kern/58933: panic in athn after wifi router rebooted, diagnostic assertion "ci->ci_mtx_count == -1" failed

["T K Spindler (moof)" <dogcow%babymeat.com@localhost>]

>Number:         58933
>Category:       kern
>Synopsis:       panic in athn after wifi router rebooted,  diagnostic assertion "ci->ci_mtx_count == -1" failed
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Dec 24 22:20:00 +0000 2024
>Originator:     "T K Spindler (moof)" <dogcow%babymeat.com@localhost>
>Release:        NetBSD 10.1
>Organization:

>Environment:
ystem: NetBSD chungus.babymeat.com 10.1 NetBSD 10.1 (CHUNGUS) #0: Tue Dec 17 11:44:53 CST 2024 dogcow%chungus.babymeat.com@localhost:/crap/obj/10obj/usr/src/sys/arch/amd64/compile/CHUNGUS amd64
Architecture: x86_64
Machine: amd64
>Description:
After rebooting my wifi router, got a panic
[ 313028.349718] panic: kernel diagnostic assertion "ci->ci_mtx_count == -1" failed: file "/usr/src/sys/kern/kern_synch.c", line 726 mi_switch: cpu1: ci_mtx_count (-2) != -1 (block with spin-mutex held)

backtrace:
(gdb) bt
#0  0xffffffff80233c25 in cpu_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0) at /usr/src/sys/arch/amd64/amd64/machdep.c:717
#1  0xffffffff805381e4 in kern_reboot (howto=howto@entry=260,
    bootstr=bootstr@entry=0x0) at /usr/src/sys/kern/kern_reboot.c:73
#2  0xffffffff8057fe45 in vpanic (
    fmt=0xffffffff80945db8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d %s: cpu%u: ci_mtx_count (%d) != -1 (block with spin-mutex held)",
    ap=ap@entry=0xffffd3070916a958) at /usr/src/sys/kern/subr_prf.c:291
#3  0xffffffff806e3e57 in kern_assert (
    fmt=fmt@entry=0xffffffff80945db8 "kernel %sassertion \"%s\" failed: file \"%s\", line %d %s: cpu%u: ci_mtx_count (%d) != -1 (block with spin-mutex held)")
    at /usr/src/sys/lib/libkern/kern_assert.c:51
#4  0xffffffff8054a50b in mi_switch (l=l@entry=0xfffff3c2f10551c0)
    at /usr/src/sys/sys/cpu.h:108
#5  0xffffffff805463fb in sleepq_block (timo=timo@entry=0,
    catch_p=catch_p@entry=false,
    syncobj=syncobj@entry=0xffffffff80c17740 <cv_syncobj>)
    at /usr/src/sys/kern/kern_sleepq.c:351
#6  0xffffffff80502238 in cv_wait (cv=0xffffd30030947cc0,
    mtx=0xffffd30030947cd0) at /usr/src/sys/kern/kern_condvar.c:174
#7  0xffffffff802e1d67 in athn_usb_wait_async (usc=0xffffd30030945000)
    at /usr/src/sys/dev/usb/if_athn_usb.c:907
#8  athn_usb_stop_locked (ifp=ifp@entry=0xffffd30030945d40)
    at /usr/src/sys/dev/usb/if_athn_usb.c:2943
#9  0xffffffff802e27df in athn_usb_stop (disable=0, ifp=0xffffd30030945d40)
    at /usr/src/sys/dev/usb/if_athn_usb.c:2924
#10 athn_usb_media_change (ifp=0xffffd30030945d40)
    at /usr/src/sys/dev/usb/if_athn_usb.c:1404
#11 athn_usb_media_change (ifp=0xffffd30030945d40)
    at /usr/src/sys/dev/usb/if_athn_usb.c:1391
#12 0xffffffff806406f7 in ifmedia_change (ifm=ifm@entry=0xffffd30030945a30,
    ifp=ifp@entry=0xffffd30030945d40) at /usr/src/sys/net/if_media.c:244
#13 0xffffffff80640c14 in ifmedia_ioctl (ifp=0xffffd30030945d40,
    ifr=<optimized out>, ifm=0xffffd30030945a30, cmd=<optimized out>)
    at /usr/src/sys/net/if_media.c:479
#14 0xffffffff802e3db1 in athn_usb_ioctl (ifp=0xffffd30030945d40,
    cmd=3230689591, data=0xfffff3c4a80db300)
    at /usr/src/sys/dev/usb/if_athn_usb.c:2726
#15 0xffffffff806340c4 in doifioctl (so=0xfffff3c2f114d038,
    cmd=<optimized out>, data=0xfffff3c4a80db300, l=0xfffff3c2f10551c0)
    at /usr/src/sys/net/if.c:3582
#16 0xffffffff8059270f in sys_ioctl (l=<optimized out>,
    uap=0xffffd3070916af00, retval=<optimized out>)
    at /usr/src/sys/kern/sys_generic.c:675
#17 0xffffffff8031f9a4 in sy_call (rval=0xffffd3070916aeb0,
    uap=0xffffd3070916af00, l=0xfffff3c2f10551c0,
    sy=0xffffffff80c14bf0 <sysent+1296>) at /usr/src/sys/sys/syscallvar.h:65
#18 sy_invoke (code=54, rval=0xffffd3070916aeb0, uap=0xffffd3070916af00,
    l=0xfffff3c2f10551c0, sy=0xffffffff80c14bf0 <sysent+1296>)
    at /usr/src/sys/sys/syscallvar.h:94
#19 syscall (frame=0xffffd3070916af00)
    at /usr/src/sys/arch/x86/x86/syscall.c:138
#20 0xffffffff8020b68d in handle_syscall ()
#21 0x0000000000000004 in ?? ()
#22 0x00000000c0906937 in ?? ()
#23 0x00007f7fff019750 in ?? ()
#24 0x00007f7fff01975f in ?? ()
#25 0x00007b2eb049a108 in ?? ()
#26 0x00007b2eb05194a8 in ?? ()
#27 0x0000000000000000 in ?? ()


>How-To-Repeat:
power-cycle wifi router again

>Fix:





>Unformatted: