1 files changed, 14 insertions, 12 deletions

diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2e4f461406ae..89d132d4af12 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1165,15 +1165,15 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
-        __le32 *txd = skbdesc->desc;
+        __le32 *txd = entry_priv->desc;
         u32 word;
 
         /*
          * Start writing the descriptor words.
          */
-        rt2x00_desc_read(entry_priv->desc, 1, &word);
+        rt2x00_desc_read(txd, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, skbdesc->skb_dma);
-        rt2x00_desc_write(entry_priv->desc, 1, word);
+        rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
         rt2x00_set_field32(&word, TXD_W2_IV_OFFSET, IEEE80211_HEADER);
@@ -1194,6 +1194,11 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            test_bit(ENTRY_TXD_RTS_FRAME, &txdesc->flags));
         rt2x00_desc_write(txd, 10, word);
 
+        /*
+         * Writing TXD word 0 must the last to prevent a race condition with
+         * the device, whereby the device may take hold of the TXD before we
+         * finished updating it.
+         */
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
@@ -1212,6 +1217,12 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, CIPHER_NONE);
         rt2x00_desc_write(txd, 0, word);
+
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txd;
+        skbdesc->desc_len = TXD_DESC_SIZE;
 }
 
 /*
@@ -1234,15 +1245,6 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        /*
-         * Replace rt2x00lib allocated descriptor with the
-         * pointer to the _real_ hardware descriptor.
-         * After that, map the beacon to DMA and update the
-         * descriptor.
-         */
-        memcpy(entry_priv->desc, skbdesc->desc, skbdesc->desc_len);
-        skbdesc->desc = entry_priv->desc;
-
         rt2x00queue_map_txskb(rt2x00dev, entry->skb);
 
         rt2x00_desc_read(entry_priv->desc, 1, &word);