[panic] Race in IEEE802.11 layer towards device drivers

[Hans Petter Selasky]

On Monday 12 July 2010 02:07:55 Andrew Thompson wrote:
> This turned out to be refcounting of the ieee80211_node struct which
> was causing this panic. vap->iv_bss can be freed at any time so all
> users of it need to bump the refcount to use it safely.
> 
> This patch should fix the panic in the rum driver.
> http://people.freebsd.org/~thompsa/rum_node_refcnt.diff
> 
> There are other places where it is still an issue such as the
> ieee80211_tx_mgt_timeout callout which havnt been addressed yet, and
> of course all other ieee80211 drivers.
> 

I will give your patch a try later today.

--HPS