From ddc10d6668d00854cf056f91c44cf92010f26e7c Mon Sep 17 00:00:00 2001
From: adrian <adrian@FreeBSD.org>
Date: Mon, 12 Oct 2015 04:55:20 +0000
Subject: [PATCH] net80211: move ieee80211_free_node() call on error from
 ic_raw_xmit() to ieee80211_raw_output().

This doesn't free the mbuf upon error; the driver ic_raw_xmit method is still
doing that.

Submitted by:	<s3erios@gmail.com>
Differential Revision:	https://reviews.freebsd.org/D3774
---
 sys/dev/ath/if_ath_tx.c         |  1 -
 sys/dev/bwi/if_bwi.c            |  5 +----
 sys/dev/bwn/if_bwn.c            | 13 +++++--------
 sys/dev/iwm/if_iwm.c            |  5 -----
 sys/dev/iwn/if_iwn.c            |  9 +--------
 sys/dev/malo/if_malo.c          |  3 ---
 sys/dev/mwl/if_mwl.c            |  3 ---
 sys/dev/otus/if_otus.c          |  1 -
 sys/dev/ral/rt2560.c            |  3 ---
 sys/dev/ral/rt2661.c            |  3 ---
 sys/dev/ral/rt2860.c            |  5 -----
 sys/dev/usb/wlan/if_rsu.c       |  3 ---
 sys/dev/usb/wlan/if_rum.c       |  1 -
 sys/dev/usb/wlan/if_run.c       |  1 -
 sys/dev/usb/wlan/if_uath.c      |  3 ---
 sys/dev/usb/wlan/if_upgt.c      |  3 ---
 sys/dev/usb/wlan/if_ural.c      |  3 ---
 sys/dev/usb/wlan/if_urtw.c      |  3 ---
 sys/dev/usb/wlan/if_urtwn.c     |  3 ---
 sys/dev/usb/wlan/if_zyd.c       |  3 ---
 sys/dev/wi/if_wi.c              |  2 +-
 sys/dev/wpi/if_wpi.c            |  1 -
 sys/net80211/ieee80211_output.c |  4 +++-
 23 files changed, 11 insertions(+), 70 deletions(-)

diff --git a/sys/dev/ath/if_ath_tx.c b/sys/dev/ath/if_ath_tx.c
index 27a17d2fdcc2..7350bb0a5105 100644
--- a/sys/dev/ath/if_ath_tx.c
+++ b/sys/dev/ath/if_ath_tx.c
@@ -2452,7 +2452,6 @@ badbad:
 	ATH_KTR(sc, ATH_KTR_TX, 2, "ath_raw_xmit: bad0: m=%p, params=%p",
 	    m, params);
 	sc->sc_stats.ast_tx_raw_fail++;
-	ieee80211_free_node(ni);
 
 	return error;
 }
diff --git a/sys/dev/bwi/if_bwi.c b/sys/dev/bwi/if_bwi.c
index 0a220a1de576..ebed09c8ac0c 100644
--- a/sys/dev/bwi/if_bwi.c
+++ b/sys/dev/bwi/if_bwi.c
@@ -1399,7 +1399,6 @@ bwi_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	int idx, error;
 
 	if ((sc->sc_flags & BWI_F_RUNNING) == 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -1424,9 +1423,7 @@ bwi_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		tbd->tbd_used++;
 		tbd->tbd_idx = (idx + 1) % BWI_TX_NDESC;
 		sc->sc_tx_timer = 5;
-	} else
-		/* NB: m is reclaimed on encap failure */
-		ieee80211_free_node(ni);
+	}
 	BWI_UNLOCK(sc);
 	return error;
 }
diff --git a/sys/dev/bwn/if_bwn.c b/sys/dev/bwn/if_bwn.c
index 15f6f27a0a5a..0746a8ebf636 100644
--- a/sys/dev/bwn/if_bwn.c
+++ b/sys/dev/bwn/if_bwn.c
@@ -2684,29 +2684,26 @@ bwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	struct ieee80211com *ic = ni->ni_ic;
 	struct bwn_softc *sc = ic->ic_softc;
 	struct bwn_mac *mac = sc->sc_curmac;
+	int error;
 
 	if ((sc->sc_flags & BWN_FLAG_RUNNING) == 0 ||
 	    mac->mac_status < BWN_MAC_STATUS_STARTED) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return (ENETDOWN);
 	}
 
