fixes a broken software beacon miss handler. There is a race to check

vap->iv_bmiss_count == 0 in ieee80211_swbmiss because iv_swbmiss_task is
enqueued by taskqueue.

Reviewed by:	rpaulo

3 files changed, 4 insertions, 2 deletions

diff --git a/sys/net80211/ieee80211_proto.c b/sys/net80211/ieee80211_proto.c
index 9aabfcf..edac519 100644
--- a/sys/net80211/ieee80211_proto.c
+++ b/sys/net80211/ieee80211_proto.c
@@ -1432,8 +1432,6 @@ ieee80211_swbmiss(void *arg)
 	} else if (vap->iv_swbmiss_count == 0) {
 		if (vap->iv_bmiss != NULL)
 			ieee80211_runtask(ic, &vap->iv_swbmiss_task);
-		if (vap->iv_bmiss_count == 0)	/* don't re-arm timer */
-			return;
 	} else
 		vap->iv_swbmiss_count = 0;
 	callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
diff --git a/sys/net80211/ieee80211_sta.c b/sys/net80211/ieee80211_sta.c
index 743fe48..4ebbd7c 100644
--- a/sys/net80211/ieee80211_sta.c
+++ b/sys/net80211/ieee80211_sta.c
@@ -141,6 +141,8 @@ sta_beacon_miss(struct ieee80211vap *vap)
 			vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
 		return;
 	}
+
+	callout_stop(&vap->iv_swbmiss);
 	vap->iv_bmiss_count = 0;
 	vap->iv_stats.is_beacon_miss++;
 	if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
diff --git a/sys/net80211/ieee80211_tdma.c b/sys/net80211/ieee80211_tdma.c
index 43f32f7..8c191ab 100644
--- a/sys/net80211/ieee80211_tdma.c
+++ b/sys/net80211/ieee80211_tdma.c
@@ -295,6 +295,8 @@ tdma_beacon_miss(struct ieee80211vap *vap)
 		"beacon miss, mode %u state %s\n",
 		vap->iv_opmode, ieee80211_state_name[vap->iv_state]);
 
+	callout_stop(&vap->iv_swbmiss);
+
 	if (ts->tdma_peer != NULL) {	/* XXX? can this be null? */
 		ieee80211_notify_node_leave(vap->iv_bss);
 		ts->tdma_peer = NULL;