https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=199676

--- Comment #1 from commit-h...@freebsd.org ---
A commit references this bug:

Author: adrian
Date: Sun May  3 22:28:43 UTC 2015
New revision: 282372
URL: https://svnweb.freebsd.org/changeset/base/282372

Log:
  Remove old iv_bss entry from the node table

  This may happen on RUN -> SCAN -> RUN -> SCAN state transition:

  1. RUN -> SCAN: in ieee80211_sta_join1(): iv_bss will be moved to obss,
     refcnt will be reduced by 2 (default minimum).

  Now, if old iv_bss have some extra references (for example, from
  unacknowledged probe responses), it will not be freed and will stay
  in the node table.

  2. SCAN -> RUN.

  3. If old iv_bss will not be deleted by the time when the next RUN -> SCAN
     state transition occurs, then sta_leave() will reduce it's reference
     counter once more. As a result, two last users will free it -> this will
     lead to kernel panic.

  In this patch old iv_bss entry is explicitly removed from the node table in
  ieee80211_sta_join1() (as a result, it will not be processed by sta_leave()).

  PR:        kern/199676
  Differential Revision:    Andriy Voskoboinyk <s3er...@gmail.com>

Changes:
  head/sys/net80211/ieee80211_node.c

-- 
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-wireless@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-wireless
To unsubscribe, send any mail to "freebsd-wireless-unsubscr...@freebsd.org"

Reply via email to