freebsd kernel with SKQ
e94527beaf
from a management frame transmission. This bug is a bit loopy, so here goes. The underlying cause is pretty easy to understand - the node isn't referenced before passing into the callout, so if the node is deleted before the callout fires, it'll dereference free'd memory. The code path however is slightly more convoluted. The functions _say_ mgt_tx - ie management transmit - which is partially true. Yes, that callback is attached to the mbuf for some management frames. However, it's only for frames relating to scanning and authentication attempts. It helpfully drives the VAP state back to "SCAN" if the transmission fails _OR_ (as I subsequently found out!) if the transmission succeeds but the state machine doesn't make progress towards being authenticated and active. Now, the code itself isn't terribly clear about this. It _looks_ like it's just handling the transmit failure case. However, when you look at what goes on in the transmit success case, it's moving the VAP state back to SCAN if it hasn't changed state since the time the callback was scheduled. Ie, if it's in ASSOC or AUTH still, it'll go back to SCAN. But if it has transitioned to the RUN state, the comparison will fail and it'll not transition things back to the SCAN state. So, to fix this, I decided to leave everything the way it is and merely fix the locking and remove the node reference. The _better_ fix would be to turn this callout into a "assoc/auth request" timeout callback and make the callout locked, thus eliminating all races. However, until all the drivers have been fixed so that transmit completions occur outside of any locking that's going on, it's going to be impossible to do this without introducing LORs. So, I leave some of the evilness in there. Tested: * AR5212, ath(4), STA mode * 5100 and 4965 wifi, iwn(4), STA mode |
||
---|---|---|
bin | ||
cddl | ||
contrib | ||
crypto | ||
etc | ||
games | ||
gnu | ||
include | ||
kerberos5 | ||
lib | ||
libexec | ||
release | ||
rescue | ||
sbin | ||
secure | ||
share | ||
sys | ||
tools | ||
usr.bin | ||
usr.sbin | ||
COPYRIGHT | ||
LOCKS | ||
MAINTAINERS | ||
Makefile | ||
Makefile.inc1 | ||
ObsoleteFiles.inc | ||
README | ||
UPDATING |
This is the top level of the FreeBSD source directory. This file was last revised on: $FreeBSD$ For copyright information, please see the file COPYRIGHT in this directory (additional copyright information also exists for some sources in this tree - please see the specific source directories for more information). The Makefile in this directory supports a number of targets for building components (or all) of the FreeBSD source tree, the most commonly used one being ``world'', which rebuilds and installs everything in the FreeBSD system from the source tree except the kernel, the kernel-modules and the contents of /etc. The ``world'' target should only be used in cases where the source tree has not changed from the currently running version. See: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/makeworld.html for more information, including setting make(1) variables. The ``buildkernel'' and ``installkernel'' targets build and install the kernel and the modules (see below). Please see the top of the Makefile in this directory for more information on the standard build targets and compile-time flags. Building a kernel is a somewhat more involved process, documentation for which can be found at: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/kernelconfig.html And in the config(8) man page. Note: If you want to build and install the kernel with the ``buildkernel'' and ``installkernel'' targets, you might need to build world before. More information is available in the handbook. The sample kernel configuration files reside in the sys/<arch>/conf sub-directory (assuming that you've installed the kernel sources), the file named GENERIC being the one used to build your initial installation kernel. The file NOTES contains entries and documentation for all possible devices, not just those commonly used. It is the successor of the ancient LINT file, but in contrast to LINT, it is not buildable as a kernel but a pure reference and documentation file. Source Roadmap: --------------- bin System/user commands. cddl Various commands and libraries under the Common Development and Distribution License. contrib Packages contributed by 3rd parties. crypto Cryptography stuff (see crypto/README). etc Template files for /etc. games Amusements. gnu Various commands and libraries under the GNU Public License. Please see gnu/COPYING* for more information. include System include files. kerberos5 Kerberos5 (Heimdal) package. lib System libraries. libexec System daemons. release Release building Makefile & associated tools. rescue Build system for statically linked /rescue utilities. sbin System commands. secure Cryptographic libraries and commands. share Shared resources. sys Kernel sources. tools Utilities for regression testing and miscellaneous tasks. usr.bin User commands. usr.sbin System administration commands. For information on synchronizing your source tree with one or more of the FreeBSD Project's development branches, please see: http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/synching.html