-Index: madwifi/net80211/ieee80211_wireless.c\r
-===================================================================\r
---- madwifi/net80211/ieee80211_wireless.c (revision 2482)\r
-+++ madwifi/net80211/ieee80211_wireless.c (revision 2484)\r
-@@ -1102,5 +1102,4 @@\r
- for (i = 0; i < number; i++) {\r
- ni = ieee80211_find_node(nt, &vap->iv_spy.mac[i * IEEE80211_ADDR_LEN]);\r
-- /* TODO: free node ? */\r
- /* check we are associated w/ this vap */\r
- if (ni && (ni->ni_vap == vap)) {\r
-@@ -1114,4 +1113,5 @@\r
- spy_stat[i].updated = IW_QUAL_ALL_INVALID;\r
- }\r
-+ ieee80211_unref_node(&ni);\r
- }\r
- \r
-@@ -3191,4 +3191,5 @@\r
- if (ik->ik_keylen > sizeof(ik->ik_keydata))\r
- return -E2BIG;\r
-+\r
- kix = ik->ik_keyix;\r
- if (kix == IEEE80211_KEYIX_NONE) {\r
-@@ -3214,4 +3215,5 @@\r
- ik->ik_flags |= IEEE80211_KEY_GROUP; /* XXX */\r
- }\r
-+\r
- error = 0;\r
- flags = ik->ik_flags & IEEE80211_KEY_COMMON;\r
-@@ -3228,5 +3230,5 @@\r
- memcpy(wk->wk_key, ik->ik_keydata, ik->ik_keylen);\r
- if (!ieee80211_crypto_setkey(vap, wk,\r
-- ni != NULL ? ni->ni_macaddr : ik->ik_macaddr, ni))\r
-+ (ni != NULL) ? ni->ni_macaddr : ik->ik_macaddr, ni))\r
- error = -EIO;\r
- else if ((ik->ik_flags & IEEE80211_KEY_DEFAULT))\r
-@@ -3234,4 +3236,5 @@\r
- } else\r
- error = -ENXIO;\r
-+\r
- ieee80211_key_update_end(vap);\r
- if (ni != NULL)\r
-Index: madwifi/net80211/ieee80211_output.c\r
-===================================================================\r
---- madwifi/net80211/ieee80211_output.c (revision 2438)\r
-+++ madwifi/net80211/ieee80211_output.c (revision 2484)\r
-@@ -269,4 +269,5 @@\r
- */\r
- ieee80211_pwrsave(ni, skb);\r
-+ ieee80211_unref_node(&ni);\r
- return 0;\r
- }\r
-@@ -283,5 +284,5 @@\r
- struct sk_buff *skb1;\r
- ni = ieee80211_find_txnode(vap->iv_xrvap, eh->ether_dhost);\r
-- skb1 = skb_clone(skb,GFP_ATOMIC);\r
-+ skb1 = skb_clone(skb, GFP_ATOMIC);\r
- if (skb1) {\r
- cb = (struct ieee80211_cb *) skb1->cb;\r
-Index: madwifi/ath/if_ath.c\r
-===================================================================\r
---- madwifi/ath/if_ath.c (revision 2482)\r
-+++ madwifi/ath/if_ath.c (revision 2484)\r
-@@ -8111,14 +8111,13 @@\r
- /* Depending on the sequence of bringing up devices\r
- * it's possible the rates of the root bss isn't\r
-- * filled yet. \r
-- */\r
-- if (vap->iv_ic->ic_newassoc != NULL &&\r
-- wds_ni->ni_rates.rs_nrates != 0) {\r
-+ * filled yet. */\r
-+ if ((vap->iv_ic->ic_newassoc != NULL) &&\r
-+ (wds_ni->ni_rates.rs_nrates != 0)) {\r
- /* Fill in the rates based on our own rates\r
- * we rely on the rate selection mechanism\r
-- * to find out which rates actually work!\r
-- */\r
-+ * to find out which rates actually work! */\r
- vap->iv_ic->ic_newassoc(wds_ni, 1);\r
- }\r
-+ ieee80211_unref_node(&wds_ni);\r
- }\r
- break;\r
+Index: madwifi-ng-r2420-20070602/ath/if_ath.c
+===================================================================
+--- madwifi-ng-r2420-20070602.orig/ath/if_ath.c 2007-07-02 23:49:33.450710750 +0200
++++ madwifi-ng-r2420-20070602/ath/if_ath.c 2007-07-02 23:50:43.107064000 +0200
+@@ -8197,16 +8197,15 @@
+ wds_ni->ni_rates = vap->iv_bss->ni_rates;
+ /* Depending on the sequence of bringing up devices
+ * it's possible the rates of the root bss isn't
+- * filled yet.
