diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c index cf0ad5f832e55703353903315ebd8f2c1241020e..59e2001c39f8d3e26ba9fcbfa33b4450add6f7fa 100644 --- a/drivers/net/wireless/intel/iwlwifi/dvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/dvm/tx.c @@ -383,6 +383,7 @@ int iwlagn_tx_skb(struct iwl_priv *priv, iwlagn_tx_cmd_build_rate(priv, tx_cmd, info, sta, fc); memset(&info->status, 0, sizeof(info->status)); + memset(info->driver_data, 0, sizeof(info->driver_data)); info->driver_data[0] = ctx; info->driver_data[1] = dev_cmd; diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h index 6534537a2daf2aaf178c71cef693967c03460dfe..a2683ef2068c60acc4030225fd330fe802b6c262 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.h +++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.h @@ -552,7 +552,8 @@ struct iwl_trans_txq_scd_cfg { * If RFkill is asserted in the middle of a SYNC host command, it must * return -ERFKILL straight away. * May sleep only if CMD_ASYNC is not set - * @tx: send an skb + * @tx: send an skb. The transport relies on the op_mode to zero the + * the ieee80211_tx_info->driver_data. * Must be atomic * @reclaim: free packet until ssn. Returns a list of freed packets. * Must be atomic diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c index 04e921fcc0fbd7f9bb6f4adf2a648522ff0c2f34..8bf48a7d0f4e99e8297feace5368375b6a16a151 100644 --- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c @@ -346,8 +346,8 @@ iwl_mvm_set_tx_params(struct iwl_mvm *mvm, struct sk_buff *skb, iwl_mvm_set_tx_cmd_rate(mvm, tx_cmd, info, sta, hdr->frame_control); memset(&info->status, 0, sizeof(info->status)); + memset(info->driver_data, 0, sizeof(info->driver_data)); - info->driver_data[0] = NULL; info->driver_data[1] = dev_cmd; return dev_cmd;