1 files changed, 11 insertions, 10 deletions

diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index 2050227ea530..b73a7e0aeed4 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -163,16 +163,11 @@ static void rt2x00usb_interrupt_txdone(struct urb *urb)
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct txdone_entry_desc txdesc;
 
-        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags) ||
+        if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags) ||
             !test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
 
         /*
-         * Remove the descriptor data from the buffer.
-         */
-        skb_pull(entry->skb, entry->queue->desc_size);
-
-        /*
          * Obtain the status about this packet.
          * Note that when the status is 0 it does not mean the
          * frame was send out correctly. It only means the frame
@@ -224,6 +219,12 @@ int rt2x00usb_write_tx_data(struct queue_entry *entry)
                           entry->skb->data, length,
                           rt2x00usb_interrupt_txdone, entry);
 
+        /*
+         * Make sure the skb->data pointer points to the frame, not the
+         * descriptor.
+         */
+        skb_pull(entry->skb, entry->queue->desc_size);
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_write_tx_data);
@@ -232,7 +233,7 @@ static inline void rt2x00usb_kick_tx_entry(struct queue_entry *entry)
 {
         struct queue_entry_priv_usb *entry_priv = entry->priv_data;
 
-        if (__test_and_clear_bit(ENTRY_DATA_PENDING, &entry->flags))
+        if (test_and_clear_bit(ENTRY_DATA_PENDING, &entry->flags))
                 usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
 }
 
@@ -283,7 +284,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         u8 rxd[32];
 
-        if (!test_bit(DEVICE_ENABLED_RADIO, &rt2x00dev->flags) ||
+        if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags) ||
             !test_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags))
                 return;
 
@@ -293,7 +294,7 @@ static void rt2x00usb_interrupt_rxdone(struct urb *urb)
          * a problem.
          */
         if (urb->actual_length < entry->queue->desc_size || urb->status) {
-                __set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
+                set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
                 usb_submit_urb(urb, GFP_ATOMIC);
                 return;
         }
@@ -361,7 +362,7 @@ void rt2x00usb_init_rxentry(struct rt2x00_dev *rt2x00dev,
                           entry->skb->data, entry->skb->len,
                           rt2x00usb_interrupt_rxdone, entry);
 
-        __set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
+        set_bit(ENTRY_OWNER_DEVICE_DATA, &entry->flags);
         usb_submit_urb(entry_priv->urb, GFP_ATOMIC);
 }
 EXPORT_SYMBOL_GPL(rt2x00usb_init_rxentry);