svn commit: r223031 - user/adrian/if_ath_tx/sys/dev/ath

[Adrian Chadd]

Author: adrian
Date: Mon Jun 13 02:23:51 2011
New Revision: 223031
URL: http://svn.freebsd.org/changeset/base/223031

Log:
  Fix another LOR, this time with the IEEE80211_NODE_LOCK() (node table lock.)
  
  free_pkts() would eventually free the last node reference, causing the
  node to be removed from the node table. This required the node table lock
  to be held.

Modified:
  user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c

Modified: user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c
==============================================================================
--- user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c	Mon Jun 13 01:30:18 2011	(r223030)
+++ user/adrian/if_ath_tx/sys/dev/ath/if_ath_tx.c	Mon Jun 13 02:23:51 2011	(r223031)
@@ -1414,9 +1414,16 @@ ath_tx_node_flush(struct ath_softc *sc, 
 {
 	int tid;
 
-	ATH_NODE_LOCK(an);
 	for (tid = 0; tid < IEEE80211_TID_SIZE; tid++)
 		ath_tx_tid_free_pkts(sc, an, tid);
+
+	/*
+	 * Don't hold the node lock across free_pkts;
+	 * freeing buffers may release the node and
+	 * that will acquire the IEEE80211_NODE_LOCK (node table).
+	 * That then causes a lock reversal.
+	 */
+	ATH_NODE_LOCK(an);
 	an->an_qdepth = 0;
 	ATH_NODE_UNLOCK(an);
 }