1 files changed, 16 insertions, 22 deletions

diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index 866403415811..e91520d0312e 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -37,6 +37,7 @@
 #include <linux/pci.h>
 #include <linux/delay.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/dst.h>
 
 /* 32bit DMA ops. */
@@ -1240,8 +1241,9 @@ struct b43legacy_dmaring *parse_cookie(struct b43legacy_wldev *dev,
 }
 
 static int dma_tx_fragment(struct b43legacy_dmaring *ring,
-                            struct sk_buff *skb)
+                            struct sk_buff **in_skb)
 {
+        struct sk_buff *skb = *in_skb;
         const struct b43legacy_dma_ops *ops = ring->ops;
         struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
         u8 *header;
@@ -1305,8 +1307,14 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
                 }
 
                 memcpy(skb_put(bounce_skb, skb->len), skb->data, skb->len);
+                memcpy(bounce_skb->cb, skb->cb, sizeof(skb->cb));
+                bounce_skb->dev = skb->dev;
+                skb_set_queue_mapping(bounce_skb, skb_get_queue_mapping(skb));
+                info = IEEE80211_SKB_CB(bounce_skb);
+
                 dev_kfree_skb_any(skb);
                 skb = bounce_skb;
+                *in_skb = bounce_skb;
                 meta->skb = skb;
                 meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
                 if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
@@ -1360,8 +1368,10 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                      struct sk_buff *skb)
 {
         struct b43legacy_dmaring *ring;
+        struct ieee80211_hdr *hdr;
         int err = 0;
         unsigned long flags;
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
 
         ring = priority_to_txring(dev, skb_get_queue_mapping(skb));
         spin_lock_irqsave(&ring->lock, flags);
@@ -1386,7 +1396,11 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                 goto out_unlock;
         }
 
-        err = dma_tx_fragment(ring, skb);
+        /* dma_tx_fragment might reallocate the skb, so invalidate pointers pointing
+         * into the skb data or cb now. */
+        hdr = NULL;
+        info = NULL;
+        err = dma_tx_fragment(ring, &skb);
         if (unlikely(err == -ENOKEY)) {
                 /* Drop this packet, as we don't have the encryption key
                  * anymore and must not transmit it unencrypted. */
@@ -1398,7 +1412,6 @@ int b43legacy_dma_tx(struct b43legacy_wldev *dev,
                 b43legacyerr(dev->wl, "DMA tx mapping failure\n");
                 goto out_unlock;
         }
-        ring->nr_tx_packets++;
         if ((free_slots(ring) < SLOTS_PER_PACKET) ||
             should_inject_overflow(ring)) {
                 /* This TX ring is full. */
@@ -1514,25 +1527,6 @@ void b43legacy_dma_handle_txstatus(struct b43legacy_wldev *dev,
         spin_unlock(&ring->lock);
 }
 
-void b43legacy_dma_get_tx_stats(struct b43legacy_wldev *dev,
-                              struct ieee80211_tx_queue_stats *stats)
-{
-        const int nr_queues = dev->wl->hw->queues;
-        struct b43legacy_dmaring *ring;
-        unsigned long flags;
-        int i;
-
-        for (i = 0; i < nr_queues; i++) {
-                ring = priority_to_txring(dev, i);
-
-                spin_lock_irqsave(&ring->lock, flags);
-                stats[i].len = ring->used_slots / SLOTS_PER_PACKET;
-                stats[i].limit = ring->nr_slots / SLOTS_PER_PACKET;
-                stats[i].count = ring->nr_tx_packets;
-                spin_unlock_irqrestore(&ring->lock, flags);
-        }
-}
-
 static void dma_rx(struct b43legacy_dmaring *ring,
                    int *slot)
 {