Re: Lots of confusion on bss refcounting.

[Ben Greear <greearb@candelatech.com>]

On 06/18/2013 08:52 AM, Johannes Berg wrote:
>
>>> You mean ->current_bss? That should be handled in all the callbacks in
>>> sme.c or so
>>
>> Looks like much of the action happens on work-queues.  I'm wondering if
>> we managed to delete wdev objects before we have completely cleaned up
>> in some cases...
>
> Don't we flush work structs appropriately?

Looks like it, from core.c in the netdev event handler:

		/*
		 * Ensure that all events have been processed and
		 * freed.
		 */
		cfg80211_process_wdev_events(wdev);


          /* I just added this to see if it helps... */
		if (WARN_ON(wdev->current_bss)) {
			cfg80211_unhold_bss(wdev->current_bss);
			cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
			SET_BSS(wdev, NULL);
		}
		break;

Some of the unregister and similar sme.c calls that should be cleaning up
the current_bss have some early returns if state does not match expected
value.  If the warning above hits, then probably we are hitting those
somehow.

If not, then I'll keep looking :)

Thanks,
Ben

>
> johannes
>


-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com