Merge branch 'fixes' into next

Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

4 files changed, 17 insertions, 1 deletions

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index efec6ec22f58..594cd0dc7df9 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -126,7 +126,7 @@ static int iwl_send_rss_cfg_cmd(struct iwl_mvm *mvm)
         return iwl_mvm_send_cmd_pdu(mvm, RSS_CONFIG_CMD, 0, sizeof(cmd), &cmd);
 }
 
-static void iwl_free_fw_paging(struct iwl_mvm *mvm)
+void iwl_free_fw_paging(struct iwl_mvm *mvm)
 {
         int i;
 
@@ -146,6 +146,8 @@ static void iwl_free_fw_paging(struct iwl_mvm *mvm)
                              get_order(mvm->fw_paging_db[i].fw_paging_size));
         }
         kfree(mvm->trans->paging_download_buf);
+        mvm->trans->paging_download_buf = NULL;
+
         memset(mvm->fw_paging_db, 0, sizeof(mvm->fw_paging_db));
 }
 
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
index f9019c4a5c0e..ab410b4659f3 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h
@@ -1318,6 +1318,9 @@ void iwl_mvm_rx_umac_scan_complete_notif(struct iwl_mvm *mvm,
 void iwl_mvm_rx_umac_scan_iter_complete_notif(struct iwl_mvm *mvm,
                                               struct iwl_rx_cmd_buffer *rxb);
 
+/* Paging */
+void iwl_free_fw_paging(struct iwl_mvm *mvm);
+
 /* MVM debugfs */
 #ifdef CONFIG_IWLWIFI_DEBUGFS
 int iwl_mvm_dbgfs_register(struct iwl_mvm *mvm, struct dentry *dbgfs_dir);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
index e6d0adc07029..699a80863e86 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c
@@ -733,6 +733,8 @@ static void iwl_op_mode_mvm_stop(struct iwl_op_mode *op_mode)
         for (i = 0; i < NVM_MAX_NUM_SECTIONS; i++)
                 kfree(mvm->nvm_sections[i].data);
 
+        iwl_free_fw_paging(mvm);
+
         iwl_mvm_tof_clean(mvm);
 
         ieee80211_free_hw(mvm->hw);
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index dd616c1d59b7..271e8da6d140 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -430,6 +430,15 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb)
                 return -1;
         }
 
+        /*
+         * Increase the pending frames counter, so that later when a reply comes
+         * in and the counter is decreased - we don't start getting negative
+         * values.
+         * Note that we don't need to make sure it isn't agg'd, since we're
+         * TXing non-sta
+         */
+        atomic_inc(&mvm->pending_frames[sta_id]);
+
         return 0;
 }