc04cb581 in db_command (last_cmdp=0xc0d8963c, cmd_table=0x0,
dopager=1) at /usr/src/sys/ddb/db_command.c:445
#5  0xc04cb6da in db_command_loop () at /usr/src/sys/ddb/db_command.c:498
#6  0xc04cd56d in db_trap (type=12, code=0) at
/usr/src/sys/ddb/db_main.c:229
#7  0xc08a9696 in kdb_trap (type=12, code=0, tf=0xf3694b38) at
/usr/src/sys/kern/subr_kdb.c:534
#8  0xc0ba88cf in trap_fatal (frame=0xf3694b38, eva=32) at
/usr/src/sys/i386/i386/trap.c:924
#9  0xc0ba9231 in trap (frame=0xf3694b38) at
/usr/src/sys/i386/i386/trap.c:325
#10 0xc0b8b9db in calltrap () at /usr/src/sys/i386/i386/exception.s:165
#11 0xc093f0e8 in ieee80211_crypto_encap (ni=0xc592d000, m=0xc4a0ca00) at
/usr/src/sys/net80211/ieee80211_crypto.c:560
#12 0xc07c4c68 in rum_start (ifp=0xc4ad2000) at
/usr/src/sys/dev/usb/wlan/if_rum.c:1216
#13 0xc0922be2 in if_start (ifp=0xc4ad2000) at /usr/src/sys/net/if.c:3061
#14 0xc09232cf in if_transmit (ifp=0xc4ad2000, m=0xc4a11100) at
/usr/src/sys/net/if.c:3073
#15 0xc0963711 in ieee80211_start (ifp=0xc4691800) at
/usr/src/sys/net80211/ieee80211_output.c:347
#16 0xc0922be2 in if_start (ifp=0xc4691800) at /usr/src/sys/net/if.c:3061
#17 0xc096918e in ieee80211_newstate_cb (xvap=0xc8cf9000, npending=1) at
/usr/src/sys/net80211/ieee80211_proto.c:1681
#18 0xc08b5a1b in taskqueue_run (queue=0xc4ace8c0) at
/usr/src/sys/kern/subr_taskqueue.c:282
#19 0xc08b5b78 in taskqueue_thread_loop (arg=0xc4b06074) at
/usr/src/sys/kern/subr_taskqueue.c:403
#20 0xc0852238 in fork_exit (callout=0xc08b5b10 <taskqueue_thread_loop>,
arg=0xc4b06074, frame=0xf3694d38) at /usr/src/sys/kern/kern_fork.c:842
#21 0xc0b8ba50 in fork_trampoline () at
/usr/src/sys/i386/i386/exception.s:270

I noticed that shortly before it happens, I also get the following message
from wpa_supplicant: "Failed to disable WPA in the driver".

-- 
Florent Thoumie
flz_at_FreeBSD.org
FreeBSD Committer