Re: kern/52553: Panic on "ifconfig athn0 up"

[Nick Hudson <skrll%netbsd.org@localhost>]

The following reply was made to PR kern/52553; it has been noted by GNATS.

From: Nick Hudson <skrll%netbsd.org@localhost>
To: gnats-bugs%NetBSD.org@localhost, kern-bug-people%netbsd.org@localhost,
 gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/52553: Panic on "ifconfig athn0 up"
Date: Thu, 21 Sep 2017 20:47:53 +0100

 This is a multi-part message in MIME format.
 --------------650FB972A3FA2865F1CE1300
 Content-Type: text/plain; charset=utf-8; format=flowed
 Content-Transfer-Encoding: 7bit
 
 On 09/18/17 17:05, Andreas Gustafsson wrote:
 >    while true; do ifconfig athn0 down; ifconfig athn0 up; done
 
 Please try this patch...
 
 Nick
 
 
 --------------650FB972A3FA2865F1CE1300
 Content-Type: text/x-patch;
  name="if_athn_usb.c.diff"
 Content-Transfer-Encoding: 7bit
 Content-Disposition: attachment;
  filename="if_athn_usb.c.diff"
 
 Index: sys/dev/usb/if_athn_usb.c
 ===================================================================
 RCS file: /cvsroot/src/sys/dev/usb/if_athn_usb.c,v
 retrieving revision 1.22
 diff -u -p -r1.22 if_athn_usb.c
 --- sys/dev/usb/if_athn_usb.c	1 Jun 2017 02:45:11 -0000	1.22
 +++ sys/dev/usb/if_athn_usb.c	21 Sep 2017 19:42:29 -0000
 @@ -728,9 +728,15 @@ athn_usb_alloc_tx_list(struct athn_usb_s
  		/* Append this Tx buffer to our free list. */
  		TAILQ_INSERT_TAIL(&usc->usc_tx_free_list, data, next);
  	}
 -	if (error != 0)
 +	if (error == 0) {
 +		/* Steal one buffer for beacons. */
 +		usc->usc_tx_bcn = TAILQ_FIRST(&usc->usc_tx_free_list);
 +		TAILQ_REMOVE(&usc->usc_tx_free_list, usc->usc_tx_bcn, next);
 +	} else {
  		athn_usb_free_tx_list(usc);
 +	}
  	mutex_exit(&usc->usc_tx_mtx);
 +
  	return error;
  }
  
 @@ -749,6 +755,8 @@ athn_usb_free_tx_list(struct athn_usb_so
  		if (xfer != NULL)
  			usbd_destroy_xfer(xfer);
  	}
 +	if (usc->usc_tx_bcn)
 +		usbd_destroy_xfer(usc->usc_tx_bcn->xfer);
  }
  
  Static int
 @@ -2756,12 +2764,6 @@ athn_usb_init_locked(struct ifnet *ifp)
  	usc->usc_cmdq.cur = usc->usc_cmdq.next = usc->usc_cmdq.queued = 0;
  	mutex_spin_exit(&usc->usc_task_mtx);
  
 -	/* Steal one buffer for beacons. */
 -	mutex_enter(&usc->usc_tx_mtx);
 -	usc->usc_tx_bcn = TAILQ_FIRST(&usc->usc_tx_free_list);
 -	TAILQ_REMOVE(&usc->usc_tx_free_list, usc->usc_tx_bcn, next);
 -	mutex_exit(&usc->usc_tx_mtx);
 -
  	curchan = ic->ic_curchan;
  	extchan = NULL;
  
 
 --------------650FB972A3FA2865F1CE1300--