Date: Sat, 25 Apr 2015 01:04:06 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-wireless@FreeBSD.org Subject: [Bug 199676] [net80211] [patch]: fix possible kernel panic in IBSS mode (iv_bss may be freed twice) Message-ID: <bug-199676-21060@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199676 Bug ID: 199676 Summary: [net80211] [patch]: fix possible kernel panic in IBSS mode (iv_bss may be freed twice) Product: Base System Version: 11.0-CURRENT Hardware: Any OS: Any Status: New Keywords: patch Severity: Affects Only Me Priority: --- Component: wireless Assignee: freebsd-wireless@FreeBSD.org Reporter: s3erios@gmail.com Keywords: patch Created attachment 155958 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=155958&action=edit Remove old iv_bss entry from the node table This may happen on RUN -> SCAN -> RUN -> SCAN state transition: 1. RUN -> SCAN: in ieee80211_sta_join1(): iv_bss will be moved to obss, refcnt will be reduced by 2 (default minimum). Now, if old iv_bss have some extra references (for example, from unacknowledged probe responses), it will not be freed and will stay in the node table. 2. SCAN -> RUN. 3. If old iv_bss will not be deleted by the time when the next RUN -> SCAN state transition occurs, then sta_leave() will reduce it's reference counter once more. As a result, two last users will free it -> this will lead to kernel panic. In this patch old iv_bss entry is explicitly removed from the node table in ieee80211_sta_join1() (as a result, it will not be processed by sta_leave()). -- You are receiving this mail because: You are the assignee for the bug.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-199676-21060>