From owner-freebsd-bugs@FreeBSD.ORG Fri Dec 25 18:20:03 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 5CC2E10656A3 for ; Fri, 25 Dec 2009 18:20:03 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 1C4628FC12 for ; Fri, 25 Dec 2009 18:20:03 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id nBPIK25J010588 for ; Fri, 25 Dec 2009 18:20:02 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id nBPIK2uu010587; Fri, 25 Dec 2009 18:20:02 GMT (envelope-from gnats) Resent-Date: Fri, 25 Dec 2009 18:20:02 GMT Resent-Message-Id: <200912251820.nBPIK2uu010587@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Andre Albsmeier Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 73BA21065695 for ; Fri, 25 Dec 2009 18:16:15 +0000 (UTC) (envelope-from Andre.Albsmeier@siemens.com) Received: from goliath.siemens.de (goliath.siemens.de [192.35.17.28]) by mx1.freebsd.org (Postfix) with ESMTP id 0BE1C8FC22 for ; Fri, 25 Dec 2009 18:16:14 +0000 (UTC) Received: from mail2.siemens.de (localhost [127.0.0.1]) by goliath.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id nBPI4LQa020048 for ; Fri, 25 Dec 2009 19:04:21 +0100 Received: from curry.mchp.siemens.de (curry.mchp.siemens.de [139.25.40.130]) by mail2.siemens.de (8.12.11.20060308/8.12.11) with ESMTP id nBPI4LVI022245 for ; Fri, 25 Dec 2009 19:04:21 +0100 Received: (from localhost) by curry.mchp.siemens.de (8.14.3/8.14.3) id nBPI4LCU064379 for FreeBSD-gnats-submit@freebsd.org; Fri, 25 Dec 2009 19:04:21 +0100 (CET) Message-Id: <200912251804.nBPI4LvG079706@curry.mchp.siemens.de> Date: Fri, 25 Dec 2009 19:04:21 +0100 (CET) From: Andre Albsmeier To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: Subject: kern/142018: iwi: Possibly wrong interpretation of beacon->number in if_iwi.c X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 25 Dec 2009 18:20:03 -0000 >Number: 142018 >Category: kern >Synopsis: iwi: Possibly wrong interpretation of beacon->number in if_iwi.c >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Fri Dec 25 18:20:02 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Andre Albsmeier >Release: FreeBSD 7.2-STABLE i386 >Organization: >Environment: System: FreeBSD 7.2-STABLE #9: Wed Dec 23 20:32:46 CET 2009 using iwi driver >Description: In WLAN environments where beacon misses may happen occasionally iwi(4) might reassociate even if the set threshold (bmiss) is not reached. sysctl debug.iwi=5 enables logging of beacon misses which are ridiculous high even after an uptime of only a few minutes: Beacon state (1, 19006982) Beacon miss: 19006982 >= 10 Beacon state (1, 19007496) Beacon miss: 19007496 >= 10 Beacon state (1, 19269126) Beacon miss: 19269126 >= 10 Adding code to if_iwi.c which prints out the hex values leads us to this picture: iwi0: Beacon miss: 19006982 1220606 iwi0: Beacon miss: 19006982 1220606 iwi0: Beacon miss: 19007239 1220707 iwi0: Beacon miss: 19007496 1220808 iwi0: Beacon miss: 19269126 1260606 iwi0: Beacon miss: 19269383 1260707 iwi0: Beacon miss: 19269640 1260808 iwi0: Beacon miss: 19269126 1260606 iwi0: Beacon miss: 19269383 1260707 iwi0: Beacon miss: 19269640 1260808 ^^^^^^^ hex values It seems to be wrong to use all 32bits of beacon->number in if_iwi.c. However, if_iwi.c in 7.2 is the same as in RELENG_6 where the problem didn't show up under same conditions. It might depend on the contents of other memory locations, stack, ... >How-To-Repeat: Use iwi in a WLAN environments where beacon misses happen. Use sysctl debug.iwi=5 to see debugging output. If numbers are reasonably low, you might not have been hit bit the problem for reasons mentioned above. See also: http://lists.freebsd.org/pipermail/freebsd-mobile/2009-December/011833.html >Fix: I am currently using this patch to mask out only the lower 8 bits of beacon->number in if_iwi.c: --- if_iwi.c.ORI 2009-12-07 16:17:46.000000000 +0100 +++ if_iwi.c 2009-12-07 16:20:10.000000000 +0100 @@ -1508,9 +1508,9 @@ * 802.11 layer. * XXX try to roam, drop assoc only on much higher count */ - if (le32toh(beacon->number) >= ic->ic_bmissthreshold) { + if ((le32toh(beacon->number) & 0xFF) >= ic->ic_bmissthreshold) { DPRINTF(("Beacon miss: %u >= %u\n", - le32toh(beacon->number), + le32toh(beacon->number) & 0xFF, ic->ic_bmissthreshold)); ieee80211_beacon_miss(ic); } >Release-Note: >Audit-Trail: >Unformatted: