NM HEAD 1.727 wpa ctrl socket bug

[Bill Moss <bmoss CLEMSON EDU>]

The following bug occurs with wpa_supplicant 0.5.0 and 0.5.1 (CVS) with 
Dan's two patches. Compiled with only the wext driver. It is a NM issue. 
NM does not remove the wpa ctrl socket from /tmp on shutdown.

The story starts in 'nm-device-802-11-wireless.c' in the function 
'supplicant_interface_init'. The problem occurs with the 'wpa_ctrl_open 
(socket_path)' returns NULL (happens intermittently as explained below). 
This causes NM to crash. This NULL should have been trapped so I changed 
the code to

      if (!(self->priv->sup_ctrl = wpa_ctrl_open (socket_path)))
      {
              nm_info ("wpa_ctrl_open failure in 
supplicant_interface_init");
              goto exit;
      }

Now NM produces an error message but does not crash. The NULL returned 
by 'wpa_ctrl_open' in wpa_ctrl.c can be traced to the code segment

      ctrl->local.sun_family = AF_UNIX;
      snprintf(ctrl->local.sun_path, sizeof(ctrl->local.sun_path),
               "/tmp/wpa_ctrl_%d-%d", getpid(), counter++);
      if (bind(ctrl->s, (struct sockaddr *) &ctrl->local,
                  sizeof(ctrl->local)) < 0) {
              close(ctrl->s);
              free(ctrl);
              nm_info ("wpa_ctrl_open second NULL");
              return NULL;
      }

I looked in /tmp and found a large number of socket files of the form

srwxr-xr-x  1 root  root     0 Jan 11 00:54 wpa_ctrl_3463-1

When I removed the socket files from /tmp, the problem went away.

If I force a reassociation by clicking in the NM menu on the active 
wireless network, wpa_ctrl_3463-1 changes to wpa_ctrl_3463-3, and next 
time to wpa_ctrl_3463-5.

If I do,

service NetworkManager stop; service NetworkManagerDispatcher stop; 
killall nm-applet

the socket is removed from /tmp as it should be and a new one is written 
when the NM service is restarted. Same thing happens with 'killall 
NetworkManager'

If I suspend and resume, wpa_ctrl_3463-1 changes to wpa_ctrl_3463-3 on 
resume which seems correct.

If I 'shutdown' or 'shutdown -r' or use the Gnome menu to reboot or 
shutdown, the socket is not removed and so sockets will accumulate in 
/tmp across boots. This is the bug. I expect that at shutdown, the 
wpa_supplicant process is being killed before NM is stopped and that 
this sequence of events results in the 'hanging' socket.


--
Bill Moss
Professor, Mathematical Sciences
Clemson University


--
Bill Moss
Professor, Mathematical Sciences
Clemson University


--
Bill Moss
Professor, Mathematical Sciences
Clemson University