diff options
| author | thompsa <thompsa@FreeBSD.org> | 2010-09-02 03:28:03 +0000 |
|---|---|---|
| committer | thompsa <thompsa@FreeBSD.org> | 2010-09-02 03:28:03 +0000 |
| commit | 1a84f8ba2ae2f9c4b0376b200c9e1c505ea1f6e5 (patch) | |
| tree | 96181ac569fa147859c67d6e8334673d021645fe /sys/dev/usb/wlan/if_ural.c | |
| parent | 5621f791d2277c43041de7701e15cbcfa9b6dd87 (diff) | |
| download | FreeBSD-src-1a84f8ba2ae2f9c4b0376b200c9e1c505ea1f6e5.zip FreeBSD-src-1a84f8ba2ae2f9c4b0376b200c9e1c505ea1f6e5.tar.gz | |
We need to grab a node reference count to vap->iv_bss before using it as it is
possible for the node to be replaced and freed at any time by
ieee80211_sta_join1().
Diffstat (limited to 'sys/dev/usb/wlan/if_ural.c')
| -rw-r--r-- | sys/dev/usb/wlan/if_ural.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/sys/dev/usb/wlan/if_ural.c b/sys/dev/usb/wlan/if_ural.c index 94b560d..aa2dcbd 100644 --- a/sys/dev/usb/wlan/if_ural.c +++ b/sys/dev/usb/wlan/if_ural.c @@ -711,7 +711,7 @@ ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) break; case IEEE80211_S_RUN: - ni = vap->iv_bss; + ni = ieee80211_ref_node(vap->iv_bss); if (vap->iv_opmode != IEEE80211_M_MONITOR) { ural_update_slot(ic->ic_ifp); @@ -729,6 +729,7 @@ ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) "could not allocate beacon\n"); RAL_UNLOCK(sc); IEEE80211_LOCK(ic); + ieee80211_free_node(ni); return (-1); } ieee80211_ref_node(ni); @@ -737,6 +738,7 @@ ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) "could not send beacon\n"); RAL_UNLOCK(sc); IEEE80211_LOCK(ic); + ieee80211_free_node(ni); return (-1); } } @@ -754,7 +756,7 @@ ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)]; if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) ural_ratectl_start(sc, ni); - + ieee80211_free_node(ni); break; default: @@ -2237,10 +2239,11 @@ ural_ratectl_task(void *arg, int pending) struct ieee80211com *ic = vap->iv_ic; struct ifnet *ifp = ic->ic_ifp; struct ural_softc *sc = ifp->if_softc; - struct ieee80211_node *ni = vap->iv_bss; + struct ieee80211_node *ni; int ok, fail; int sum, retrycnt; + ni = ieee80211_ref_node(vap->iv_bss); RAL_LOCK(sc); /* read and clear statistic registers (STA_CSR0 to STA_CSR10) */ ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta)); @@ -2258,6 +2261,7 @@ ural_ratectl_task(void *arg, int pending) usb_callout_reset(&uvp->ratectl_ch, hz, ural_ratectl_timeout, uvp); RAL_UNLOCK(sc); + ieee80211_free_node(ni); } static int |