 	BWN_LOCK(sc);
 	if (bwn_tx_isfull(sc, m)) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		BWN_UNLOCK(sc);
 		return (ENOBUFS);
 	}
 
-	if (bwn_tx_start(sc, ni, m) != 0) {
-		if (ni != NULL)
-			ieee80211_free_node(ni);
-	}
-	sc->sc_watchdog_timer = 5;
+	error = bwn_tx_start(sc, ni, m);
+	if (error == 0)
+		sc->sc_watchdog_timer = 5;
 	BWN_UNLOCK(sc);
-	return (0);
+	return (error);
 }
 
 /*
diff --git a/sys/dev/iwm/if_iwm.c b/sys/dev/iwm/if_iwm.c
index cd2ccd2814f3..df17f9312af3 100644
--- a/sys/dev/iwm/if_iwm.c
+++ b/sys/dev/iwm/if_iwm.c
@@ -2877,7 +2877,6 @@ iwm_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	    "->%s begin\n", __func__);
 
 	if ((sc->sc_flags & IWM_FLAG_HW_INITED) == 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		IWM_DPRINTF(sc, IWM_DEBUG_XMIT,
 		    "<-%s not RUNNING\n", __func__);
@@ -2891,10 +2890,6 @@ iwm_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	} else {
 		error = iwm_tx(sc, m, ni, 0);
 	}
-	if (error != 0) {
-		/* NB: m is reclaimed on tx failure */
-		ieee80211_free_node(ni);
-	}
 	sc->sc_tx_timer = 5;
 	IWM_UNLOCK(sc);
 
diff --git a/sys/dev/iwn/if_iwn.c b/sys/dev/iwn/if_iwn.c
index fe36294bbeba..0cdeafb5f898 100644
--- a/sys/dev/iwn/if_iwn.c
+++ b/sys/dev/iwn/if_iwn.c
@@ -4875,7 +4875,6 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	DPRINTF(sc, IWN_DEBUG_XMIT | IWN_DEBUG_TRACE, "->%s begin\n", __func__);
 
 	if ((sc->sc_flags & IWN_FLAG_RUNNING) == 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -4889,9 +4888,6 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (sc->sc_beacon_wait) {
 		if (iwn_xmit_queue_enqueue(sc, m) != 0) {
 			m_freem(m);
-			if_inc_counter(ni->ni_vap->iv_ifp,
-			    IFCOUNTER_OERRORS, 1);
-			ieee80211_free_node(ni);
 			IWN_UNLOCK(sc);
 			return (ENOBUFS);
 		}
@@ -4913,10 +4909,7 @@ iwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		 */
 		error = iwn_tx_data_raw(sc, m, ni, params);
 	}
-	if (error != 0) {
-		/* NB: m is reclaimed on tx failure */
-		ieee80211_free_node(ni);
-	} else
+	if (error == 0)
 		sc->sc_tx_timer = 5;
 
 	IWN_UNLOCK(sc);
diff --git a/sys/dev/malo/if_malo.c b/sys/dev/malo/if_malo.c
index 251ddc60d327..d02b6d5e2475 100644
--- a/sys/dev/malo/if_malo.c
+++ b/sys/dev/malo/if_malo.c
@@ -1786,7 +1786,6 @@ malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	struct malo_txq *txq;
 
 	if (!sc->malo_running || sc->malo_invalid) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -1800,7 +1799,6 @@ malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	txq = &sc->malo_txq[0];
 	bf = malo_getbuf(sc, txq);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENOBUFS;
 	}
@@ -1816,7 +1814,6 @@ malo_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		txq->nfree++;
 		MALO_TXQ_UNLOCK(txq);
 
-		ieee80211_free_node(ni);
 		return EIO;		/* XXX */
 	}
 
diff --git a/sys/dev/mwl/if_mwl.c b/sys/dev/mwl/if_mwl.c
index 7f9d8e010e98..d01165c535b8 100644
--- a/sys/dev/mwl/if_mwl.c
+++ b/sys/dev/mwl/if_mwl.c
@@ -1422,7 +1422,6 @@ mwl_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	struct mwl_txq *txq;
 
 	if (!sc->sc_running || sc->sc_invalid) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -1438,7 +1437,6 @@ mwl_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	bf = mwl_gettxbuf(sc, txq);
 	if (bf == NULL) {
 		sc->sc_stats.mst_tx_qstop++;
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENOBUFS;
 	}
@@ -1448,7 +1446,6 @@ mwl_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (mwl_tx_start(sc, ni, bf, m)) {
 		mwl_puttxbuf_head(txq, bf);
 
