From 2e83cb98f6bbbaa7edda49bbc4db6715ce2dd020 Mon Sep 17 00:00:00 2001
From: Adrian Chadd <adrian@FreeBSD.org>
Date: Sun, 4 Oct 2015 05:22:17 +0000
Subject: [PATCH] Fix run(4) mbuf queue flushing / freeing.

Ensure things are freed during interface stop, or start may end up never
being able to transmit a full queue.
---
 sys/dev/usb/wlan/if_run.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/sys/dev/usb/wlan/if_run.c b/sys/dev/usb/wlan/if_run.c
index e620afd4067b..fe9d477b4324 100644
--- a/sys/dev/usb/wlan/if_run.c
+++ b/sys/dev/usb/wlan/if_run.c
@@ -831,6 +831,21 @@ detach:
 	return (ENXIO);
 }
 
+static void
+run_drain_mbufq(struct run_softc *sc)
+{
+	struct mbuf *m;
+	struct ieee80211_node *ni;
+
+	RUN_LOCK_ASSERT(sc, MA_OWNED);
+	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
+		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
+		m->m_pkthdr.rcvif = NULL;
+		ieee80211_free_node(ni);
+		m_freem(m);
+	}
+}
+
 static int
 run_detach(device_t self)
 {
@@ -852,6 +867,9 @@ run_detach(device_t self)
 	/* free TX list, if any */
 	for (i = 0; i != RUN_EP_QUEUES; i++)
 		run_unsetup_tx_list(sc, &sc->sc_epq[i]);
+
+	/* Free TX queue */
+	run_drain_mbufq(sc);
 	RUN_UNLOCK(sc);
 
 	if (sc->sc_ic.ic_softc == sc) {
@@ -862,7 +880,6 @@ run_detach(device_t self)
 		ieee80211_ifdetach(ic);
 	}
 
-	mbufq_drain(&sc->sc_snd);
 	mtx_destroy(&sc->sc_mtx);
 
 	return (0);
@@ -6172,6 +6189,8 @@ run_stop(void *arg)
 
 	RUN_LOCK(sc);
 
+	run_drain_mbufq(sc);
+
 	if (sc->rx_m != NULL) {
 		m_free(sc->rx_m);
 		sc->rx_m = NULL;