Re: kern/59168: kernel crash in iwm

["Michael van Elst via gnats" <gnats-admin%NetBSD.org@localhost>]

The following reply was made to PR kern/59168; it has been noted by GNATS.

From: mlelstv%serpens.de@localhost (Michael van Elst)
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: kern/59168: kernel crash in iwm
Date: Tue, 11 Mar 2025 07:30:14 -0000 (UTC)

 rwhitlock22%gmail.com@localhost writes:
 
 >[ 43607.786698] panic: m_copydata(0xffff8ef8cd539068,88,0,0xffff918260855000): m=NULL, off=0 (0), len=12 (76)
 >[ 43607.786698] cpu0: Begin traceback...
 >[ 43607.786698] vpanic() at netbsd:vpanic+0x171
 >[ 43607.786698] panic() at netbsd:panic+0x3c
 >[ 43607.796698] m_copydata() at netbsd:m_copydata+0x13d
 >[ 43607.796698] bus_dmamap_sync() at netbsd:bus_dmamap_sync+0x381
 
 
 That's a mismatch between dma map and mbuf size. Usually without effect,
 but if e.g. the data needs to be bounced, the mbuf is copied to a DMA
 buffer and m_copydata() will notice if the mbuf is smaller than then
 sync length and will panic.
 
 iwm_rx_tx_cmd() does:
 
  bus_dmamap_sync(sc->sc_dmat, data->map, 0, IWM_RBUF_SIZE,
             BUS_DMASYNC_POSTREAD);
 
 which works only for RX because
 
         if (iwm_rx_addbuf(sc, IWM_RBUF_SIZE, sc->rxq.cur) != 0)
                 return;
 
 creates an mbuf of that size before loading it. But a TX buffer
 is always smaller than IWM_RBUF_SIZE (== 4096).