From 02bc3a2f7814e21e0c88520dd15dba57ba752969 Mon Sep 17 00:00:00 2001
From: damien <damien@openbsd.org>
Date: Sat, 2 Aug 2008 08:33:21 +0000
Subject: [PATCH] do not touch m after it has been enqueued with IFQ_ENQUEUE().
 copy m_pkthdr.len and m_flags before and use that after to update the
 statistics.

from altq(4) man page and for consistency with what is done in
other parts of the tree.
---
 sys/net80211/ieee80211_output.c     | 14 ++++++++------
 sys/net80211/ieee80211_pae_output.c |  9 +++++----
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/sys/net80211/ieee80211_output.c b/sys/net80211/ieee80211_output.c
index 982d7664143..20f0d324714 100644
--- a/sys/net80211/ieee80211_output.c
+++ b/sys/net80211/ieee80211_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_output.c,v 1.64 2008/08/02 08:20:16 damien Exp $	*/
+/*	$OpenBSD: ieee80211_output.c,v 1.65 2008/08/02 08:33:21 damien Exp $	*/
 /*	$NetBSD: ieee80211_output.c,v 1.13 2004/05/31 11:02:55 dyoung Exp $	*/
 
 /*-
@@ -98,9 +98,9 @@ int
 ieee80211_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
     struct rtentry *rt)
 {
-	u_int dlt = 0;
-	int s, error = 0;
 	struct m_tag *mtag;
+	int s, len, error = 0;
+	u_short mflags;
 
 	/* Interface has to be up and running */
 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) !=
@@ -111,7 +111,7 @@ ieee80211_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
 
 	/* Try to get the DLT from a mbuf tag */
 	if ((mtag = m_tag_find(m, PACKET_TAG_DLT, NULL)) != NULL) {
-		dlt = *(u_int *)(mtag + 1);
+		u_int dlt = *(u_int *)(mtag + 1);
 
 		/* Fallback to ethernet for non-802.11 linktypes */
 		if (!(dlt == DLT_IEEE802_11 || dlt == DLT_IEEE802_11_RADIO))
@@ -122,6 +122,8 @@ ieee80211_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
 		 * further headers, and start output if interface not
 		 * yet active.
 		 */
+		mflags = m->m_flags;
+		len = m->m_pkthdr.len;
 		s = splnet();
 		IFQ_ENQUEUE(&ifp->if_snd, m, NULL, error);
 		if (error) {
@@ -131,8 +133,8 @@ ieee80211_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
 			    ifp->if_xname);
 			return (error);
 		}
-		ifp->if_obytes += m->m_pkthdr.len;
-		if (m->m_flags & M_MCAST)
+		ifp->if_obytes += len;
+		if (mflags & M_MCAST)
 			ifp->if_omcasts++;
 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
 			(*ifp->if_start)(ifp);
diff --git a/sys/net80211/ieee80211_pae_output.c b/sys/net80211/ieee80211_pae_output.c
index 78404227cec..b1e2c04bcc9 100644
--- a/sys/net80211/ieee80211_pae_output.c
+++ b/sys/net80211/ieee80211_pae_output.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ieee80211_pae_output.c,v 1.4 2008/07/27 14:21:15 damien Exp $	*/
+/*	$OpenBSD: ieee80211_pae_output.c,v 1.5 2008/08/02 08:33:21 damien Exp $	*/
 
 /*-
  * Copyright (c) 2007,2008 Damien Bergamini <damien.bergamini@free.fr>
@@ -61,8 +61,8 @@ ieee80211_send_eapol_key(struct ieee80211com *ic, struct mbuf *m,
 	struct ifnet *ifp = &ic->ic_if;
 	struct ether_header *eh;
 	struct ieee80211_eapol_key *key;
-	u_int16_t len, info;
-	int s, error;
+	u_int16_t info;
+	int s, len, error;
 
 	M_PREPEND(m, sizeof(struct ether_header), M_DONTWAIT);
 	if (m == NULL)
@@ -109,13 +109,14 @@ ieee80211_send_eapol_key(struct ieee80211com *ic, struct mbuf *m,
 	if (info & EAPOL_KEY_KEYMIC)
 		ieee80211_eapol_key_mic(key, ptk->kck);
 
+	len = m->m_pkthdr.len;
 	s = splnet();
 	/* start a 100ms timeout if an answer is expected from supplicant */
 	if (info & EAPOL_KEY_KEYACK)
 		timeout_add(&ni->ni_rsn_timeout, hz / 10);
 	IFQ_ENQUEUE(&ifp->if_snd, m, NULL, error);
 	if (error == 0) {
-		ifp->if_obytes += m->m_pkthdr.len;
+		ifp->if_obytes += len;
 		if ((ifp->if_flags & IFF_OACTIVE) == 0)
 			(*ifp->if_start)(ifp);
 	}
-- 
2.20.1