pmksa_cache not thread-safe ?

[Jouni Malinen]

On Sat, Oct 04, 2014 at 11:32:22AM +0400, Sergey Korolew wrote:
> I have several access points with OpenWrt and hostapd-2014-06-03. After enabling pmksa_caching in config
> access points entered 100% CPU utilisation after some time (and several clients). CPU consumed by
> hostapd process. I found many other user's reports about this problem, for example
> https://dev.openwrt.org/ticket/16470

How easily can you reproduce this? Would it be possible to reproduce it
with the current hostapd build rather than the OpenWrt version which
includes number of custom changes that do not exist in the upstream
version? It would be interesting to get backtrace information from the
process when that state has been entered (e.g., with gdb attaching to
the process). However, I'm not sure how easily that could be achieved on
an OpenWrt AP.

> Quick looking on the pmksa_cache_auth.c found what its totally non-threadsafe and full of possible
> eternal loops if accessed simultaneosly :) for example in functions pmksa_cache_free_entry() and
> pmksa_cache_link_entry() chain can be damaged and looped forever.
> 
> It is possible to add some locking ?

Why? hostapd runs in a single thread.
 
-- 
Jouni Malinen                                            PGP id EFC895FA