RDKB-65569 : [XB10][RDKB] WiFi management service crashes with finge… - #1309
Open
SakeVictorDaniel wants to merge 1 commit into
Open
RDKB-65569 : [XB10][RDKB] WiFi management service crashes with finge…#1309SakeVictorDaniel wants to merge 1 commit into
SakeVictorDaniel wants to merge 1 commit into
Conversation
…print 58928292 on XB10 and XER10 gateways, which can cause brief WiFi interruptions for customers each time it restart Reason for Change: When wifi_getApAssociatedDeviceDiagnosticResult3() fails, stale entries in sta_map are never cleaned up while process_connect() keeps adding new ones. This causes harvester_get_associated_device_info() to overflow its fixed 66500 byte buffer when serializing all entries to JSON. Fix: 1) Add bounds check in harvester loop to stop before overflow. 2) Perform stale entry cleanup even when HAL call fails. Signed-off-by: Sake Victor Daniel <VictorDaniel_Sake@comcast.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Prevents WiFi management service crashes caused by unbounded sta_map growth and subsequent overflow when serializing associated-client diagnostics into a fixed-size JSON buffer.
Changes:
- Adds stale
sta_mapcleanup even whenwifi_getApAssociatedDeviceDiagnosticResult3()fails, avoiding unbounded map growth. - Adds a bounds check in
harvester_get_associated_device_info()to stop serializing client entries before exceeding the fixed diagnostics buffer.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| source/stats/wifi_stats_assoc_client.c | Adds cleanup on HAL failure to remove stale station-map entries rather than returning early with no pruning. |
| source/stats/wifi_monitor.c | Adds bounds checking during JSON serialization of associated-client diagnostics to prevent buffer overflow. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+1046
to
+1054
| /* Bounds check: stop serializing if we are approaching buffer limit. | ||
| * Reserve 64 bytes for the closing JSON brackets and null terminator. | ||
| */ | ||
| if (pos >= (buf_size - 64)) { | ||
| wifi_util_error_print(WIFI_MON, | ||
| "%s %d Buffer overflow prevented for vap %d, pos=%u buf_size=%u sta_count=%u\n", | ||
| __func__, __LINE__, vap_index, pos, buf_size, sta_count); | ||
| break; | ||
| } |
Comment on lines
+263
to
+270
| tmp_sta = NULL; | ||
| if (sta->dev_stats.cli_Active == false && | ||
| timespecisset(&(sta->last_disconnected_time))) { | ||
| unsigned int disc_time = tv_now_err.tv_sec - sta->last_disconnected_time.tv_sec; | ||
| if (disc_time > mon_data->bssid_data[vap_array_index].ap_params.rapid_reconnect_threshold) { | ||
| tmp_sta = sta; | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RDKB-65569 : WiFi management service crashes with fingerprint 58928292 on XB10 and XER10 gateways, which can cause brief WiFi interruptions for customers each time it restart
Reason for Change:
--> wifi_getApAssociatedDeviceDiagnosticResult3() was failing continuously as the driver returns early since /tmp/sta_assoc_count is greater than 8096 bytes
--> wifi_getApAssociatedDeviceDiagnosticResult3() is invoked every 5000ms.
--> When wifi_getApAssociatedDeviceDiagnosticResult3() fails, clean up logic never hits and stale entries in sta_map are never cleaned. This causes harvester_get_associated_device_info() to overflow its fixed 66,500 bytes harvester_buf when serializing all entries to JSON when populating the harvester_buf on harvester reporting interval.
Fix:
Add bounds check in harvester loop to stop before overflow.
Perform stale entry cleanup even when wifi_getApAssociatedDeviceDiagnosticResult3() fails. (If clients remain inactive for more than rapid disconnect threshold time then those clients are removed from sta_map, if client connects back within rapid disconnect threshold, then such clients are not removed, this is as per the current clean-up design)
Unit Testing:
Connected 42 clients to 5GHz private SSID
Confirmed that all the connected clients are listed under wl -i wl1.1 assoclist
Made the /tmp/sta_assoc_count greater than 8096 to simulate the stats fetch failure (as observed in the issue devices in field)
Checked /rdklogs/logs/messages.txt and observed
"2026 Jul 28 07:52:57 Docsis-Gateway kernel: CFG80211-ERROR) wl_cfgvendor_get_assoc_num : Failed to read whole file /tmp/sta_assoc_count
2026 Jul 28 07:52:57 Docsis-Gateway kernel: CFG80211-ERROR) wl_cfgvendor_get_station_reply : Failed to get assoc num, error: -1
reply handler return early due to /tmp/sta_assoc_count being more than 8098 bytes and as a result in /rdklogs/logs/wifiMon.txt observe "Failed to get AP Associated Devices statistics for vap index 1" every 5 seconds
Disconnected 15 connected clients
Out of 15 disconnected clients, reconnected 5 clients within rapid disconnect threshold (180s)
Checked in /rdklogs/logs/wifiMon.txt.0 that exactly after 180s the 10 disconnected clients (that were not reconnected within 180s) are removed from the sta_map by checking the log "execute_assoc_client_stats_api:275 wifi_getApAssociatedDeviceDiagnosticResult3 failed: removing stale device 00:0a:52:ee:03:10 from map of ap:1" and none of the reconnected clients with 180s should be removed from sta_map
Waited for the next harvester report and saw that there is no disconnected entry in the report. But the reconnected client entries are present as expected.
Left the device in this state for more than 17 hours, harvester report does not contain any stale entries.
Attaching relevant logs:
65569_Disconnected_Clients_&_Reconnected_Clients.txt
65569_RG_Console_logs.txt
harvester_buf_contents.txt
Priority: P1
Risk: Medium
Signed-off-by: Sake Victor Daniel VictorDaniel_Sake@comcast.com