From owner-freebsd-wireless@FreeBSD.ORG  Fri Mar 29 22:50:01 2013
Return-Path: <owner-freebsd-wireless@FreeBSD.ORG>
Delivered-To: freebsd-wireless@smarthost.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115])
 by hub.freebsd.org (Postfix) with ESMTP id A4663B98
 for <freebsd-wireless@smarthost.ysv.freebsd.org>;
 Fri, 29 Mar 2013 22:50:01 +0000 (UTC)
 (envelope-from gnats@FreeBSD.org)
Received: from freefall.freebsd.org (freefall.freebsd.org
 [IPv6:2001:1900:2254:206c::16:87])
 by mx1.freebsd.org (Postfix) with ESMTP id 9532BE89
 for <freebsd-wireless@smarthost.ysv.freebsd.org>;
 Fri, 29 Mar 2013 22:50:01 +0000 (UTC)
Received: from freefall.freebsd.org (localhost [127.0.0.1])
 by freefall.freebsd.org (8.14.6/8.14.6) with ESMTP id r2TMo1a4060082
 for <freebsd-wireless@freefall.freebsd.org>; Fri, 29 Mar 2013 22:50:01 GMT
 (envelope-from gnats@freefall.freebsd.org)
Received: (from gnats@localhost)
 by freefall.freebsd.org (8.14.6/8.14.6/Submit) id r2TMo1qu060081;
 Fri, 29 Mar 2013 22:50:01 GMT (envelope-from gnats)
Date: Fri, 29 Mar 2013 22:50:01 GMT
Message-Id: <201303292250.r2TMo1qu060081@freefall.freebsd.org>
To: freebsd-wireless@FreeBSD.org
Cc: 
From: PseudoCylon <moonlightakkiy@yahoo.ca>
Subject: Re: kern/177451: [ieee80211] page fault in ieee80211_tx_mgt_timeout
X-BeenThere: freebsd-wireless@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
Reply-To: PseudoCylon <moonlightakkiy@yahoo.ca>
List-Id: "Discussions of 802.11 stack,
 tools device driver development." <freebsd-wireless.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-wireless>
List-Post: <mailto:freebsd-wireless@freebsd.org>
List-Help: <mailto:freebsd-wireless-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-wireless>, 
 <mailto:freebsd-wireless-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 29 Mar 2013 22:50:01 -0000

The following reply was made to PR kern/177451; it has been noted by GNATS.

From: PseudoCylon <moonlightakkiy@yahoo.ca>
To: bug-followup@freebsd.org, davide@freebsd.org
Cc:  
Subject: Re: kern/177451: [ieee80211] page fault in ieee80211_tx_mgt_timeout
Date: Fri, 29 Mar 2013 16:37:20 -0600

 Oops. The code casts the enum to the pointer to begin, so it works.
 
 Sorry, for the noise.
 
 On Fri, Mar 29, 2013 at 3:21 PM, PseudoCylon <moonlightakkiy@yahoo.ca> wrote:
 > http://fxr.watson.org/fxr/source/net80211/ieee80211_output.c?v=FREEBSD91#L2506
 > enum ieee80211_state ostate = (enum ieee80211_state) arg;
 > casting a pointer to an enum
 >
 > http://fxr.watson.org/fxr/source/net80211/ieee80211_output.c?v=FREEBSD91#L2519
 > if (vap->iv_state == ostate)
 > So that, this test is always false -> callout_reset() will never be
 > called -> by the time the callout timer runs out, ni could be freed.