[DragonFlyBSD - Bug #1784] (Closed) wlan_crypt_tkip panic

bugtracker-admin at leaf.dragonflybsd.org bugtracker-admin at leaf.dragonflybsd.org
Sat Nov 27 08:21:45 PST 2021

Issue #1784 has been updated by tuxillo.

Status changed from Feedback to Closed
% Done changed from 0 to 100

There was a WLAN upgrade in 2015 (commit:085ff963b243cbeba68069d0b25c2b798c566b31) to what the FreeBSD code at that time (by Adrian).
I don't think this is no longer relevant.

Bug #1784: wlan_crypt_tkip panic

* Author: josepht
* Status: Closed
* Priority: Normal
* Category: Driver
* Target version: 6.2
Hey guys,

It seems I've either munged the iwn driver I'm working on or I'm
genuinely hitting an edge case in the TKIP code.  I got the following
panic.  I'm attaching a tarball of the source directory and can
include patches from the unaltered FreeBSD source if needed.

My main concerns regarding the wifi driver porting in general is my
weak understanding of the mbuf handling code and the bus_dma* code.

Any ideas are appreciated.

Unread portion of the kernel message buffer:
panic: not enough data, data_len 3 space 2

Trace beginning at frame 0xd801c9b4
panic(ffffffff) at panic+0x8e
panic(c0609324,3,2,db20f500,5f0873f1) at panic+0x8e
michael_mic(1a,3,d801ca2c,c465dff8,d7d682b8) at michael_mic+0x455
tkip_enmic(d7d6b784,db210000,0) at tkip_enmic+0xb5
ieee80211_encap(d7dbb9c0,d7d6b6b8,db20bd00,d7dbb9c0,d7d682b8) at
ieee80211_start(c48d8198,1,0,1,0) at ieee80211_start+0x657
ifq_dispatch(c48d8198,db20bd00,d801cb38) at ifq_dispatch+0x13a
ether_output_frame(c48d8198,db20bd00,db20bd9a,db20bd9a,0) at
ether_output(c48d8198,db20bd00,c4549570,c46ef940,14) at
ieee80211_output(c48d8198,db20bd00,c4549570,c46ef940,0) at
ip_output(db20bd00,0,d7c20104,10000,0) at ip_output+0xbc1
tcp_output(d7c20188,41eb68,0,db41eb68,1) at tcp_output+0x1449
tcp_usr_send(d7b616e0,0,c47b8700,0,0) at tcp_usr_send+0x1d3
netmsg_pru_send(db41eb68,c0714958,c0714958,d801cd84,c03def13) at
netmsg_service(db41eb68,1,0,c0714440,ff800000) at netmsg_service+0x58
tcpmsg_service_loop(0,0,0,0,0) at tcpmsg_service_loop+0x1d
lwkt_exit() at lwkt_exit

iwn.tgz (55.4 KB)

You have received this notification because you have either subscribed to it, or are involved in it.
To change your notification preferences, please click here: http://bugs.dragonflybsd.org/my/account

More information about the Bugs mailing list