Commit 4f5fa237 authored by Johannes Berg's avatar Johannes Berg Committed by Reinette Chatre

iwl3945: fix bugs in txq freeing

When we free a txq that had no txb array allocated,
we still try to access it. Fix that, and also free
all SKBs that may be in the txb array (although it
can just be a single one).
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
parent fc66be2a
...@@ -705,16 +705,18 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq) ...@@ -705,16 +705,18 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
for (i = 1; i < counter; i++) { for (i = 1; i < counter; i++) {
pci_unmap_single(dev, le32_to_cpu(tfd->tbs[i].addr), pci_unmap_single(dev, le32_to_cpu(tfd->tbs[i].addr),
le32_to_cpu(tfd->tbs[i].len), PCI_DMA_TODEVICE); le32_to_cpu(tfd->tbs[i].len), PCI_DMA_TODEVICE);
if (txq->txb[txq->q.read_ptr].skb[0]) { if (txq->txb) {
struct sk_buff *skb = txq->txb[txq->q.read_ptr].skb[0]; struct sk_buff *skb;
if (txq->txb[txq->q.read_ptr].skb[0]) {
/* Can be called from interrupt context */ skb = txq->txb[txq->q.read_ptr].skb[i - 1];
/* can be called from irqs-disabled context */
if (skb) {
dev_kfree_skb_any(skb); dev_kfree_skb_any(skb);
txq->txb[txq->q.read_ptr].skb[0] = NULL; txq->txb[txq->q.read_ptr].skb[i - 1] = NULL;
} }
} }
} }
return ;
} }
/** /**
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment