11 files changed, 117 insertions, 80 deletions

diff --git a/drivers/net/bnx2x.h b/drivers/net/bnx2x.h
index a14dba1afcc5..fd705d1295a7 100644
--- a/drivers/net/bnx2x.h
+++ b/drivers/net/bnx2x.h
@@ -151,6 +151,8 @@ struct sw_rx_page {
 #define PAGES_PER_SGE_SHIFT             0
 #define PAGES_PER_SGE                   (1 << PAGES_PER_SGE_SHIFT)
 
+#define BCM_RX_ETH_PAYLOAD_ALIGN        64
+
 /* SGE ring related macros */
 #define NUM_RX_SGE_PAGES                2
 #define RX_SGE_CNT              (BCM_PAGE_SIZE / sizeof(struct eth_rx_sge))
@@ -750,8 +752,7 @@ struct bnx2x {
 
         u32                     rx_csum;
         u32                     rx_offset;
-        u32                     rx_buf_use_size;        /* useable size */
-        u32                     rx_buf_size;            /* with alignment */
+        u32                     rx_buf_size;
 #define ETH_OVREHEAD                    (ETH_HLEN + 8)  /* 8 for CRC + VLAN */
 #define ETH_MIN_PACKET_SIZE             60
 #define ETH_MAX_PACKET_SIZE             1500
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index 82deea0a63f5..a8eb3c4a47c8 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -59,8 +59,8 @@
 #include "bnx2x.h"
 #include "bnx2x_init.h"
 
-#define DRV_MODULE_VERSION      "1.45.20"
-#define DRV_MODULE_RELDATE      "2008/08/25"
+#define DRV_MODULE_VERSION      "1.45.21"
+#define DRV_MODULE_RELDATE      "2008/09/03"
 #define BNX2X_BC_VER            0x040200
 
 /* Time in jiffies before concluding the transmitter is hung */
@@ -1027,7 +1027,7 @@ static inline int bnx2x_alloc_rx_skb(struct bnx2x *bp,
         if (unlikely(skb == NULL))
                 return -ENOMEM;
 
-        mapping = pci_map_single(bp->pdev, skb->data, bp->rx_buf_use_size,
+        mapping = pci_map_single(bp->pdev, skb->data, bp->rx_buf_size,
                                  PCI_DMA_FROMDEVICE);
         if (unlikely(dma_mapping_error(&bp->pdev->dev, mapping))) {
                 dev_kfree_skb(skb);
@@ -1169,7 +1169,7 @@ static void bnx2x_tpa_start(struct bnx2x_fastpath *fp, u16 queue,
         /* move empty skb from pool to prod and map it */
         prod_rx_buf->skb = fp->tpa_pool[queue].skb;
         mapping = pci_map_single(bp->pdev, fp->tpa_pool[queue].skb->data,
-                                 bp->rx_buf_use_size, PCI_DMA_FROMDEVICE);
+                                 bp->rx_buf_size, PCI_DMA_FROMDEVICE);
         pci_unmap_addr_set(prod_rx_buf, mapping, mapping);
 
         /* move partial skb from cons to pool (don't unmap yet) */
@@ -1276,7 +1276,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
            pool entry status to BNX2X_TPA_STOP even if new skb allocation
            fails. */
         pci_unmap_single(bp->pdev, pci_unmap_addr(rx_buf, mapping),
-                         bp->rx_buf_use_size, PCI_DMA_FROMDEVICE);
+                         bp->rx_buf_size, PCI_DMA_FROMDEVICE);
 
         if (likely(new_skb)) {
                 /* fix ip xsum and give it to the stack */
@@ -1520,7 +1520,7 @@ static int bnx2x_rx_int(struct bnx2x_fastpath *fp, int budget)
                         } else if (bnx2x_alloc_rx_skb(bp, fp, bd_prod) == 0) {
                                 pci_unmap_single(bp->pdev,
                                         pci_unmap_addr(rx_buf, mapping),
-                                                 bp->rx_buf_use_size,
+                                                 bp->rx_buf_size,
                                                  PCI_DMA_FROMDEVICE);
                                 skb_reserve(skb, pad);
                                 skb_put(skb, len);
@@ -4229,7 +4229,7 @@ static inline void bnx2x_free_tpa_pool(struct bnx2x *bp,
                 if (fp->tpa_state[i] == BNX2X_TPA_START)
                         pci_unmap_single(bp->pdev,
                                          pci_unmap_addr(rx_buf, mapping),
-                                         bp->rx_buf_use_size,
+                                         bp->rx_buf_size,
                                          PCI_DMA_FROMDEVICE);
 
                 dev_kfree_skb(skb);
@@ -4245,15 +4245,14 @@ static void bnx2x_init_rx_rings(struct bnx2x *bp)
         u16 ring_prod, cqe_ring_prod;
         int i, j;
 
