Attempt to catch scan cancellations at exactly the wrong time from occuring.

The scan code unlocks the comlock and calls into the driver.  It then
assumes the state hasn't changed from underneath it.

Although I haven't seen this particular condition trigger, I'd like to
be informed if I or anyone else sees it.

What I'm thinking may occur:

* A cancellation comes in during the scan_end call;
* the cancel flag is set;
* but it's never checked, so scandone isn't updated;
* .. and the interface stays in the STA power save mode.

It's a subtle race, if it even exists.

PR:		kern/163318

1 files changed, 13 insertions, 0 deletions

diff --git a/sys/net80211/ieee80211_scan.c b/sys/net80211/ieee80211_scan.c
index 5c1e3d9..27f24c1 100644
--- a/sys/net80211/ieee80211_scan.c
+++ b/sys/net80211/ieee80211_scan.c
@@ -960,6 +960,19 @@ scan_task(void *arg, int pending)
 	IEEE80211_LOCK(ic);
 
 	/*
+	 * Since a cancellation may have occured during one of the
+	 * driver calls (whilst unlocked), update scandone.
+	 */
+	if (scandone == 0 &&
+	    ((SCAN_PRIVATE(ss)->ss_iflags & ISCAN_CANCEL) != 0)) {
+		/* XXX printf? */
+		if_printf(vap->iv_ifp,
+		    "%s: OOPS! scan cancelled during driver call!\n",
+		    __func__);
+	}
+	scandone |= ((SCAN_PRIVATE(ss)->ss_iflags & ISCAN_CANCEL) != 0);
+
+	/*
 	 * Record scan complete time.  Note that we also do
 	 * this when canceled so any background scan will
 	 * not be restarted for a while.