When starting a background scan, free the nodes table to ensure we

get an up-to-date view of APs around us. In particular, we need to
kick out the AP we are associated to. Otherwise, our current AP might
stay cached if it is turned off while we are scanning, and we could
end up picking a now non-existent but "good looking" AP over and over.

found with and ok phessler@

6 files changed, 25 insertions, 16 deletions

diff --git a/sys/dev/ic/pgt.c b/sys/dev/ic/pgt.c
index 8ff77a99ccb..0fbe8f8f129 100644
--- a/sys/dev/ic/pgt.c
+++ b/sys/dev/ic/pgt.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pgt.c,v 1.91 2018/04/28 11:17:08 pirofti Exp $  */
+/*	$OpenBSD: pgt.c,v 1.92 2018/04/28 14:49:07 stsp Exp $  */
 
 /*
  * Copyright (c) 2006 Claudio Jeker <claudio@openbsd.org>
@@ -2936,7 +2936,7 @@ pgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 			ic->ic_if.if_timer = 0;
 		ic->ic_mgt_timer = 0;
 		ic->ic_flags &= ~IEEE80211_F_SIBSS;
-		ieee80211_free_allnodes(ic);
+		ieee80211_free_allnodes(ic, 1);
 		break;
 	case IEEE80211_S_SCAN:
 		ic->ic_if.if_timer = 1;
@@ -2944,7 +2944,7 @@ pgt_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 		if (sc->sc_flags & SC_NOFREE_ALLNODES)
 			sc->sc_flags &= ~SC_NOFREE_ALLNODES;
 		else
-			ieee80211_free_allnodes(ic);
+			ieee80211_free_allnodes(ic, 1);
 
 #ifndef IEEE80211_STA_ONLY
 		/* Just use any old channel; we override it anyway. */
diff --git a/sys/dev/usb/if_atu.c b/sys/dev/usb/if_atu.c
index ede699045be..ae65dd61891 100644
--- a/sys/dev/usb/if_atu.c
+++ b/sys/dev/usb/if_atu.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: if_atu.c,v 1.124 2018/01/31 12:36:13 stsp Exp $ */
+/*	$OpenBSD: if_atu.c,v 1.125 2018/04/28 14:49:07 stsp Exp $ */
 /*
  * Copyright (c) 2003, 2004
  *	Daan Vreeken <Danovitsch@Vitsch.net>.  All rights reserved.
@@ -1210,7 +1210,7 @@ atu_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 	case IEEE80211_S_SCAN:
 		memcpy(ic->ic_chan_scan, ic->ic_chan_active,
 		    sizeof(ic->ic_chan_active));
-		ieee80211_free_allnodes(ic);
+		ieee80211_free_allnodes(ic, 1);
 
 		/* tell the event thread that we want a scan */
 		sc->sc_cmd = ATU_C_SCAN;
diff --git a/sys/net80211/ieee80211.c b/sys/net80211/ieee80211.c
index 6a00e5a0a22..458b4f363ea 100644
--- a/sys/net80211/ieee80211.c
+++ b/sys/net80211/ieee80211.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211.c,v 1.67 2018/04/26 12:50:07 pirofti Exp $	*/
+/*	$OpenBSD: ieee80211.c,v 1.68 2018/04/28 14:49:07 stsp Exp $	*/
 /*	$NetBSD: ieee80211.c,v 1.19 2004/06/06 05:45:29 dyoung Exp $	*/
 
 /*-
@@ -81,6 +81,15 @@ ieee80211_begin_bgscan(struct ifnet *ifp)
 		return;
 
 	if (ic->ic_bgscan_start != NULL && ic->ic_bgscan_start(ic) == 0) {
+		/*
+		 * Free the nodes table to ensure we get an up-to-date view
+		 * of APs around us. In particular, we need to kick out the
+		 * AP we are associated to. Otherwise, our current AP might
+		 * stay cached if it is turned off while we are scanning, and
+		 * we could end up picking a now non-existent AP over and over.
+		 */
+		ieee80211_free_allnodes(ic, 0 /* keep ic->ic_bss */);
+
 		ic->ic_flags |= IEEE80211_F_BGSCAN;
 		if (ifp->if_flags & IFF_DEBUG)
 			printf("%s: begin background scan\n", ifp->if_xname);
diff --git a/sys/net80211/ieee80211_node.c b/sys/net80211/ieee80211_node.c
index 70d6419e619..3eba6e9c392 100644
--- a/sys/net80211/ieee80211_node.c
+++ b/sys/net80211/ieee80211_node.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_node.c,v 1.128 2018/04/27 15:27:10 stsp Exp $	*/
+/*	$OpenBSD: ieee80211_node.c,v 1.129 2018/04/28 14:49:07 stsp Exp $	*/
 /*	$NetBSD: ieee80211_node.c,v 1.14 2004/05/09 09:18:47 dyoung Exp $	*/
 
