From owner-svn-src-user@FreeBSD.ORG  Mon Jun 13 02:23:52 2011
Return-Path: <owner-svn-src-user@FreeBSD.ORG>
Delivered-To: svn-src-user@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 19EF3106566C;
	Mon, 13 Jun 2011 02:23:52 +0000 (UTC)
	(envelope-from adrian@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c])
	by mx1.freebsd.org (Postfix) with ESMTP id 0A76D8FC14;
	Mon, 13 Jun 2011 02:23:52 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
	by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id p5D2NpX4051463;
	Mon, 13 Jun 2011 02:23:51 GMT (envelope-from adrian@svn.freebsd.org)
Received: (from adrian@localhost)
	by svn.freebsd.org (8.14.4/8.14.4/Submit) id p5D2NpkN051461;
	Mon, 13 Jun 2011 02:23:51 GMT (envelope-from adrian@svn.freebsd.org)
Message-Id: <201106130223.p5D2NpkN051461@svn.freebsd.org>
From: Adrian Chadd <adrian@FreeBSD.org>
Date: Mon, 13 Jun 2011 02:23:51 +0000 (UTC)
To: src-committers@freebsd.org, svn-src-user@freebsd.org
X-SVN-Group: user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Cc: 
Subject: svn commit: r223031 - user/adrian/if_ath_tx/sys/dev/ath
X-BeenThere: svn-src-user@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "SVN commit messages for the experimental &quot; user&quot;
	src tree" <svn-src-user.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-user>,
	<mailto:svn-src-user-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-src-user>
List-Post: <mailto:svn-src-user@freebsd.org>
List-Help: <mailto:svn-src-user-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-src-user>,
	<mailto:svn-src-user-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Mon, 13 Jun 2011 02:23:52 -0000

Author: adrian
Date: Mon Jun 13 02:23:51 2011
New Revision: 223031
URL: http://svn.freebsd.org/changeset/base/223031

Log:
  Fix another LOR, this time with the IEEE80211_NODE_LOCK() (node table lock.)
  
  free_pkts() would eventually free the last node reference, causing the
  node to be removed from the node table. This required the node table lock
  to be held.

Modified:
  user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c

Modified: user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c
==============================================================================
--- user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c	Mon Jun 13 01:30:18 2011	(r223030)
+++ user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c	Mon Jun 13 02:23:51 2011	(r223031)
@@ -1414,9 +1414,16 @@ ath_tx_node_flush(struct ath_softc *sc, 
 {
 	int tid;
 
-	ATH_NODE_LOCK(an);
 	for (tid = 0; tid < IEEE80211_TID_SIZE; tid++)
 		ath_tx_tid_free_pkts(sc, an, tid);
+
+	/*
+	 * Don't hold the node lock across free_pkts;
+	 * freeing buffers may release the node and
+	 * that will acquire the IEEE80211_NODE_LOCK (node table).
+	 * That then causes a lock reversal.
+	 */
+	ATH_NODE_LOCK(an);
 	an->an_qdepth = 0;
 	ATH_NODE_UNLOCK(an);
 }