Re: iwn 2

[Patrick Welche <prlw1%cam.ac.uk@localhost>]

On Wed, Aug 17, 2011 at 12:46:01PM -0400, Ken Hornstein wrote:
> >Then, the call to ieee80211_amrr_choose uses amn, which is after the
> >struct the iwn_node was initalised with. ieee80211_amrr_choose then starts
> >by dereferencing bits of the amn. Isn't that pointing at garbage?
> >
> >I haven't used iwn as an "infrastructure station", so have never run into
> >trouble, but is the C analysis right?
> 
> Looks like to me that every time iwn_iter_func() is called, it's being
> called with a struct iwn_node as the argument that just happens to cast
> to a struct ieee80211_node (look at iwn_node_alloc(), and see how in
> iwn_attach() ic->ic_node_alloc is set to iwn_node alloc()).

The only call to iwn_iter_func() I see is in if_iwn.c (I'm looking at v1.56):

            iwn_iter_func(sc, ic->ic_bss);

where
    struct ieee80211com *ic = &sc->sc_ic;
struct ieee80211com {
...
        struct ieee80211_node   *ic_bss;        /* information for this node */

so it is being called with an ieee80211_node rather than an iwn_node, so
I'm already stuck in the first part of your reply...

Cheers,

Patrick