From owner-freebsd-wireless@FreeBSD.ORG Fri Aug 19 04:41:10 2011 Return-Path: Delivered-To: freebsd-wireless@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id E0DB41065672 for ; Fri, 19 Aug 2011 04:41:10 +0000 (UTC) (envelope-from adrian.chadd@gmail.com) Received: from mail-yw0-f54.google.com (mail-yw0-f54.google.com [209.85.213.54]) by mx1.freebsd.org (Postfix) with ESMTP id 9F2488FC1A for ; Fri, 19 Aug 2011 04:41:10 +0000 (UTC) Received: by ywo32 with SMTP id 32so2284510ywo.13 for ; Thu, 18 Aug 2011 21:41:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:date :x-google-sender-auth:message-id:subject:from:to:cc:content-type; bh=YfUmkoBHS2OdxfL+XPj+T/ACuzH7Qi7h8JkAeGntFNs=; b=ICpdMonE9p+ceQVh1t+CXIjhKApeytm5kLj+nr+LSwOJjbyI2lox2eUuiy9pTVTT8Y jL8bnjSFH2tgfoicDsu4JBpw0+MAeJyu7VBLogDBhmJhu+ZuaeqQ1MGy7BNCzleyzkZt P+k4cBEnMfuCPlgjGQvX7qcWtHlx8O7R1/du8= MIME-Version: 1.0 Received: by 10.151.12.1 with SMTP id p1mr1735292ybi.272.1313728869745; Thu, 18 Aug 2011 21:41:09 -0700 (PDT) Sender: adrian.chadd@gmail.com Received: by 10.150.145.21 with HTTP; Thu, 18 Aug 2011 21:41:09 -0700 (PDT) In-Reply-To: References: Date: Fri, 19 Aug 2011 12:41:09 +0800 X-Google-Sender-Auth: Ll-NFI4zK4-kNK7TW2b9X-4-ExE Message-ID: From: Adrian Chadd To: PseudoCylon Content-Type: text/plain; charset=ISO-8859-1 Cc: freebsd-wireless@freebsd.org Subject: Re: ieee80211_process_callback() use in drivers X-BeenThere: freebsd-wireless@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Discussions of 802.11 stack, tools device driver development." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 19 Aug 2011 04:41:11 -0000 On 19 August 2011 12:20, PseudoCylon wrote: >> Hm, so we can't kill the free, because ieee80211_ref_node() is called early on. >> So if ic->ic_raw_xmit(), just return ret, rather then "goto bad" ? >> > > Other mgmt frame Tx functions, i.e ieee80211_send_mgmt(), refs node > and expects ic_raw_xmit() to free node whether on success or on > failure. So, drivers free node after calling > ieee80211_process_callback() or in ic_raw_xmit() on failure. So, ref > count is kept balanced. > > But, ieee80211_send_bar() frees node. So that, on failure in > ic_raw_xmit(), drivers need first to test if it is a BAR frame. If > not, free node; if so, don't free node because ieee80211_send_bar() > does by its self. Otherwise node would be freed twice on one ref. Right. So I'll fix that function to just not free the node once ic->ic_raw_xmit is called. Adrian