When in the RUN -> AUTH -> RUN FSM transition happens, we'll call the

ratectl_node_init() functions and since ni_rtctls was already
malloc'ed() we will panic. Fix this by using the already malloc'ed
pointer.

Found by:	bschmidt
Reviewed by:	bschmidt

2 files changed, 21 insertions, 17 deletions

diff --git a/sys/net80211/ieee80211_amrr.c b/sys/net80211/ieee80211_amrr.c
index 6111058..7902545 100644
--- a/sys/net80211/ieee80211_amrr.c
+++ b/sys/net80211/ieee80211_amrr.c
@@ -136,16 +136,16 @@ amrr_node_init(struct ieee80211_node *ni)
 	struct ieee80211_amrr *amrr = vap->iv_rs;
 	struct ieee80211_amrr_node *amn;
 
-	KASSERT(ni->ni_rctls == NULL, ("%s: ni_rctls already initialized",
-	    __func__));
-
-	ni->ni_rctls = amn = malloc(sizeof(struct ieee80211_amrr_node),
-	    M_80211_RATECTL, M_NOWAIT|M_ZERO);
-	if (amn == NULL) {
-		if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
-		    "structure\n");
-		return;
-	}
+	if (ni->ni_rctls == NULL) {
+		ni->ni_rctls = amn = malloc(sizeof(struct ieee80211_amrr_node),
+		    M_80211_RATECTL, M_NOWAIT|M_ZERO);
+		if (amn == NULL) {
+			if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
+			    "structure\n");
+			return;
+		}
+	} else
+		amn = ni->ni_rctls;
 	amn->amn_amrr = amrr;
 	amn->amn_success = 0;
 	amn->amn_recovery = 0;
diff --git a/sys/net80211/ieee80211_rssadapt.c b/sys/net80211/ieee80211_rssadapt.c
index ad329e0..f82c01e 100644
--- a/sys/net80211/ieee80211_rssadapt.c
+++ b/sys/net80211/ieee80211_rssadapt.c
@@ -169,13 +169,17 @@ rssadapt_node_init(struct ieee80211_node *ni)
 	struct ieee80211_rssadapt *rsa = vap->iv_rs;
 	const struct ieee80211_rateset *rs = &ni->ni_rates;
 
-	ni->ni_rctls = ra = malloc(sizeof(struct ieee80211_rssadapt_node),
-	    M_80211_RATECTL, M_NOWAIT|M_ZERO);
-	if (ra == NULL) {
-		if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
-		    "structure\n");
-		return;
-	}
+	if (ni->ni_rctls == NULL) {
+		ni->ni_rctls = ra = 
+		    malloc(sizeof(struct ieee80211_rssadapt_node),
+		        M_80211_RATECTL, M_NOWAIT|M_ZERO);
+		if (ra == NULL) {
+			if_printf(vap->iv_ifp, "couldn't alloc per-node ratectl "
+			    "structure\n");
+			return;
+		}
+	} else
+		ra = ni->ni_rctls;
 	ra->ra_rs = rsa;
 	ra->ra_rates = *rs;
 	rssadapt_updatestats(ra);