-		ieee80211_free_node(ni);
 		return EIO;		/* XXX */
 	}
 	/*
diff --git a/sys/dev/otus/if_otus.c b/sys/dev/otus/if_otus.c
index e60157adda9d..2f6d92fa307e 100644
--- a/sys/dev/otus/if_otus.c
+++ b/sys/dev/otus/if_otus.c
@@ -567,7 +567,6 @@ error:
 	if (bf)
 		otus_freebuf(sc, bf);
 	OTUS_UNLOCK(sc);
-	ieee80211_free_node(ni);
 	m_freem(m);
 	return (ENXIO);
 }
diff --git a/sys/dev/ral/rt2560.c b/sys/dev/ral/rt2560.c
index b03e8faaf242..e5d75181e460 100644
--- a/sys/dev/ral/rt2560.c
+++ b/sys/dev/ral/rt2560.c
@@ -2711,13 +2711,11 @@ rt2560_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (!(sc->sc_flags & RT2560_F_RUNNING)) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENOBUFS;		/* XXX */
 	}
 
@@ -2742,7 +2740,6 @@ rt2560_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 
 	return 0;
 bad:
-	ieee80211_free_node(ni);
 	RAL_UNLOCK(sc);
 	return EIO;		/* XXX */
 }
diff --git a/sys/dev/ral/rt2661.c b/sys/dev/ral/rt2661.c
index 100b5d613424..cff64b18dd17 100644
--- a/sys/dev/ral/rt2661.c
+++ b/sys/dev/ral/rt2661.c
@@ -1636,13 +1636,11 @@ rt2661_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (!(sc->sc_flags & RAL_RUNNING)) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENOBUFS;		/* XXX */
 	}
 
@@ -1659,7 +1657,6 @@ rt2661_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 
 	return 0;
 bad:
-	ieee80211_free_node(ni);
 	RAL_UNLOCK(sc);
 	return EIO;		/* XXX */
 }
diff --git a/sys/dev/ral/rt2860.c b/sys/dev/ral/rt2860.c
index 9c7fa532957d..d233315d28e7 100644
--- a/sys/dev/ral/rt2860.c
+++ b/sys/dev/ral/rt2860.c
@@ -1702,7 +1702,6 @@ rt2860_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (!(sc->sc_flags & RT2860_RUNNNING)) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (params == NULL) {
@@ -1718,10 +1717,6 @@ rt2860_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 		 */
 		error = rt2860_tx_raw(sc, m, ni, params);
 	}
-	if (error != 0) {
-		/* NB: m is reclaimed on tx failure */
-		ieee80211_free_node(ni);
-	}
 	sc->sc_tx_timer = 5;
 	RAL_UNLOCK(sc);
 	return error;
diff --git a/sys/dev/usb/wlan/if_rsu.c b/sys/dev/usb/wlan/if_rsu.c
index 4fb9d85bee9d..6558c93571ea 100644
--- a/sys/dev/usb/wlan/if_rsu.c
+++ b/sys/dev/usb/wlan/if_rsu.c
@@ -2793,19 +2793,16 @@ rsu_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	/* prevent management frames from being sent if we're not ready */
 	if (!sc->sc_running) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENETDOWN);
 	}
 	RSU_LOCK(sc);
 	bf = rsu_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		RSU_UNLOCK(sc);
 		return (ENOBUFS);
 	}
 	if (rsu_tx_start(sc, ni, m, bf) != 0) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		rsu_freebuf(sc, bf);
 		RSU_UNLOCK(sc);
diff --git a/sys/dev/usb/wlan/if_rum.c b/sys/dev/usb/wlan/if_rum.c
index f1c9cdf66524..de7b8806e800 100644
--- a/sys/dev/usb/wlan/if_rum.c
+++ b/sys/dev/usb/wlan/if_rum.c
@@ -2850,7 +2850,6 @@ rum_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 bad:
 	RUM_UNLOCK(sc);
 	m_freem(m);
-	ieee80211_free_node(ni);
 	return ret;
 }
 
