From owner-freebsd-net@FreeBSD.ORG  Mon Jan 17 06:30:17 2011
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@hub.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 31866106566B
	for <freebsd-net@hub.freebsd.org>; Mon, 17 Jan 2011 06:30:17 +0000 (UTC)
	(envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
	[IPv6:2001:4f8:fff6::28])
	by mx1.freebsd.org (Postfix) with ESMTP id 061608FC1A
	for <freebsd-net@hub.freebsd.org>; Mon, 17 Jan 2011 06:30:17 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
	by freefall.freebsd.org (8.14.4/8.14.4) with ESMTP id p0H6UGvL017818
	for <freebsd-net@freefall.freebsd.org>; Mon, 17 Jan 2011 06:30:16 GMT
	(envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
	by freefall.freebsd.org (8.14.4/8.14.4/Submit) id p0H6UGrD017810;
	Mon, 17 Jan 2011 06:30:16 GMT (envelope-from gnats)
Date: Mon, 17 Jan 2011 06:30:16 GMT
Message-Id: <201101170630.p0H6UGrD017810@freefall.freebsd.org>
To: freebsd-net@FreeBSD.org
From: PseudoCylon <moonlightakkiy@yahoo.ca>
Cc: 
Subject: Re: kern/153938: [run] [panic] [patch] Workaround for
	use-after-free panic
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
Reply-To: PseudoCylon <moonlightakkiy@yahoo.ca>
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 17 Jan 2011 06:30:17 -0000

The following reply was made to PR kern/153938; it has been noted by GNATS.

From: PseudoCylon <moonlightakkiy@yahoo.ca>
To: Juergen Lock <nox@jelal.kn-bremen.de>
Cc: bug-followup@freebsd.org, nox@jelal.kn-bremen.de
Subject: Re: kern/153938: [run] [panic] [patch] Workaround for use-after-free panic
Date: Sun, 16 Jan 2011 22:24:07 -0800 (PST)

 ----- Original Message ----
 > From: Juergen Lock <nox@jelal.kn-bremen.de>
 > To: PseudoCylon <moonlightakkiy@yahoo.ca>
 > Cc: bug-followup@freebsd.org; nox@jelal.kn-bremen.de
 > Sent: Fri, January 14, 2011 10:36:50 AM
 > Subject: Re: kern/153938: [run] [panic] [patch] Workaround for use-after-free 
 >panic
 > 
 > On Thu, Jan 13, 2011 at 04:47:21PM -0800, PseudoCylon wrote:
 > >  Hello,
 > Hi!
 > > 
 > > Thank you for the patch.
 > > 
 >  You're  welcome! :)
 > 
 > > I have applied it. Please try patched driver  out.
 > > http://gitorious.org/run/run/trees/ratectl_fix/dev/usb/wlan
 > > 
 > > I added locks to your patch, so saved pointers are more  reliable.
 > 
 >  I see you removed the rn->wcid code, I guess I should  have
 > explained what it's for:  ni->ni_associd already gets zeroed  before
 > run_node_cleanup() is called so with your version no  sc->sc_ni[wcid]
 > ever gets set to NULL.
 > 
 
 You're right.
 
 > +        if (wcid ==  0)
 > +            wcid =  rn->wcid;
 
 
 Is there any reason to test "ni->ni_associd == 0"? We know it is 0.
 
 
 AK