1 files changed, 10 insertions, 5 deletions

diff --git a/drivers/net/wireless/p54/p54common.c b/drivers/net/wireless/p54/p54common.c
index 91ac9208b77d..9f7224de6fd1 100644
--- a/drivers/net/wireless/p54/p54common.c
+++ b/drivers/net/wireless/p54/p54common.c
@@ -392,16 +392,21 @@ static void p54_rx_frame_sent(struct ieee80211_hw *dev, struct sk_buff *skb)
         u32 last_addr = priv->rx_start;
 
         while (entry != (struct sk_buff *)&priv->tx_queue) {
-                range = (struct memrecord *)&entry->cb;
+                struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
+                range = (void *)info->driver_data;
                 if (range->start_addr == addr) {
-                        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(entry);
                         struct p54_control_hdr *entry_hdr;
                         struct p54_tx_control_allocdata *entry_data;
                         int pad = 0;
 
-                        if (entry->next != (struct sk_buff *)&priv->tx_queue)
-                                freed = ((struct memrecord *)&entry->next->cb)->start_addr - last_addr;
-                        else
+                        if (entry->next != (struct sk_buff *)&priv->tx_queue) {
+                                struct ieee80211_tx_info *ni;
+                                struct memrecord *mr;
+
+                                ni = IEEE80211_SKB_CB(entry->next);
+                                mr = (struct memrecord *)ni->driver_data;
+                                freed = mr->start_addr - last_addr;
+                        } else
                                 freed = priv->rx_end - last_addr;
 
                         last_addr = range->end_addr;