2 files changed, 4 insertions, 2 deletions

diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 4e492c154f88..0921e454185b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -663,7 +663,8 @@ static int iwl4965_alive_notify(struct iwl_priv *priv)
                 iwl_write_targ_mem(priv, a, 0);
         for (; a < priv->scd_base_addr + IWL49_SCD_TRANSLATE_TBL_OFFSET; a += 4)
                 iwl_write_targ_mem(priv, a, 0);
-        for (; a < sizeof(u16) * priv->hw_params.max_txq_num; a += 4)
+        for (; a < priv->scd_base_addr +
+               IWL49_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
                 iwl_write_targ_mem(priv, a, 0);
 
         /* Tel 4965 where to find Tx byte count tables */
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 660fd51d190b..01d53ebb96ad 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -748,7 +748,8 @@ int iwl5000_alive_notify(struct iwl_priv *priv)
         for (; a < priv->scd_base_addr + IWL50_SCD_TRANSLATE_TBL_OFFSET;
                 a += 4)
                 iwl_write_targ_mem(priv, a, 0);
-        for (; a < sizeof(u16) * priv->hw_params.max_txq_num; a += 4)
+        for (; a < priv->scd_base_addr +
+               IWL50_SCD_TRANSLATE_TBL_OFFSET_QUEUE(priv->hw_params.max_txq_num); a += 4)
                 iwl_write_targ_mem(priv, a, 0);
 
         iwl_write_prph(priv, IWL50_SCD_DRAM_BASE_ADDR,