iwl3945: fix bugs in txq freeing

When we free a txq that had no txb array allocated,
we still try to access it. Fix that, and also free
all SKBs that may be in the txb array (although it
can just be a single one).

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>

diff --git a/drivers/net/wireless/iwlwifi/iwl-3945.c b/drivers/net/wireless/iwlwifi/iwl-3945.c
index 295b67ac8169de7f3efeef1c98adb1b30d161081..fec05b5c334e4e1c1cd7960e986120ba0dd320db 100644 (file)
--- a/drivers/net/wireless/iwlwifi/iwl-3945.c
+++ b/drivers/net/wireless/iwlwifi/iwl-3945.c
@@ -705,16 +705,18 @@ void iwl3945_hw_txq_free_tfd(struct iwl_priv *priv, struct iwl_tx_queue *txq)
        for (i = 1; i < counter; i++) {
                pci_unmap_single(dev, le32_to_cpu(tfd->tbs[i].addr),
                         le32_to_cpu(tfd->tbs[i].len), PCI_DMA_TODEVICE);
-               if (txq->txb[txq->q.read_ptr].skb[0]) {
-                       struct sk_buff *skb = txq->txb[txq->q.read_ptr].skb[0];
-                       if (txq->txb[txq->q.read_ptr].skb[0]) {
-                               /* Can be called from interrupt context */
+               if (txq->txb) {
+                       struct sk_buff *skb;
+
+                       skb = txq->txb[txq->q.read_ptr].skb[i - 1];
+
+                       /* can be called from irqs-disabled context */
+                       if (skb) {
                                dev_kfree_skb_any(skb);
-                               txq->txb[txq->q.read_ptr].skb[0] = NULL;
+                               txq->txb[txq->q.read_ptr].skb[i - 1] = NULL;
                        }
                }
        }
-       return ;
 }
 
 /**