From 4f5fa2376f3ca46fa497632844872a6f4e224c09 Mon Sep 17 00:00:00 2001 From: Johannes Berg Date: Mon, 17 May 2010 02:37:31 -0700 Subject: iwl3945: fix bugs in txq freeing When we free a txq that had no txb array allocated, we still try to access it. Fix that, and also free all SKBs that may be in the txb array (although it can just be a single one). Signed-off-by: Johannes Berg Signed-off-by: Reinette Chatre --- drivers/net/wireless/iwlwifi/iwl-3945.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'drivers/net/wireless/iwlwifi/iwl-3945.c') diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c index 295b67ac816..fec05b5c334 100644 --- a/drivers/net/wireless/iwlwifi/iwl-3945.c +++ b/drivers/net/wireless/iwlwifi/iwl-3945.c @@ -705,16 +705,18 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq) for (i = 1; i < counter; i++) { pci_unmap_single(dev, le32_to_cpu(tfd->tbs[i].addr), le32_to_cpu(tfd->tbs[i].len), PCI_DMA_TODEVICE); - if (txq->txb[txq->q.read_ptr].skb[0]) { - struct sk_buff *skb = txq->txb[txq->q.read_ptr].skb[0]; - if (txq->txb[txq->q.read_ptr].skb[0]) { - /* Can be called from interrupt context */ + if (txq->txb) { + struct sk_buff *skb; + + skb = txq->txb[txq->q.read_ptr].skb[i - 1]; + + /* can be called from irqs-disabled context */ + if (skb) { dev_kfree_skb_any(skb); - txq->txb[txq->q.read_ptr].skb[0] = NULL; + txq->txb[txq->q.read_ptr].skb[i - 1] = NULL; } } } - return ; } /** -- cgit v1.2.3-70-g09d2