-        bp->rx_buf_use_size = bp->dev->mtu;
-        bp->rx_buf_use_size += bp->rx_offset + ETH_OVREHEAD;
-        bp->rx_buf_size = bp->rx_buf_use_size + 64;
+        bp->rx_buf_size = bp->dev->mtu;
+        bp->rx_buf_size += bp->rx_offset + ETH_OVREHEAD +
+                BCM_RX_ETH_PAYLOAD_ALIGN;
 
         if (bp->flags & TPA_ENABLE_FLAG) {
                 DP(NETIF_MSG_IFUP,
-                   "rx_buf_use_size %d  rx_buf_size %d  effective_mtu %d\n",
-                   bp->rx_buf_use_size, bp->rx_buf_size,
-                   bp->dev->mtu + ETH_OVREHEAD);
+                   "rx_buf_size %d  effective_mtu %d\n",
+                   bp->rx_buf_size, bp->dev->mtu + ETH_OVREHEAD);
 
                 for_each_queue(bp, j) {
                         struct bnx2x_fastpath *fp = &bp->fp[j];
@@ -4462,9 +4461,10 @@ static void bnx2x_init_context(struct bnx2x *bp)
                 context->ustorm_st_context.common.status_block_id = sb_id;
                 context->ustorm_st_context.common.flags =
                         USTORM_ETH_ST_CONTEXT_CONFIG_ENABLE_MC_ALIGNMENT;
-                context->ustorm_st_context.common.mc_alignment_size = 64;
+                context->ustorm_st_context.common.mc_alignment_size =
+                        BCM_RX_ETH_PAYLOAD_ALIGN;
                 context->ustorm_st_context.common.bd_buff_size =
-                                                bp->rx_buf_use_size;
+                                                bp->rx_buf_size;
                 context->ustorm_st_context.common.bd_page_base_hi =
                                                 U64_HI(fp->rx_desc_mapping);
                 context->ustorm_st_context.common.bd_page_base_lo =
@@ -4717,7 +4717,7 @@ static void bnx2x_init_internal_func(struct bnx2x *bp)
         }
 
         /* Init CQ ring mapping and aggregation size */
-        max_agg_size = min((u32)(bp->rx_buf_use_size +
+        max_agg_size = min((u32)(bp->rx_buf_size +
                                  8*BCM_PAGE_SIZE*PAGES_PER_SGE),
                            (u32)0xffff);
         for_each_queue(bp, i) {
@@ -5940,7 +5940,7 @@ static void bnx2x_free_rx_skbs(struct bnx2x *bp)
 
                         pci_unmap_single(bp->pdev,
                                          pci_unmap_addr(rx_buf, mapping),
-                                         bp->rx_buf_use_size,
+                                         bp->rx_buf_size,
                                          PCI_DMA_FROMDEVICE);
 
                         rx_buf->skb = NULL;
diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 95b337149484..c5107f269f24 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -1067,8 +1067,16 @@ void ath_tx_complete(struct ath_softc *sc, struct sk_buff *skb,
                 tx_info->flags |= IEEE80211_TX_STAT_AMPDU_NO_BACK;
                 tx_status->flags &= ~ATH_TX_BAR;
         }
-        if (tx_status->flags)
-                tx_info->status.excessive_retries = 1;
+
+        if (tx_status->flags & (ATH_TX_ERROR | ATH_TX_XRETRY)) {
+                if (!(tx_info->flags & IEEE80211_TX_CTL_NO_ACK)) {
+                        /* Frame was not ACKed, but an ACK was expected */
+                        tx_info->status.excessive_retries = 1;
+                }
+        } else {
+                /* Frame was ACKed */
+                tx_info->flags |= IEEE80211_TX_STAT_ACK;
+        }
 
         tx_info->status.retry_count = tx_status->retries;
 
