kern/57836: iwm(4) detach panic: TAILQ_* back 0xffffbd0091e99038 /home/riastradh/netbsd/current/src/sys/kern/subr_evcnt.c:212

[campbell+netbsd%mumble.net@localhost]

>Number:         57836
>Category:       kern
>Synopsis:       iwm(4) detach panic: TAILQ_* back 0xffffbd0091e99038 /home/riastradh/netbsd/current/src/sys/kern/subr_evcnt.c:212
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jan 11 20:00:01 +0000 2024
>Originator:     Taylor R Campbell
>Release:        current as of 2022-09-23
>Organization:
The NetBSDetach Foundation
>Environment:
>Description:
iwm(4) was acting up spewing unhandled firmware response messages like:

[ 2024070.294426] iwm0: autoconfiguration error: unhandled firmware response 0xffff 0xff/0x80 rx ring 127[255]
[ 2024070.394425] iwm0: autoconfiguration error: unhandled firmware response 0x9005 0x5/0xd0a04180 rx ring 59[10]

(This is a bug in its own right, of course.)

ifconfig down/up and restarting wpa_supplicant didn't take it out of this state, so I thought I'd try detach and reattach.  But upon `drvctl -d iwm0', the system panicked with:

[ 2024199.235937] panic: TAILQ_* back 0xffffbd0091e99038 /home/riastradh/netbsd/current/src/sys/kern/subr_evcnt.c:212
[ 2024199.235937] cpu0: Begin traceback...
[ 2024199.235937] vpanic() at netbsd:vpanic+0x183
[ 2024199.235937] panic() at netbsd:panic+0x3c
[ 2024199.235937] evcnt_detach() at netbsd:evcnt_detach+0xa9
[ 2024199.235937] intr_free_io_intrsource_direct() at netbsd:intr_free_io_intrsource_direct+0xb1
[ 2024199.235937] pci_msi_free_vectors() at netbsd:pci_msi_free_vectors+0x5d
[ 2024199.235937] x86_pci_msi_release() at netbsd:x86_pci_msi_release+0x40
[ 2024199.235937] iwm_detach() at netbsd:iwm_detach+0x303
[ 2024199.245937] config_detach_release() at netbsd:config_detach_release+0x1f4
[ 2024199.245937] drvctl_ioctl() at netbsd:drvctl_ioctl+0x306
[ 2024199.245937] sys_ioctl() at netbsd:sys_ioctl+0x56d
[ 2024199.245937] syscall() at netbsd:syscall+0x196

