iwl3945: fix bugs in txq freeing
When we free a txq that had no txb array allocated,
we still try to access it. Fix that, and also free
all SKBs that may be in the txb array (although it
can just be a single one).
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 295b67a..fec05b5 100644
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -705,16 +705,18 @@
for (i = 1; i < counter; i++) {
pci_unmap_single(dev, le32_to_cpu(tfd->tbs[i].addr),
le32_to_cpu(tfd->tbs[i].len), PCI_DMA_TODEVICE);
- if (txq->txb[txq->q.read_ptr].skb[0]) {
- struct sk_buff *skb = txq->txb[txq->q.read_ptr].skb[0];
- if (txq->txb[txq->q.read_ptr].skb[0]) {
- /* Can be called from interrupt context */
+ if (txq->txb) {
+ struct sk_buff *skb;
+
+ skb = txq->txb[txq->q.read_ptr].skb[i - 1];
+
+ /* can be called from irqs-disabled context */
+ if (skb) {
dev_kfree_skb_any(skb);
- txq->txb[txq->q.read_ptr].skb[0] = NULL;
+ txq->txb[txq->q.read_ptr].skb[i - 1] = NULL;
}
}
}
- return ;
}
/**