diff --git a/drivers/net/wireless/ath9k/xmit.c b/drivers/net/wireless/ath9k/xmit.c
index 157f830ee6b8..550129f717e2 100644
--- a/drivers/net/wireless/ath9k/xmit.c
+++ b/drivers/net/wireless/ath9k/xmit.c
@@ -357,9 +357,9 @@ static int ath_tx_prepare(struct ath_softc *sc,
         txctl->flags = ATH9K_TXDESC_CLRDMASK;    /* needed for crypto errors */
 
         if (tx_info->flags & IEEE80211_TX_CTL_NO_ACK)
-                tx_info->flags |= ATH9K_TXDESC_NOACK;
+                txctl->flags |= ATH9K_TXDESC_NOACK;
         if (tx_info->flags & IEEE80211_TX_CTL_USE_RTS_CTS)
-                tx_info->flags |= ATH9K_TXDESC_RTSENA;
+                txctl->flags |= ATH9K_TXDESC_RTSENA;
 
         /*
          * Setup for rate calculations.
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
index 754fef5b592f..90a2b6dee7c0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
@@ -1153,7 +1153,8 @@ static int rs_switch_to_mimo2(struct iwl_priv *priv,
             !sta->ht_info.ht_supported)
                 return -1;
 
-        if (priv->current_ht_config.tx_mimo_ps_mode == IWL_MIMO_PS_STATIC)
+        if (((sta->ht_info.cap & IEEE80211_HT_CAP_MIMO_PS) >> 2)
+                                                == IWL_MIMO_PS_STATIC)
                 return -1;
 
         /* Need both Tx chains/antennas to support MIMO */
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index c0b73c4d6f44..e01f048a02dd 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -181,14 +181,14 @@ static int iwl4965_check_rxon_cmd(struct iwl_rxon_cmd *rxon)
 }
 
 /**
- * iwl4965_full_rxon_required - check if full RXON (vs RXON_ASSOC) cmd is needed
+ * iwl_full_rxon_required - check if full RXON (vs RXON_ASSOC) cmd is needed
  * @priv: staging_rxon is compared to active_rxon
  *
  * If the RXON structure is changing enough to require a new tune,
  * or is clearing the RXON_FILTER_ASSOC_MSK, then return 1 to indicate that
  * a new tune (full RXON command, rather than RXON_ASSOC cmd) is required.
  */
-static int iwl4965_full_rxon_required(struct iwl_priv *priv)
+static int iwl_full_rxon_required(struct iwl_priv *priv)
 {
 
         /* These items are only settable from the full RXON command */
@@ -207,7 +207,6 @@ static int iwl4965_full_rxon_required(struct iwl_priv *priv)
              priv->active_rxon.ofdm_ht_single_stream_basic_rates) ||
             (priv->staging_rxon.ofdm_ht_dual_stream_basic_rates !=
              priv->active_rxon.ofdm_ht_dual_stream_basic_rates) ||
-            (priv->staging_rxon.rx_chain != priv->active_rxon.rx_chain) ||
             (priv->staging_rxon.assoc_id != priv->active_rxon.assoc_id))
                 return 1;
 
@@ -263,7 +262,7 @@ static int iwl4965_commit_rxon(struct iwl_priv *priv)
         /* If we don't need to send a full RXON, we can use
          * iwl4965_rxon_assoc_cmd which is used to reconfigure filter
          * and other flags for the current radio configuration. */
-        if (!iwl4965_full_rxon_required(priv)) {
+        if (!iwl_full_rxon_required(priv)) {
                 ret = iwl_send_rxon_assoc(priv);
                 if (ret) {
                         IWL_ERROR("Error setting RXON_ASSOC (%d)\n", ret);
@@ -587,8 +586,6 @@ static void iwl4965_ht_conf(struct iwl_priv *priv,
                 iwl_conf->supported_chan_width = 0;
         }
 
-        iwl_conf->tx_mimo_ps_mode =
-                (u8)((ht_conf->cap & IEEE80211_HT_CAP_MIMO_PS) >> 2);
         memcpy(iwl_conf->supp_mcs_set, ht_conf->supp_mcs_set, 16);
 
         iwl_conf->control_channel = ht_bss_conf->primary_channel;
@@ -2190,7 +2187,10 @@ static void __iwl4965_down(struct iwl_priv *priv)
         udelay(5);
 
