iwlwifi: fix canceling monitor_recover timer

To make del_timer_sync() works we have to assure that timer function
does not rearm the timer. To achieve that we cancel timer with
STATUS_EXIT_PENDING bit set in __iwl{3945,}_down function.

Patch also fix priv->txq memory usage after free for iwl3945, because
it move timer cancellation before iwl3945_hw_txq_ctx_free(priv) is called.

Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 94d7e6e1323d..53e6cbb3aaaa 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -2571,6 +2571,11 @@ static void __iwl3945_down(struct iwl_priv *priv)
         if (!exit_pending)
                 set_bit(STATUS_EXIT_PENDING, &priv->status);
 
+        /* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
+         * to prevent rearm timer */
+        if (priv->cfg->ops->lib->recover_from_tx_stall)
+                del_timer_sync(&priv->monitor_recover);
+
         /* Station information will now be cleared in device */
         iwl_clear_ucode_stations(priv);
         iwl_dealloc_bcast_station(priv);
@@ -3811,8 +3816,6 @@ static void iwl3945_cancel_deferred_work(struct iwl_priv *priv)
         cancel_delayed_work(&priv->alive_start);
         cancel_work_sync(&priv->start_internal_scan);
         cancel_work_sync(&priv->beacon_update);
-        if (priv->cfg->ops->lib->recover_from_tx_stall)
-                del_timer_sync(&priv->monitor_recover);
 }
 
 static struct attribute *iwl3945_sysfs_entries[] = {