 /*-
@@ -205,7 +205,7 @@ ieee80211_node_detach(struct ifnet *ifp)
 		(*ic->ic_node_free)(ic, ic->ic_bss);
 		ic->ic_bss = NULL;
 	}
-	ieee80211_free_allnodes(ic);
+	ieee80211_free_allnodes(ic, 1);
 #ifndef IEEE80211_STA_ONLY
 	free(ic->ic_aid_bitmap, M_DEVBUF,
 	    howmany(ic->ic_max_aid, 32) * sizeof(u_int32_t));
@@ -271,7 +271,7 @@ ieee80211_begin_scan(struct ifnet *ifp)
 	 * otherwise we'll potentially flush state of stations
 	 * associated with us.
 	 */
-	ieee80211_free_allnodes(ic);
+	ieee80211_free_allnodes(ic, 1);
 
 	/*
 	 * Reset the current mode. Setting the current mode will also
@@ -1348,7 +1348,7 @@ ieee80211_release_node(struct ieee80211com *ic, struct ieee80211_node *ni)
 }
 
 void
-ieee80211_free_allnodes(struct ieee80211com *ic)
+ieee80211_free_allnodes(struct ieee80211com *ic, int clear_ic_bss)
 {
 	struct ieee80211_node *ni;
 	int s;
@@ -1359,7 +1359,7 @@ ieee80211_free_allnodes(struct ieee80211com *ic)
 		ieee80211_free_node(ic, ni);
 	splx(s);
 
-	if (ic->ic_bss != NULL)
+	if (clear_ic_bss && ic->ic_bss != NULL)
 		ieee80211_node_cleanup(ic, ic->ic_bss);	/* for station mode */
 }
 
diff --git a/sys/net80211/ieee80211_node.h b/sys/net80211/ieee80211_node.h
index c6eb702bbe3..5a414fef8b7 100644
--- a/sys/net80211/ieee80211_node.h
+++ b/sys/net80211/ieee80211_node.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_node.h,v 1.73 2018/02/06 22:17:03 phessler Exp $	*/
+/*	$OpenBSD: ieee80211_node.h,v 1.74 2018/04/28 14:49:07 stsp Exp $	*/
 /*	$NetBSD: ieee80211_node.h,v 1.9 2004/04/30 22:57:32 dyoung Exp $	*/
 
 /*-
@@ -382,7 +382,7 @@ struct ieee80211_node *
 		const char *, u_int8_t);
 void ieee80211_release_node(struct ieee80211com *,
 		struct ieee80211_node *);
-void ieee80211_free_allnodes(struct ieee80211com *);
+void ieee80211_free_allnodes(struct ieee80211com *, int);
 void ieee80211_iterate_nodes(struct ieee80211com *,
 		ieee80211_iter_func *, void *);
 void ieee80211_clean_cached(struct ieee80211com *);
diff --git a/sys/net80211/ieee80211_proto.c b/sys/net80211/ieee80211_proto.c
index 918c75a6172..aac9cfb9464 100644
--- a/sys/net80211/ieee80211_proto.c
+++ b/sys/net80211/ieee80211_proto.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_proto.c,v 1.84 2018/04/27 15:33:49 stsp Exp $	*/
+/*	$OpenBSD: ieee80211_proto.c,v 1.85 2018/04/28 14:49:07 stsp Exp $	*/
 /*	$NetBSD: ieee80211_proto.c,v 1.8 2004/04/30 23:58:20 dyoung Exp $	*/
 
 /*-
@@ -944,7 +944,7 @@ justcleanup:
 			ic->ic_mgt_timer = 0;
 			mq_purge(&ic->ic_mgtq);
 			mq_purge(&ic->ic_pwrsaveq);
-			ieee80211_free_allnodes(ic);
+			ieee80211_free_allnodes(ic, 1);
 			break;
 		}
 		ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE;
@@ -994,7 +994,7 @@ justcleanup:
 			}
 			timeout_del(&ic->ic_bgscan_timeout);
 			ic->ic_bgscan_fail = 0;
-			ieee80211_free_allnodes(ic);
+			ieee80211_free_allnodes(ic, 1);
 			/* FALLTHROUGH */
 		case IEEE80211_S_AUTH:
 		case IEEE80211_S_ASSOC: