net80211: fix a race between ieee80211_sta_join and scan entries

[bz]

Summary

We were seeing panics during ieee80211_sta_join() which seemed that
the ni->ni_chan was not valid anymore, which was true.
We also saw errors indicating data put into ni_ies became inalid.

The problem was that the ieee80211_scan_entry passed into
ieee80211_sta_join() (in the observed case from setmlme_assoc_sta())
became invalid during ieee80211_alloc_node().
As a result for the ni_chan case the the rateset and len in rates[1]
became invalid. Similarly for the IEs.

Make a (deep)copy of the scan entry in setmlme_assoc_sta() and return
the copy as once we leave ieee80211_scan_iterate() we can no longer
rely on the scan entry to be valid.

Sponsored by: The FreeBSD Foundation
MFC after: 3 days
Reported by: rm
PR: 286063

[bz]

@adrian, does this also fix your problem from D49514 or is that a similar yet different problem?

[rm]

Bjoern, as I said in the beginning I wasn't able to reproduce the panic, it only happened once. I tested with your patch, and can say everything works smoothly on my side.
Please let me know if you need any additional info, command outputs etc. Thank you!

[rm]

sys/net80211/ieee80211_ioctl.c

1558

There is a typo in a word "everything"

[bz]

In D49865#1137332, @rm wrote:

Bjoern, as I said in the beginning I wasn't able to reproduce the panic, it only happened once. I tested with your patch, and can say everything works smoothly on my side.
Please let me know if you need any additional info, command outputs etc. Thank you!

Thanks. I could reliably reproduce it (at some point) before this patch. Given it's a race it happens .. or not and a change to system may just make it happen. I had enabled lots of debugging to console at that point.

@adrian @thj does this make sense here?

@adrian I do not think this fixes your problem from D49514. Need to look into that. I need an AP supporting WEP and GCMP anyway so ... maybe I'll hit it too.