https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199676
--- Comment #1 from [email protected] --- A commit references this bug: Author: adrian Date: Sun May 3 22:28:43 UTC 2015 New revision: 282372 URL: https://svnweb.freebsd.org/changeset/base/282372 Log: Remove old iv_bss entry from the node table This may happen on RUN -> SCAN -> RUN -> SCAN state transition: 1. RUN -> SCAN: in ieee80211_sta_join1(): iv_bss will be moved to obss, refcnt will be reduced by 2 (default minimum). Now, if old iv_bss have some extra references (for example, from unacknowledged probe responses), it will not be freed and will stay in the node table. 2. SCAN -> RUN. 3. If old iv_bss will not be deleted by the time when the next RUN -> SCAN state transition occurs, then sta_leave() will reduce it's reference counter once more. As a result, two last users will free it -> this will lead to kernel panic. In this patch old iv_bss entry is explicitly removed from the node table in ieee80211_sta_join1() (as a result, it will not be processed by sta_leave()). PR: kern/199676 Differential Revision: Andriy Voskoboinyk <[email protected]> Changes: head/sys/net80211/ieee80211_node.c -- You are receiving this mail because: You are the assignee for the bug. _______________________________________________ [email protected] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-wireless To unsubscribe, send any mail to "[email protected]"
