From owner-freebsd-wireless@FreeBSD.ORG Thu Jan 26 16:35:23 2012 Return-Path: Delivered-To: freebsd-wireless@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 15E9A106564A; Thu, 26 Jan 2012 16:35:23 +0000 (UTC) (envelope-from bschmidt@techwires.net) Received: from mail-lpp01m010-f54.google.com (mail-lpp01m010-f54.google.com [209.85.215.54]) by mx1.freebsd.org (Postfix) with ESMTP id 62D8C8FC14; Thu, 26 Jan 2012 16:35:21 +0000 (UTC) Received: by lahj13 with SMTP id j13so597786lah.13 for ; Thu, 26 Jan 2012 08:35:21 -0800 (PST) MIME-Version: 1.0 Received: by 10.112.38.227 with SMTP id j3mr759957lbk.88.1327595720933; Thu, 26 Jan 2012 08:35:20 -0800 (PST) Received: by 10.152.3.161 with HTTP; Thu, 26 Jan 2012 08:35:20 -0800 (PST) X-Originating-IP: [79.140.39.245] In-Reply-To: References: Date: Thu, 26 Jan 2012 17:35:20 +0100 Message-ID: From: Bernhard Schmidt To: Adrian Chadd Content-Type: text/plain; charset=ISO-8859-1 Cc: PseudoCylon , freebsd-wireless@freebsd.org Subject: Re: net80211 race conditions seen in -HEAD X-BeenThere: freebsd-wireless@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussions of 802.11 stack, tools device driver development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 26 Jan 2012 16:35:23 -0000 On Wed, Jan 25, 2012 at 22:47, Adrian Chadd wrote: > .. whilst the refcount is 1, so ieee80211_ref_node() may not increment the > counter before it's freed by another thread. You know, that is an inline function, what "lifetime" are we taking about? iv_bss has other issues, being overwritten while some task is using it no matter how high the refcount is is once of those. -- Bernhard