Date: Sun, 6 Jan 2013 04:40:07 +0000 (UTC) From: Adrian Chadd <adrian@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r245098 - head/sys/net80211 Message-ID: <201301060440.r064e7vr098693@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: adrian Date: Sun Jan 6 04:40:07 2013 New Revision: 245098 URL: http://svnweb.freebsd.org/changeset/base/245098 Log: Handle ps-poll data frame if_transmit() failure. If the data frame transmission failures, it may have a node reference that needs cleaning up. If the frame is marked as M_ENCAP then it should treat recvif as a node reference and clear it. Now - since the mbuf has been freed by calling if_transmit() (even on failure), the mbuf has to be treated as invalid. Hence why the ifp is used. Modified: head/sys/net80211/ieee80211_hostap.c Modified: head/sys/net80211/ieee80211_hostap.c ============================================================================== --- head/sys/net80211/ieee80211_hostap.c Sun Jan 6 04:38:31 2013 (r245097) +++ head/sys/net80211/ieee80211_hostap.c Sun Jan 6 04:40:07 2013 (r245098) @@ -2324,5 +2324,19 @@ ieee80211_recv_pspoll(struct ieee80211_n ifp = vap->iv_ic->ic_ifp; else ifp = vap->iv_ifp; - (void) ifp->if_transmit(ifp, m); + + /* + * Free any node ref which this mbuf may have. + * + * Much like psq_mfree(), we assume that M_ENCAP nodes have + * node references. + */ + if (ifp->if_transmit(ifp, m) != 0) { + /* + * XXX m is invalid (freed) at this point, determine M_ENCAP + * an alternate way. + */ + if (ifp == vap->iv_ic->ic_ifp) + ieee80211_free_node(ni); + } }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201301060440.r064e7vr098693>