Please note: This project is no longer active. The website is kept online for historic purposes only.
If you´re looking for a Linux driver for your Atheros WLAN device, you should continue here .

Ticket #1595 (closed defect: fixed)

Opened 12 years ago

Last modified 12 years ago

reference count bug in _node_table_join function

Reported by: Tomasz Rostanski Assigned to:
Priority: minor Milestone: version 0.9.5
Component: madwifi: 802.11 stack Version: trunk
Keywords: Cc:
Patch is attached: 1 Pending:

Description

The TAILQ_INSERT_TAIL(head, elm, field) macro is being called as follows in the function _node_table_join:

TAILQ_INSERT_TAIL(&nt->nt_node, ieee80211_ref_node(ni), ni_list);

so in each place the (elm) will occur the preprocessor puts ieee80211_ref_node(ni). This makes the function references the node not once but 5 times.

Then the code in ieee80211_auth_open function:

1289	                if (ni == vap->iv_bss) {
1290	                        ni = ieee80211_dup_bss(vap, wh->i_addr2, 0);
1291	                        if (ni == NULL)
1292	                                return;
1293	
1294	                        IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1295	                        "%s: %p<%s> refcnt %d\n", __func__, ni, ether_sprintf(ni->ni_macaddr),
1296	                        ieee80211_node_refcnt(ni));
1297	                        tmpnode = 1;
1298	                }
1299	
1300	                IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1301	                IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1302	                        ni, "station authenticated (%s)", "open");
1303	                /*
1304	                 * When 802.1x is not in use mark the port
1305	                 * authorized at this point so traffic can flow.
1306	                 */
1307	                if (ni->ni_authmode != IEEE80211_AUTH_8021X)
1308	                        ieee80211_node_authorize(ni);
1309	                if (tmpnode)
1310	                        ieee80211_unref_node(&ni);

will create the temporary node, but this node will not be freed because the refcount value will be 6, so the ieee80211_unref_node simply reduce it to 5 and exit.

Attachments

_node_table_join_fix.diff (0.6 kB) - added by Tomasz Rostanski <rozteck@interia.pl> on 10/19/07 16:57:45.
This patch fixes the refcount stuff in _node_table_join function. Signed-off-by: Tomasz Rostanski <rozteck@interia.pl>

Change History

10/19/07 16:57:45 changed by Tomasz Rostanski <rozteck@interia.pl>

  • attachment _node_table_join_fix.diff added.

This patch fixes the refcount stuff in _node_table_join function. Signed-off-by: Tomasz Rostanski <rozteck@interia.pl>

10/22/07 16:41:53 changed by mrenzmann

  • milestone set to version 0.9.4.

Thanks for the patch.

@team: please review.

10/26/07 19:12:13 changed by anonymous

It appears this patch fixes #1563.

10/27/07 19:58:55 changed by mentor

  • status changed from new to closed.
  • resolution set to fixed.

r2792

Thanks

02/11/08 06:22:58 changed by mrenzmann

  • milestone changed from version 0.9.4 to version 0.9.5.