Attachment #155954 for bug #199672

View | Details | Raw Unified | Return to bug 199672
Collapse All | Expand All




void
ieee80211_node_deauth(struct ieee80211_node *ni, int reason)
{
	/* NB: bump the refcnt to be sure temporary nodes are not reclaimed */
	ieee80211_ref_node(ni);
	if (ni->ni_associd != 0)
		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH, reason);

	ni->ni_ic->ic_node_free(ni);
}

/*
 * Clear any entry in the unicast key mapping table.
 */
static int
node_clear_keyixmap(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
{
	ieee80211_keyix keyix;

	keyix = ni->ni_ucastkey.wk_rxkeyix;
	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
	    nt->nt_keyixmap[keyix] == ni) {
		IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
			"%s: %p<%s> clear key map entry %u\n",
			__func__, ni, ether_sprintf(ni->ni_macaddr), keyix);
		nt->nt_keyixmap[keyix] = NULL;
		ieee80211_node_decref(ni);
		return 1;
	}

	return 0;
}

void
#ifdef IEEE80211_DEBUG_REFCNT
ieee80211_free_node_debug(struct ieee80211_node *ni, const char *func, int line)

			 * Last reference, reclaim state.
			 */
			_ieee80211_free_node(ni);
		} else if (ieee80211_node_refcnt(ni) == 1)
			if (node_clear_keyixmap(nt, ni))
			ieee80211_keyix keyix;
			/*
			 * Check for a last reference in the key mapping table.
			 */
			keyix = ni->ni_ucastkey.wk_rxkeyix;
			if (keyix < nt->nt_keyixmax &&
			    nt->nt_keyixmap[keyix] == ni) {
				IEEE80211_DPRINTF(ni->ni_vap,
				    IEEE80211_MSG_NODE,
				    "%s: %p<%s> clear key map entry", __func__,
				    ni, ether_sprintf(ni->ni_macaddr));
				nt->nt_keyixmap[keyix] = NULL;
				ieee80211_node_decref(ni); /* XXX needed? */
				_ieee80211_free_node(ni);
			}
		}
		IEEE80211_NODE_UNLOCK(nt);
	} else {
		if (ieee80211_node_dectestref(ni))

static void
node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
{
	ieee80211_keyix keyix;

	IEEE80211_NODE_LOCK_ASSERT(nt);


	 * table.  We cannot depend on the mapping table entry
	 * being cleared because the node may not be free'd.
	 */
	(void)node_clear_keyixmap(nt, ni);
	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
	    nt->nt_keyixmap[keyix] == ni) {
		IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
			"%s: %p<%s> clear key map entry %u\n",
			__func__, ni, ether_sprintf(ni->ni_macaddr), keyix);
		nt->nt_keyixmap[keyix] = NULL;
		ieee80211_node_decref(ni);	/* NB: don't need free */
	}
	if (!ieee80211_node_dectestref(ni)) {
		/*
		 * Other references are present, just remove the

