--- /dev/null
+Index: madwifi/net80211/ieee80211_wireless.c\r
+===================================================================\r
+--- madwifi/net80211/ieee80211_wireless.c (revision 2482)\r
++++ madwifi/net80211/ieee80211_wireless.c (revision 2484)\r
+@@ -1102,5 +1102,4 @@\r
+ for (i = 0; i < number; i++) {\r
+ ni = ieee80211_find_node(nt, &vap->iv_spy.mac[i * IEEE80211_ADDR_LEN]);\r
+- /* TODO: free node ? */\r
+ /* check we are associated w/ this vap */\r
+ if (ni && (ni->ni_vap == vap)) {\r
+@@ -1114,4 +1113,5 @@\r
+ spy_stat[i].updated = IW_QUAL_ALL_INVALID;\r
+ }\r
++ ieee80211_unref_node(&ni);\r
+ }\r
+ \r
+@@ -3191,4 +3191,5 @@\r
+ if (ik->ik_keylen > sizeof(ik->ik_keydata))\r
+ return -E2BIG;\r
++\r
+ kix = ik->ik_keyix;\r
+ if (kix == IEEE80211_KEYIX_NONE) {\r
+@@ -3214,4 +3215,5 @@\r
+ ik->ik_flags |= IEEE80211_KEY_GROUP; /* XXX */\r
+ }\r
++\r
+ error = 0;\r
+ flags = ik->ik_flags & IEEE80211_KEY_COMMON;\r
+@@ -3228,5 +3230,5 @@\r
+ memcpy(wk->wk_key, ik->ik_keydata, ik->ik_keylen);\r
+ if (!ieee80211_crypto_setkey(vap, wk,\r
+- ni != NULL ? ni->ni_macaddr : ik->ik_macaddr, ni))\r
++ (ni != NULL) ? ni->ni_macaddr : ik->ik_macaddr, ni))\r
+ error = -EIO;\r
+ else if ((ik->ik_flags & IEEE80211_KEY_DEFAULT))\r
+@@ -3234,4 +3236,5 @@\r
+ } else\r
+ error = -ENXIO;\r
++\r
+ ieee80211_key_update_end(vap);\r
+ if (ni != NULL)\r
+Index: madwifi/net80211/ieee80211_output.c\r
+===================================================================\r
+--- madwifi/net80211/ieee80211_output.c (revision 2438)\r
++++ madwifi/net80211/ieee80211_output.c (revision 2484)\r
+@@ -269,4 +269,5 @@\r
+ */\r
+ ieee80211_pwrsave(ni, skb);\r
++ ieee80211_unref_node(&ni);\r
+ return 0;\r
+ }\r
+@@ -283,5 +284,5 @@\r
+ struct sk_buff *skb1;\r
+ ni = ieee80211_find_txnode(vap->iv_xrvap, eh->ether_dhost);\r
+- skb1 = skb_clone(skb,GFP_ATOMIC);\r
++ skb1 = skb_clone(skb, GFP_ATOMIC);\r
+ if (skb1) {\r
+ cb = (struct ieee80211_cb *) skb1->cb;\r
+Index: madwifi/ath/if_ath.c\r
+===================================================================\r
+--- madwifi/ath/if_ath.c (revision 2482)\r
++++ madwifi/ath/if_ath.c (revision 2484)\r
+@@ -8111,14 +8111,13 @@\r
+ /* Depending on the sequence of bringing up devices\r
+ * it's possible the rates of the root bss isn't\r
+- * filled yet. \r
+- */\r
+- if (vap->iv_ic->ic_newassoc != NULL &&\r
+- wds_ni->ni_rates.rs_nrates != 0) {\r
++ * filled yet. */\r
++ if ((vap->iv_ic->ic_newassoc != NULL) &&\r
++ (wds_ni->ni_rates.rs_nrates != 0)) {\r
+ /* Fill in the rates based on our own rates\r
+ * we rely on the rate selection mechanism\r
+- * to find out which rates actually work!\r
+- */\r
++ * to find out which rates actually work! */\r
+ vap->iv_ic->ic_newassoc(wds_ni, 1);\r
+ }\r
++ ieee80211_unref_node(&wds_ni);\r
+ }\r
+ break;\r