Fix a node reference leak in XR mode due to re-assigning a variable without unref...

git-svn-id: http://madwifi-project.org/svn/madwifi/trunk@2824 0192ed92-7a03-0410-a25b-9323aeb14dbd

diff --git a/net80211/ieee80211_output.c b/net80211/ieee80211_output.c
index 14ac3a1fbf6918a44ececf3871cb6959705dc5a4..91b9e8f3bac107a029bcdfd88d0aaeeda71414c6 100644 (file)
--- a/net80211/ieee80211_output.c
+++ b/net80211/ieee80211_output.c
@@ -270,7 +270,7 @@ ieee80211_hardstart(struct sk_buff *skb, struct net_device *dev)
                 * We'll get the frame back when the time is right.
                 */
                ieee80211_pwrsave(ni, skb);
-               ieee80211_unref_node(&ni);
+               ieee80211_unref_node(&ni); /* matches ieee80211_find_txnode */
                return 0;
        }
 
@@ -284,11 +284,11 @@ ieee80211_hardstart(struct sk_buff *skb, struct net_device *dev)
        if (vap->iv_xrvap && ni == vap->iv_bss &&
            vap->iv_xrvap->iv_sta_assoc) {
                struct sk_buff *skb1;
-               ni = ieee80211_find_txnode(vap->iv_xrvap, eh->ether_dhost);
                skb1 = skb_clone(skb, GFP_ATOMIC);
                if (skb1) {
                        cb = (struct ieee80211_cb *) skb1->cb;
-                       cb->ni = ni;
+                       cb->ni = ieee80211_find_txnode(vap->iv_xrvap, 
+                                                      eh->ether_dhost);
                        cb->flags = 0;
                        cb->next = NULL;
                        (void) dev_queue_xmit(skb1);
@@ -296,14 +296,14 @@ ieee80211_hardstart(struct sk_buff *skb, struct net_device *dev)
        }
 #endif
        ieee80211_parent_queue_xmit(skb);
-       ieee80211_unref_node(&ni);
+       ieee80211_unref_node(&ni); /* matches ieee80211_find_txnode */
        return 0;
 
 bad:
        if (skb != NULL)
                dev_kfree_skb(skb);
        if (ni != NULL)
-               ieee80211_unref_node(&ni);
+               ieee80211_unref_node(&ni); /* matches ieee80211_find_txnode */
        return 0;
 }