Bug ID: 199676
           Summary: [net80211] [patch]: fix possible kernel panic in IBSS
                    mode (iv_bss may be freed twice)
           Product: Base System
           Version: 11.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Keywords: patch
          Severity: Affects Only Me
          Priority: ---
         Component: wireless
          Keywords: patch

Created attachment 155958
Remove old iv_bss entry from the node table

This may happen on RUN -> SCAN -> RUN -> SCAN state transition:

1. RUN -> SCAN: in ieee80211_sta_join1(): iv_bss will be moved to obss, refcnt
will be reduced by 2 (default minimum).

Now, if old iv_bss have some extra references (for example, from unacknowledged
probe responses), it will not be freed and will stay in the node table.

2. SCAN -> RUN.

3. If old iv_bss will not be deleted by the time when the next RUN -> SCAN
state transition occurs, then sta_leave() will reduce it's reference counter
once more. As a result, two last users will free it -> this will lead to kernel

In this patch old iv_bss entry is explicitly removed from the node table in
ieee80211_sta_join1() (as a result, it will not be processed by sta_leave()).

You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________ mailing list
To unsubscribe, send any mail to ""

Reply via email to