+- */
+- if (vap->iv_ic->ic_newassoc != NULL &&
+- wds_ni->ni_rates.rs_nrates != 0) {
++ * filled yet. */
++ if ((vap->iv_ic->ic_newassoc != NULL) &&
++ (wds_ni->ni_rates.rs_nrates != 0)) {
+ /* Fill in the rates based on our own rates
+ * we rely on the rate selection mechanism
+- * to find out which rates actually work!
+- */
++ * to find out which rates actually work! */
+ vap->iv_ic->ic_newassoc(wds_ni, 1);
+ }
++ ieee80211_unref_node(&wds_ni);
+ }
+ break;
+ default:
+Index: madwifi-ng-r2420-20070602/net80211/ieee80211_output.c
+===================================================================
+--- madwifi-ng-r2420-20070602.orig/net80211/ieee80211_output.c 2007-07-02 23:49:31.574593500 +0200
++++ madwifi-ng-r2420-20070602/net80211/ieee80211_output.c 2007-07-02 23:50:37.462711250 +0200
+@@ -268,6 +268,7 @@
+ * We'll get the frame back when the time is right.
+ */
+ ieee80211_pwrsave(ni, skb);
++ ieee80211_unref_node(&ni);
+ return 0;
+ }
+
+@@ -282,7 +283,7 @@
+ vap->iv_xrvap->iv_sta_assoc) {
+ struct sk_buff *skb1;
+ ni = ieee80211_find_txnode(vap->iv_xrvap, eh->ether_dhost);
+- skb1 = skb_clone(skb,GFP_ATOMIC);
++ skb1 = skb_clone(skb, GFP_ATOMIC);
+ if (skb1) {
+ cb = (struct ieee80211_cb *) skb1->cb;
+ cb->ni = ni;
+Index: madwifi-ng-r2420-20070602/net80211/ieee80211_wireless.c
+===================================================================
+--- madwifi-ng-r2420-20070602.orig/net80211/ieee80211_wireless.c 2007-07-02 23:49:31.566593000 +0200
++++ madwifi-ng-r2420-20070602/net80211/ieee80211_wireless.c 2007-07-02 23:49:34.126753000 +0200
+@@ -1088,7 +1088,6 @@
+ /* locate a node, read its rssi, check if updated, convert to dBm */
+ for (i = 0; i < number; i++) {
+ ni = ieee80211_find_node(nt, &vap->iv_spy.mac[i * IEEE80211_ADDR_LEN]);
+- /* TODO: free node ? */
+ /* check we are associated w/ this vap */
+ if (ni && (ni->ni_vap == vap)) {
+ set_quality(&spy_stat[i], ni->ni_rssi, ic->ic_channoise);
+@@ -1100,6 +1099,7 @@
+ } else {
+ spy_stat[i].updated = IW_QUAL_ALL_INVALID;
+ }
++ ieee80211_unref_node(&ni);
+ }
+
+ /* copy results to userspace */
+@@ -3153,6 +3153,7 @@
+ /* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
+ if (ik->ik_keylen > sizeof(ik->ik_keydata))
+ return -E2BIG;
++
+ kix = ik->ik_keyix;
+ if (kix == IEEE80211_KEYIX_NONE) {
+ /* XXX unicast keys currently must be tx/rx */
+@@ -3176,6 +3177,7 @@
+ if ((ik->ik_flags & IEEE80211_KEY_XMIT) == 0) /* XXX */
+ ik->ik_flags |= IEEE80211_KEY_GROUP; /* XXX */
+ }
++
+ error = 0;
+ flags = ik->ik_flags & IEEE80211_KEY_COMMON;
+ ieee80211_key_update_begin(vap);
+@@ -3190,12 +3192,13 @@
+ memset(wk->wk_key, 0, sizeof(wk->wk_key));
+ memcpy(wk->wk_key, ik->ik_keydata, ik->ik_keylen);
+ if (!ieee80211_crypto_setkey(vap, wk,
+- ni != NULL ? ni->ni_macaddr : ik->ik_macaddr, ni))
++ (ni != NULL) ? ni->ni_macaddr : ik->ik_macaddr, ni))
+ error = -EIO;
+ else if ((ik->ik_flags & IEEE80211_KEY_DEFAULT))
+ vap->iv_def_txkey = kix;
+ } else
+ error = -ENXIO;
++
+ ieee80211_key_update_end(vap);
+ if (ni != NULL)
+ ieee80211_unref_node(&ni);