2008-08-28 15:51:06

by Lars Ericsson

[permalink] [raw]
Subject: Race problem in mac80211/mlme.c and rt2x00

Hi,

I have found a race problem in mac80211/mlme.c and rt2x00

When the wpa_supplicant trigs an AP scan, mlme saves current configuration
and start scanning.
When the scan is complete, a SIOCGIWSCAN is sent and the saved configuration
is restored.

Since the SIOCGIWSCAN signal is send before the restore, a wpa_supplicant
initiated SIWFREQ may hit the restore operation.
The result is that local->ops->config() may be called by two different
processes at the 'same' time.

In the rt2x00 driver, rt2x00mac_config() may 'optimise' (skip) the channel
set operation.
The ultimate result/error is that the first authentication will happen on
wrong (old) channel.

I have moved the SIOCGIWSCAN code section after the restore operation and it
seems to work.
There is most likely a better solution but I leave that for the experts :)


/Lars