Return to bug 199672

Lines 871-877 Link Here

(-)sys/net80211/ieee80211_node.c (-28 / +26 lines)
871	void	879	void
872	ieee80211_node_deauth(struct ieee80211_node *ni, int reason)	880	ieee80211_node_deauth(struct ieee80211_node *ni, int reason)
873	{	881	{
874	/* NB: bump the refcnt to be sure temporay nodes are not reclaimed */	882	/* NB: bump the refcnt to be sure temporary nodes are not reclaimed */
875	ieee80211_ref_node(ni);	883	ieee80211_ref_node(ni);
876	if (ni->ni_associd != 0)	884	if (ni->ni_associd != 0)
877	IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH, reason);	885	IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
Lines 1749-1754 Link Here
1749	ni->ni_ic->ic_node_free(ni);	1757	ni->ni_ic->ic_node_free(ni);
1750	}	1758	}
1751		1759
		1760	/*
		1761	* Clear any entry in the unicast key mapping table.
		1762	*/
		1763	static int
		1764	node_clear_keyixmap(struct ieee80211_node_table nt, struct ieee80211_node ni)
		1765	{
		1766	ieee80211_keyix keyix;
		1767
		1768	keyix = ni->ni_ucastkey.wk_rxkeyix;
		1769	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
		1770	nt->nt_keyixmap[keyix] == ni) {
		1771	IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
		1772	"%s: %p<%s> clear key map entry %u\n",
		1773	__func__, ni, ether_sprintf(ni->ni_macaddr), keyix);
		1774	nt->nt_keyixmap[keyix] = NULL;
		1775	ieee80211_node_decref(ni);
		1776	return 1;
		1777	}
		1778
		1779	return 0;
		1780	}
		1781
1752	void	1782	void
1753	#ifdef IEEE80211_DEBUG_REFCNT	1783	#ifdef IEEE80211_DEBUG_REFCNT
1754	ieee80211_free_node_debug(struct ieee80211_node ni, const char func, int line)	1784	ieee80211_free_node_debug(struct ieee80211_node ni, const char func, int line)
Lines 1770-1793 Link Here
1770	* Last reference, reclaim state.	1800	* Last reference, reclaim state.
1771	*/	1801	*/
1772	_ieee80211_free_node(ni);	1802	_ieee80211_free_node(ni);
1773	} else if (ieee80211_node_refcnt(ni) == 1 &&	1803	} else if (ieee80211_node_refcnt(ni) == 1)
1774	nt->nt_keyixmap != NULL) {	1804	if (node_clear_keyixmap(nt, ni))
1775	ieee80211_keyix keyix;
1776	/*
1777	* Check for a last reference in the key mapping table.
1778	*/
1779	keyix = ni->ni_ucastkey.wk_rxkeyix;
1780	if (keyix < nt->nt_keyixmax &&
1781	nt->nt_keyixmap[keyix] == ni) {
1782	IEEE80211_DPRINTF(ni->ni_vap,
1783	IEEE80211_MSG_NODE,
1784	"%s: %p<%s> clear key map entry", __func__,
1785	ni, ether_sprintf(ni->ni_macaddr));
1786	nt->nt_keyixmap[keyix] = NULL;
1787	ieee80211_node_decref(ni); /* XXX needed? */
1788	_ieee80211_free_node(ni);	1805	_ieee80211_free_node(ni);
1789	}
1790	}
1791	IEEE80211_NODE_UNLOCK(nt);	1806	IEEE80211_NODE_UNLOCK(nt);
1792	} else {	1807	} else {
1793	if (ieee80211_node_dectestref(ni))	1808	if (ieee80211_node_dectestref(ni))
Lines 1855-1861 Link Here
1855	static void	1870	static void
1856	node_reclaim(struct ieee80211_node_table nt, struct ieee80211_node ni)	1871	node_reclaim(struct ieee80211_node_table nt, struct ieee80211_node ni)
1857	{	1872	{
1858	ieee80211_keyix keyix;
1859		1873
1860	IEEE80211_NODE_LOCK_ASSERT(nt);	1874	IEEE80211_NODE_LOCK_ASSERT(nt);
1861		1875
Lines 1870-1884 Link Here
1870	* table. We cannot depend on the mapping table entry	1884	* table. We cannot depend on the mapping table entry
1871	* being cleared because the node may not be free'd.	1885	* being cleared because the node may not be free'd.
1872	*/	1886	*/
1873	keyix = ni->ni_ucastkey.wk_rxkeyix;	1887	(void)node_clear_keyixmap(nt, ni);
1874	if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
1875	nt->nt_keyixmap[keyix] == ni) {
1876	IEEE80211_DPRINTF(ni->ni_vap, IEEE80211_MSG_NODE,
1877	"%s: %p<%s> clear key map entry %u\n",
1878	__func__, ni, ether_sprintf(ni->ni_macaddr), keyix);
1879	nt->nt_keyixmap[keyix] = NULL;
1880	ieee80211_node_decref(ni); /* NB: don't need free */
1881	}
1882	if (!ieee80211_node_dectestref(ni)) {	1888	if (!ieee80211_node_dectestref(ni)) {
1883	/*	1889	/*
1884	* Other references are present, just remove the	1890	* Other references are present, just remove the