Date: Thu, 18 Aug 2011 22:20:52 -0600 From: PseudoCylon <moonlightakkiy@yahoo.ca> To: Adrian Chadd <adrian@freebsd.org> Cc: freebsd-wireless@freebsd.org Subject: Re: ieee80211_process_callback() use in drivers Message-ID: <CAFZ_MYKJzLE9t78KJVNS4W3wqLzm1cUuLAtzrQQxkL3y88MGKA@mail.gmail.com> In-Reply-To: <CAJ-Vmonw=4K4wNo64zU5UDgWkp4zc9P2v90sY1F1ZYWDfaCTsg@mail.gmail.com> References: <CAFZ_MYJGv8zhJLaAjs_o2mxjjopYofSoymgwfMnO-79nKub66w@mail.gmail.com> <CAJ-VmomS%2Bo%2BvJTjCC26FoXHf6JESDofLgZH4vZRSRKNM3ZgVkQ@mail.gmail.com> <CAFZ_MYLPnH=wMF1uiLCV08LnQztPBA-OkQ8zVKSvp7ZHm%2BvJ1Q@mail.gmail.com> <CAJ-Vmonw=4K4wNo64zU5UDgWkp4zc9P2v90sY1F1ZYWDfaCTsg@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Aug 17, 2011 at 8:31 PM, Adrian Chadd <adrian@freebsd.org> wrote: > On 18 August 2011 10:10, PseudoCylon <moonlightakkiy@yahoo.ca> wrote: > >>> Hm, I fixed the status check in the BAR TX routines. >>> Is that enough? Or are you saying that the node ref is freed somewhere >>> inside ic_raw_xmit() on a TX failure? >> >> Sorry, I found the commit after replied. >> >> But, drivers call ieee80211_free_node() in ic_raw_xmit() on failure. > > Hm, so we can't kill the free, because ieee80211_ref_node() is called early on. > So if ic->ic_raw_xmit(), just return ret, rather then "goto bad" ? > Other mgmt frame Tx functions, i.e ieee80211_send_mgmt(), refs node and expects ic_raw_xmit() to free node whether on success or on failure. So, drivers free node after calling ieee80211_process_callback() or in ic_raw_xmit() on failure. So, ref count is kept balanced. But, ieee80211_send_bar() frees node. So that, on failure in ic_raw_xmit(), drivers need first to test if it is a BAR frame. If not, free node; if so, don't free node because ieee80211_send_bar() does by its self. Otherwise node would be freed twice on one ref.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAFZ_MYKJzLE9t78KJVNS4W3wqLzm1cUuLAtzrQQxkL3y88MGKA>