[Bug 199676] [net80211] [patch]: fix possible kernel panic in IBSS mode (iv_bss may be freed twice)
bugzilla-noreply at freebsd.org
bugzilla-noreply at freebsd.org
Sat Apr 25 01:04:06 UTC 2015
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199676
Bug ID: 199676
Summary: [net80211] [patch]: fix possible kernel panic in IBSS
mode (iv_bss may be freed twice)
Product: Base System
Version: 11.0-CURRENT
Hardware: Any
OS: Any
Status: New
Keywords: patch
Severity: Affects Only Me
Priority: ---
Component: wireless
Assignee: freebsd-wireless at FreeBSD.org
Reporter: s3erios at gmail.com
Keywords: patch
Created attachment 155958
--> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=155958&action=edit
Remove old iv_bss entry from the node table
This may happen on RUN -> SCAN -> RUN -> SCAN state transition:
1. RUN -> SCAN: in ieee80211_sta_join1(): iv_bss will be moved to obss, refcnt
will be reduced by 2 (default minimum).
Now, if old iv_bss have some extra references (for example, from unacknowledged
probe responses), it will not be freed and will stay in the node table.
2. SCAN -> RUN.
3. If old iv_bss will not be deleted by the time when the next RUN -> SCAN
state transition occurs, then sta_leave() will reduce it's reference counter
once more. As a result, two last users will free it -> this will lead to kernel
panic.
In this patch old iv_bss entry is explicitly removed from the node table in
ieee80211_sta_join1() (as a result, it will not be processed by sta_leave()).
--
You are receiving this mail because:
You are the assignee for the bug.
More information about the freebsd-wireless
mailing list