@@ -383,6 +383,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv,
iwlagn_tx_cmd_build_rate(priv, tx_cmd, info, sta, fc);
memset(&info->status, 0, sizeof(info->status));
+ memset(info->driver_data, 0, sizeof(info->driver_data));
info->driver_data[0] = ctx;
info->driver_data[1] = dev_cmd;
@@ -552,7 +552,8 @@ struct iwl_trans_txq_scd_cfg {
* If RFkill is asserted in the middle of a SYNC host command, it must
* return -ERFKILL straight away.
* May sleep only if CMD_ASYNC is not set
- * @tx: send an skb
+ * @tx: send an skb. The transport relies on the op_mode to zero the
+ * the ieee80211_tx_info->driver_data.
* Must be atomic
* @reclaim: free packet until ssn. Returns a list of freed packets.
* Must be atomic
@@ -346,8 +346,8 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb,
iwl_mvm_set_tx_cmd_rate(mvm, tx_cmd, info, sta, hdr->frame_control);
memset(&info->status, 0, sizeof(info->status));
+ memset(info->driver_data, 0, sizeof(info->driver_data));
- info->driver_data[0] = NULL;
info->driver_data[1] = dev_cmd;
return dev_cmd;
The transport will need to use the info->driver_data pointers. Since the op_mode has this memory hot in cache, clear it there. Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> --- drivers/net/wireless/intel/iwlwifi/dvm/tx.c | 1 + drivers/net/wireless/intel/iwlwifi/iwl-trans.h | 3 ++- drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +- 3 files changed, 4 insertions(+), 2 deletions(-)