diff --git a/sys/dev/usb/wlan/if_run.c b/sys/dev/usb/wlan/if_run.c
index be43755588e3..3a8c02038bfb 100644
--- a/sys/dev/usb/wlan/if_run.c
+++ b/sys/dev/usb/wlan/if_run.c
@@ -3707,7 +3707,6 @@ done:
 	if (error != 0) {
 		if(m != NULL)
 			m_freem(m);
-		ieee80211_free_node(ni);
 	}
 
 	return (error);
diff --git a/sys/dev/usb/wlan/if_uath.c b/sys/dev/usb/wlan/if_uath.c
index 292bb9f6626e..ec5b54caf46c 100644
--- a/sys/dev/usb/wlan/if_uath.c
+++ b/sys/dev/usb/wlan/if_uath.c
@@ -1781,7 +1781,6 @@ uath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if ((sc->sc_flags & UATH_FLAG_INVALID) ||
 	    !(sc->sc_flags & UATH_FLAG_INITDONE)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		UATH_UNLOCK(sc);
 		return (ENETDOWN);
 	}
@@ -1789,7 +1788,6 @@ uath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	/* grab a TX buffer  */
 	bf = uath_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		UATH_UNLOCK(sc);
 		return (ENOBUFS);
@@ -1797,7 +1795,6 @@ uath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 
 	sc->sc_seqnum = 0;
 	if (uath_tx_start(sc, m, ni, bf) != 0) {
-		ieee80211_free_node(ni);
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
 		UATH_STAT_INC(sc, st_tx_inactive);
 		UATH_UNLOCK(sc);
diff --git a/sys/dev/usb/wlan/if_upgt.c b/sys/dev/usb/wlan/if_upgt.c
index 516caf0c43e0..2689ae0fb7f3 100644
--- a/sys/dev/usb/wlan/if_upgt.c
+++ b/sys/dev/usb/wlan/if_upgt.c
@@ -798,14 +798,12 @@ upgt_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	/* prevent management frames from being sent if we're not ready */
 	if (!(sc->sc_flags & UPGT_FLAG_INITDONE)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		UPGT_UNLOCK(sc);
 		return ENETDOWN;
 	}
 
 	data_tx = upgt_gettxbuf(sc);
 	if (data_tx == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		UPGT_UNLOCK(sc);
 		return (ENOBUFS);
@@ -814,7 +812,6 @@ upgt_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (upgt_tx_start(sc, m, ni, data_tx) != 0) {
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, data_tx, next);
 		UPGT_STAT_INC(sc, st_tx_inactive);
-		ieee80211_free_node(ni);
 		UPGT_UNLOCK(sc);
 		return (EIO);
 	}
diff --git a/sys/dev/usb/wlan/if_ural.c b/sys/dev/usb/wlan/if_ural.c
index 6f6686f21c8c..3fb03bdf39d1 100644
--- a/sys/dev/usb/wlan/if_ural.c
+++ b/sys/dev/usb/wlan/if_ural.c
@@ -2123,13 +2123,11 @@ ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (!sc->sc_running) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	if (sc->tx_nfree < RAL_TX_MINFREE) {
 		RAL_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return EIO;
 	}
 
@@ -2152,7 +2150,6 @@ ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	return 0;
 bad:
 	RAL_UNLOCK(sc);
-	ieee80211_free_node(ni);
 	return EIO;		/* XXX */
 }
 
diff --git a/sys/dev/usb/wlan/if_urtw.c b/sys/dev/usb/wlan/if_urtw.c
index 040ba867df30..a9aac3a02f20 100644
--- a/sys/dev/usb/wlan/if_urtw.c
+++ b/sys/dev/usb/wlan/if_urtw.c
@@ -1527,20 +1527,17 @@ urtw_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	/* prevent management frames from being sent if we're not ready */
 	if (!(sc->sc_flags & URTW_RUNNING)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return ENETDOWN;
 	}
 	URTW_LOCK(sc);
 	bf = urtw_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		URTW_UNLOCK(sc);
 		return (ENOBUFS);		/* XXX */
 	}
 
