PERFORCE change 114934 for review

[Sam Leffler]

http://perforce.freebsd.org/chv.cgi?CH=114934

Change 114934 by sam at sam_ebb on 2007/02/23 23:57:19

	Correct refcnt handling for sending a null data frame; looks
	to have been mis-merged a while ago.

Affected files ...

.. //depot/projects/wifi/sys/net80211/ieee80211_output.c#65 edit

Differences ...

==== //depot/projects/wifi/sys/net80211/ieee80211_output.c#65 (text+ko) ====

@@ -339,6 +339,10 @@
 
 /*
  * Send a null data frame to the specified node.
+ *
+ * NB: the caller is assumed to have setup a node reference
+ *     for use; this is necessary to deal with a race condition
+ *     when probing for inactive stations.
  */
 int
 ieee80211_send_nulldata(struct ieee80211_node *ni)
@@ -351,10 +355,11 @@
 	MGETHDR(m, M_NOWAIT, MT_DATA);
 	if (m == NULL) {
 		/* XXX debug msg */
+		ieee80211_unref_node(&ni);
 		ic->ic_stats.is_tx_nobuf++;
 		return ENOMEM;
 	}
-	m->m_pkthdr.rcvif = (void *) ieee80211_ref_node(ni);
+	m->m_pkthdr.rcvif = (void *) ni;
 
 	wh = mtod(m, struct ieee80211_frame *);
 	ieee80211_send_setup(ic, ni, wh,