(gdb) bt
#0  0xffffffff80239b25 in cpu_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0)
    at /home/riastradh/netbsd/current/src/sys/arch/amd64/amd64/machdep.c:721
#1  0xffffffff80ddcf2f in kern_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0)
    at /home/riastradh/netbsd/current/src/sys/kern/kern_reboot.c:73
#2  0xffffffff80e246ed in vpanic (
    fmt=fmt@entry=0xffffffff81399587 "TAILQ_* back %p %s:%d",
    ap=ap@entry=0xffffbd10a08e1c08)
    at /home/riastradh/netbsd/current/src/sys/kern/subr_prf.c:293
#3  0xffffffff80e247c2 in panic (
    fmt=fmt@entry=0xffffffff81399587 "TAILQ_* back %p %s:%d")
    at /home/riastradh/netbsd/current/src/sys/kern/subr_prf.c:210
#4  0xffffffff80e1165c in evcnt_detach (ev=0xffffbd0091e99038)
    at /home/riastradh/netbsd/current/src/sys/kern/subr_evcnt.c:212
#5  0xffffffff80590a6b in intr_free_io_intrsource_direct (
    isp=0xffffbd0091e91000)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/x86/intr.c:402
#6  0xffffffff80592216 in intr_free_io_intrsource (intrid=<optimized out>)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/x86/intr.c:435
#7  0xffffffff805b486d in pci_msi_free_vectors (
    msi_pic=msi_pic@entry=0xffffdffd56f0a340,
    pihs=pihs@entry=0xffffe00c53f86180, count=count@entry=1)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/pci/pci_msi_machdep.c:144
#8  0xffffffff805b4bc5 in x86_pci_msi_release_internal (count=1,
    pihs=0xffffe00c53f86180)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/pci/pci_msi_machdep.c:348
#9  x86_pci_msi_release (pc=<optimized out>, pihs=0xffffe00c53f86180, count=1)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/pci/pci_msi_machdep.c:431
#10 0xffffffff803e1543 in iwm_detach (self=<optimized out>,
    flags=<optimized out>)
    at /home/riastradh/netbsd/current/src/sys/dev/pci/if_iwm.c:8351
#11 0xffffffff80e05d24 in config_detach_release (
    dev=dev@entry=0xffffdffd5753e780, flags=flags@entry=0)
    at /home/riastradh/netbsd/current/src/sys/kern/subr_autoconf.c:2148
#12 0xffffffff80e0629a in config_detach (dev=dev@entry=0xffffdffd5753e780,
    flags=flags@entry=0)
    at /home/riastradh/netbsd/current/src/sys/kern/subr_autoconf.c:2286
#13 0xffffffff80722181 in detachdevbyname (devname=0xffffbd10a08e1ee0 "iwm0")
    at /home/riastradh/netbsd/current/src/sys/kern/kern_drvctl.c:287
#14 drvctl_ioctl (fp=0xffffdffd621de180, cmd=<optimized out>,
    data=0xffffbd10a08e1ee0)
    at /home/riastradh/netbsd/current/src/sys/kern/kern_drvctl.c:380
#15 0xffffffff80e36e95 in sys_ioctl (l=<optimized out>,
    uap=0xffffbd10a08e2000, retval=<optimized out>)
    at /home/riastradh/netbsd/current/src/sys/kern/sys_generic.c:675
#16 0xffffffff805a536e in sy_call (rval=0xffffbd10a08e1fb0,
    uap=0xffffbd10a08e2000, l=0xffffe0033413e100,
    sy=0xffffffff81886610 <sysent+1296>)
    at /home/riastradh/netbsd/current/src/sys/sys/syscallvar.h:65
#17 sy_invoke (code=54, rval=0xffffbd10a08e1fb0, uap=0xffffbd10a08e2000,
    l=0xffffe0033413e100, sy=0xffffffff81886610 <sysent+1296>)
    at /home/riastradh/netbsd/current/src/sys/sys/syscallvar.h:94
#18 syscall (frame=0xffffbd10a08e2000)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/x86/syscall.c:138
#19 0xffffffff8021025d in handle_syscall ()
(gdb) fr 4
#4  0xffffffff80e1165c in evcnt_detach (ev=0xffffbd0091e99038)
    at /home/riastradh/netbsd/current/src/sys/kern/subr_evcnt.c:212
212             TAILQ_REMOVE(&allevents, ev, ev_list);
(gdb) print *ev
$1 = {ev_count = 107765382, ev_list = {tqe_next = 0xffffbd0091ea2038, 
    tqe_prev = 0xffffbd0091d29040}, ev_type = 1 '\001', 
  ev_grouplen = 4 '\004', ev_namelen = 5 '\005', ev_pad1 = 0 '\000', 
  ev_parent = 0x0, ev_group = 0xffffdffd5751d724 "msi2", 
  ev_name = 0xffffbd0091e99088 "vec 0"}
(gdb) fr 5
#5  0xffffffff80590a6b in intr_free_io_intrsource_direct (
    isp=0xffffbd0091e91000)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/x86/intr.c:402
402                     evcnt_detach(&isp->is_evcnt);
(gdb) print *isp
$2 = {is_maxlevel = 0, is_pin = 0, is_handlers = 0x0, 
  is_pic = 0xffffdffd56f0a340, is_recurse = 0x0, is_resume = 0x0, 
  is_lwp = 0x0, ipl_evt_mask1 = 0, ipl_evt_mask2 = {0 <repeats 4096 times>}, 
  is_evcnt = {ev_count = 107765382, ev_list = {tqe_next = 0xffffbd0091ea2038, 
      tqe_prev = 0xffffbd0091d29040}, ev_type = 1 '\001', 
    ev_grouplen = 4 '\004', ev_namelen = 5 '\005', ev_pad1 = 0 '\000', 
    ev_parent = 0x0, ev_group = 0xffffdffd5751d724 "msi2", 
    ev_name = 0xffffbd0091e99088 "vec 0"}, is_mask_count = 0, 
  is_distribute_pending = 0, is_flags = 0, is_type = 2, is_idtvec = 102, 
  is_minlevel = 8, is_evname = "vec 0", '\000' <repeats 26 times>, 
  is_intrid = "msi2 vec 0", '\000' <repeats 53 times>, 
  is_xname = "iwm0", '\000' <repeats 251 times>, is_active_cpu = 0, 
  is_saved_evcnt = 0xffffdffd5751d800, is_list = {
    sqe_next = 0xffffbd0091e9a000}}
(gdb) fr 7
#7  0xffffffff805b486d in pci_msi_free_vectors (
    msi_pic=msi_pic@entry=0xffffdffd56f0a340, 
    pihs=pihs@entry=0xffffe00c53f86180, count=count@entry=1)
    at /home/riastradh/netbsd/current/src/sys/arch/x86/pci/pci_msi_machdep.c:144
144                     intr_free_io_intrsource(intrstr);
(gdb) info locals
pih = <optimized out>
i = 0
intrstr = <optimized out>
intrstr_buf = "msi2 vec 0\000\201\377\377\377\377\020\245\360V\375\337\377\377@\344?T\f\340\377\377\377\377\377\377\377\377\377\377\000\035\216\240\020\275\377\377\247R[\200\377\377\377\377@\344?T\f\340\377\377"
>How-To-Repeat:
drvctl -d iwm0
>Fix:
Yes, please!

(It's possible this is already fixed but I don't see any obvious evidence of that in if_iwm.c,