From 9eb1568718890683e687c226e2480ec91416a069 Mon Sep 17 00:00:00 2001 From: Stefan Sperling Date: Sat, 21 Jan 2012 19:01:05 +0000 Subject: Hold interrupts blocked while comparing a cached node's refcount to zero and freeing the node. Just in case an interrupt happens to ref the node after the refcount was checked but before the node is freed. Tested by several as part of a larger diff. --- sys/net80211/ieee80211_node.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'sys/net80211/ieee80211_node.c') diff --git a/sys/net80211/ieee80211_node.c b/sys/net80211/ieee80211_node.c index 9435a287862..76154d957c0 100644 --- a/sys/net80211/ieee80211_node.c +++ b/sys/net80211/ieee80211_node.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ieee80211_node.c,v 1.64 2012/01/18 14:35:34 stsp Exp $ */ +/* $OpenBSD: ieee80211_node.c,v 1.65 2012/01/21 19:01:04 stsp Exp $ */ /* $NetBSD: ieee80211_node.c,v 1.14 2004/05/09 09:18:47 dyoung Exp $ */ /*- @@ -1080,12 +1080,12 @@ ieee80211_release_node(struct ieee80211com *ic, struct ieee80211_node *ni) DPRINTF(("%s refcnt %d\n", ether_sprintf(ni->ni_macaddr), ni->ni_refcnt)); + s = splnet(); if (ieee80211_node_decref(ni) == 0 && ni->ni_state == IEEE80211_STA_COLLECT) { - s = splnet(); ieee80211_free_node(ic, ni); - splx(s); } + splx(s); } void -- cgit v1.2.3