From owner-p4-projects@FreeBSD.ORG Sat Oct 30 23:37:25 2004 Return-Path: Delivered-To: p4-projects@freebsd.org Received: by hub.freebsd.org (Postfix, from userid 32767) id 4C24816A4D0; Sat, 30 Oct 2004 23:37:25 +0000 (GMT) Delivered-To: perforce@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 1BF9116A4CE for ; Sat, 30 Oct 2004 23:37:25 +0000 (GMT) Received: from repoman.freebsd.org (repoman.freebsd.org [216.136.204.115]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0CB4543D54 for ; Sat, 30 Oct 2004 23:37:25 +0000 (GMT) (envelope-from sam@freebsd.org) Received: from repoman.freebsd.org (localhost [127.0.0.1]) by repoman.freebsd.org (8.12.11/8.12.11) with ESMTP id i9UNbOij088761 for ; Sat, 30 Oct 2004 23:37:24 GMT (envelope-from sam@freebsd.org) Received: (from perforce@localhost) by repoman.freebsd.org (8.12.11/8.12.11/Submit) id i9UNbOqm088758 for perforce@freebsd.org; Sat, 30 Oct 2004 23:37:24 GMT (envelope-from sam@freebsd.org) Date: Sat, 30 Oct 2004 23:37:24 GMT Message-Id: <200410302337.i9UNbOqm088758@repoman.freebsd.org> X-Authentication-Warning: repoman.freebsd.org: perforce set sender to sam@freebsd.org using -f From: Sam Leffler To: Perforce Change Reviews Subject: PERFORCE change 64003 for review X-BeenThere: p4-projects@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: p4 projects tree changes List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 30 Oct 2004 23:37:25 -0000 http://perforce.freebsd.org/chv.cgi?CH=64003 Change 64003 by sam@sam_ebb on 2004/10/30 23:36:50 Reclaim node references when cleaning the tx queues when a node is cleansed. Previously we could get away with just nulling out the held reference as we were only called just before the node was reclaimed. But with recent changes to cleanup node state separately from freeing a node we must properly release references. This fixes refcnt leaks when operating as an ap. Affected files ... .. //depot/projects/wifi/sys/dev/ath/if_ath.c#5 edit Differences ... ==== //depot/projects/wifi/sys/dev/ath/if_ath.c#5 (text+ko) ==== @@ -2023,20 +2023,26 @@ /* * Clear any references to a node in a transmit queue. - * This happens when the node is removed so we don't - * need to worry about reclaiming reference counts; we - * just null the pointer and the right thing will happen - * when the buffer is cleaned. + * This happens when the node is cleaned so we don't + * need to worry about the reference count going to zero; + * we just reclaim the reference w/o dropping the txq lock. + * Then we null the pointer and the right thing happens + * when the buffer is cleaned in ath_tx_processq. */ static void -ath_tx_cleanq(struct ath_txq *txq, struct ieee80211_node *ni) +ath_tx_cleanq(struct ieee80211com *ic, struct ath_txq *txq, + struct ieee80211_node *ni) { struct ath_buf *bf; ATH_TXQ_LOCK(txq); STAILQ_FOREACH(bf, &txq->axq_q, bf_list) { - if (bf->bf_node == ni) + if (bf->bf_node == ni) { bf->bf_node = NULL; + if (ni != ic->ic_bss) + /* NB: cannot use ieee80211_unref_node */ + ieee80211_node_decref(ni); + } } ATH_TXQ_UNLOCK(txq); } @@ -2051,7 +2057,7 @@ for (i = 0; i < HAL_NUM_TX_QUEUES; i++) if (ATH_TXQ_SETUP(sc, i)) - ath_tx_cleanq(&sc->sc_txq[i], ni); + ath_tx_cleanq(ic, &sc->sc_txq[i], ni); ath_rate_node_cleanup(sc, ATH_NODE(ni)); sc->sc_node_cleanup(ic, ni); }