 	if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_LOW) != 0) {
-		ieee80211_free_node(ni);
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
 		URTW_UNLOCK(sc);
 		return (EIO);
diff --git a/sys/dev/usb/wlan/if_urtwn.c b/sys/dev/usb/wlan/if_urtwn.c
index f680edc33cb9..cb101c65ea42 100644
--- a/sys/dev/usb/wlan/if_urtwn.c
+++ b/sys/dev/usb/wlan/if_urtwn.c
@@ -3460,13 +3460,11 @@ urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	/* prevent management frames from being sent if we're not ready */
 	if (!(sc->sc_flags & URTWN_RUNNING)) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENETDOWN);
 	}
 	URTWN_LOCK(sc);
 	bf = urtwn_getbuf(sc);
 	if (bf == NULL) {
-		ieee80211_free_node(ni);
 		m_freem(m);
 		URTWN_UNLOCK(sc);
 		return (ENOBUFS);
@@ -3474,7 +3472,6 @@ urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 
 	if (urtwn_tx_start(sc, ni, m, bf) != 0) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
 		URTWN_UNLOCK(sc);
 		return (EIO);
diff --git a/sys/dev/usb/wlan/if_zyd.c b/sys/dev/usb/wlan/if_zyd.c
index ed70d19a43e2..dc7a87f2dad6 100644
--- a/sys/dev/usb/wlan/if_zyd.c
+++ b/sys/dev/usb/wlan/if_zyd.c
@@ -2590,13 +2590,11 @@ zyd_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	if (!(sc->sc_flags & ZYD_FLAG_RUNNING)) {
 		ZYD_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENETDOWN);
 	}
 	if (sc->tx_nfree == 0) {
 		ZYD_UNLOCK(sc);
 		m_freem(m);
-		ieee80211_free_node(ni);
 		return (ENOBUFS);		/* XXX */
 	}
 
@@ -2607,7 +2605,6 @@ zyd_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	 */
 	if (zyd_tx_start(sc, m, ni) != 0) {
 		ZYD_UNLOCK(sc);
-		ieee80211_free_node(ni);
 		m_freem(m);
 		return (EIO);
 	}
diff --git a/sys/dev/wi/if_wi.c b/sys/dev/wi/if_wi.c
index f8af23138340..832e6aa37c04 100644
--- a/sys/dev/wi/if_wi.c
+++ b/sys/dev/wi/if_wi.c
@@ -1077,6 +1077,7 @@ wi_raw_xmit(struct ieee80211_node *ni, struct mbuf *m0,
 		goto out;
 	}
 	m0 = NULL;
+	ieee80211_free_node(ni);
 
 	sc->sc_txnext = cur = (cur + 1) % sc->sc_ntxbuf;
 out:
@@ -1084,7 +1085,6 @@ out:
 
 	if (m0 != NULL)
 		m_freem(m0);
-	ieee80211_free_node(ni);
 	return rc;
 }
 
diff --git a/sys/dev/wpi/if_wpi.c b/sys/dev/wpi/if_wpi.c
index 040360f16cda..7932bce9b7de 100644
--- a/sys/dev/wpi/if_wpi.c
+++ b/sys/dev/wpi/if_wpi.c
@@ -3093,7 +3093,6 @@ unlock:	WPI_TX_UNLOCK(sc);
 
 	if (error != 0) {
 		m_freem(m);
-		ieee80211_free_node(ni);
 		DPRINTF(sc, WPI_DEBUG_TRACE, TRACE_STR_END_ERR, __func__);
 
 		return error;
diff --git a/sys/net80211/ieee80211_output.c b/sys/net80211/ieee80211_output.c
index 81d9eb192e36..322491d25a2c 100644
--- a/sys/net80211/ieee80211_output.c
+++ b/sys/net80211/ieee80211_output.c
@@ -531,8 +531,10 @@ ieee80211_raw_output(struct ieee80211vap *vap, struct ieee80211_node *ni,
 		(void) ieee80211_add_xmit_params(m, params);
 
 	error = ic->ic_raw_xmit(ni, m, params);
-	if (error)
+	if (error) {
 		if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS, 1);
+		ieee80211_free_node(ni);
+	}
 	return (error);
 }
 
-- 
2.39.5