===================================================================
@@ -1522,7 +1522,13 @@ void b43_dma_handle_txstatus(struct b43_
if (meta->is_last_fragment) {
struct ieee80211_tx_info *info;
- BUG_ON(!meta->skb);
+ if (meta->skb == (void *)0x0606060606060606) {
+ printk(KERN_ERR "b43: Duplicate free of skb\n");
+ return;
+ } else if (!meta->skb) {
+ printk(KERN_ERR "b43: skb is NULL\n");
+ return;
+ }
info = IEEE80211_SKB_CB(meta->skb);
@@ -1540,8 +1546,8 @@ void b43_dma_handle_txstatus(struct b43_
#endif /* DEBUG */
ieee80211_tx_status(dev->wl->hw, meta->skb);
- /* skb is freed by ieee80211_tx_status() */
- meta->skb = NULL;
+ /* skb was freed by ieee80211_tx_status() - poison it */
+ meta->skb = (void *)0x0606060606060606;
} else {
/* No need to call free_descriptor_buffer here, as
* this is only the txhdr, which is not allocated.