svn commit: r288279 - head/sys/dev/usb/wlan

[Adrian Chadd]

Author: adrian
Date: Sat Sep 26 22:20:30 2015
New Revision: 288279
URL: https://svnweb.freebsd.org/changeset/base/288279

Log:
  Free the TX/RX list buffers /before/ tearing down net80211 state.
  
  Otherwise buffers in the RX queue get freed with their parent vap
  being gone and you end up with a juicy kernel panic.

Modified:
  head/sys/dev/usb/wlan/if_rsu.c

Modified: head/sys/dev/usb/wlan/if_rsu.c
==============================================================================
--- head/sys/dev/usb/wlan/if_rsu.c	Sat Sep 26 22:20:11 2015	(r288278)
+++ head/sys/dev/usb/wlan/if_rsu.c	Sat Sep 26 22:20:30 2015	(r288279)
@@ -545,18 +545,25 @@ rsu_detach(device_t self)
 	RSU_LOCK(sc);
 	rsu_stop(sc);
 	RSU_UNLOCK(sc);
+
 	usbd_transfer_unsetup(sc->sc_xfer, RSU_N_TRANSFER);
 
+	/*
+	 * Free buffers /before/ we detach from net80211, else node
+	 * references to destroyed vaps will lead to a panic.
+	 */
+	/* Free Tx/Rx buffers. */
+	RSU_LOCK(sc);
+	rsu_free_tx_list(sc);
+	rsu_free_rx_list(sc);
+	RSU_UNLOCK(sc);
+
 	/* Frames are freed; detach from net80211 */
 	ieee80211_ifdetach(ic);
 
 	taskqueue_drain_timeout(taskqueue_thread, &sc->calib_task);
 	taskqueue_drain(taskqueue_thread, &sc->tx_task);
 
-	/* Free Tx/Rx buffers. */
-	rsu_free_tx_list(sc);
-	rsu_free_rx_list(sc);
-
 	mtx_destroy(&sc->sc_mtx);
 
 	return (0);