         /* FIXME: apm_ops.suspend(priv) */
-        priv->cfg->ops->lib->apm_ops.reset(priv);
+        if (exit_pending || test_bit(STATUS_IN_SUSPEND, &priv->status))
+                priv->cfg->ops->lib->apm_ops.stop(priv);
+        else
+                priv->cfg->ops->lib->apm_ops.reset(priv);
         priv->cfg->ops->lib->free_shared_mem(priv);
 
  exit:
@@ -3588,7 +3588,7 @@ static int iwl4965_mac_beacon_update(struct ieee80211_hw *hw, struct sk_buff *sk
 
         priv->assoc_id = 0;
         timestamp = ((struct ieee80211_mgmt *)skb->data)->u.beacon.timestamp;
-        priv->timestamp = le64_to_cpu(timestamp) +  (priv->beacon_int * 1000);
+        priv->timestamp = le64_to_cpu(timestamp);
 
         IWL_DEBUG_MAC80211("leave\n");
         spin_unlock_irqrestore(&priv->lock, flags);
@@ -4372,15 +4372,18 @@ static void __devexit iwl4965_pci_remove(struct pci_dev *pdev)
         iwl_dbgfs_unregister(priv);
         sysfs_remove_group(&pdev->dev.kobj, &iwl4965_attribute_group);
 
+        /* ieee80211_unregister_hw call wil cause iwl4965_mac_stop to
+         * to be called and iwl4965_down since we are removing the device
+         * we need to set STATUS_EXIT_PENDING bit.
+         */
+        set_bit(STATUS_EXIT_PENDING, &priv->status);
         if (priv->mac80211_registered) {
                 ieee80211_unregister_hw(priv->hw);
                 priv->mac80211_registered = 0;
+        } else {
+                iwl4965_down(priv);
         }
 
-        set_bit(STATUS_EXIT_PENDING, &priv->status);
-
-        iwl4965_down(priv);
-
         /* make sure we flush any pending irq or
          * tasklet for the driver
          */
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index c72f72579bea..80f2f84defa8 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -592,12 +592,11 @@ static void iwlcore_free_geos(struct iwl_priv *priv)
         clear_bit(STATUS_GEO_CONFIGURED, &priv->status);
 }
 
-static u8 is_single_rx_stream(struct iwl_priv *priv)
+static bool is_single_rx_stream(struct iwl_priv *priv)
 {
         return !priv->current_ht_config.is_ht ||
                ((priv->current_ht_config.supp_mcs_set[1] == 0) &&
-                (priv->current_ht_config.supp_mcs_set[2] == 0)) ||
-               priv->ps_mode == IWL_MIMO_PS_STATIC;
+                (priv->current_ht_config.supp_mcs_set[2] == 0));
 }
 
 static u8 iwl_is_channel_extension(struct iwl_priv *priv,
@@ -704,33 +703,39 @@ EXPORT_SYMBOL(iwl_set_rxon_ht);
  * MIMO (dual stream) requires at least 2, but works better with 3.
  * This does not determine *which* chains to use, just how many.
  */
-static int iwlcore_get_rx_chain_counter(struct iwl_priv *priv,
-                                        u8 *idle_state, u8 *rx_state)
+static int iwl_get_active_rx_chain_count(struct iwl_priv *priv)
 {
-        u8 is_single = is_single_rx_stream(priv);
-        u8 is_cam = test_bit(STATUS_POWER_PMI, &priv->status) ? 0 : 1;
+        bool is_single = is_single_rx_stream(priv);
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
 
         /* # of Rx chains to use when expecting MIMO. */
         if (is_single || (!is_cam && (priv->ps_mode == IWL_MIMO_PS_STATIC)))
-                *rx_state = 2;
+                return 2;
         else
-                *rx_state = 3;
+                return 3;
+}
 
+static int iwl_get_idle_rx_chain_count(struct iwl_priv *priv, int active_cnt)
+{
+        int idle_cnt;
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
         /* # Rx chains when idling and maybe trying to save power */
         switch (priv->ps_mode) {
         case IWL_MIMO_PS_STATIC:
         case IWL_MIMO_PS_DYNAMIC:
-                *idle_state = (is_cam) ? 2 : 1;
+                idle_cnt = (is_cam) ? 2 : 1;
                 break;
         case IWL_MIMO_PS_NONE:
-                *idle_state = (is_cam) ? *rx_state : 1;
+                idle_cnt = (is_cam) ? active_cnt : 1;
                 break;
+        case IWL_MIMO_PS_INVALID:
         default:
-                *idle_state = 1;
+                IWL_ERROR("invalide mimo ps mode %d\n", priv->ps_mode);
+                WARN_ON(1);
+                idle_cnt = -1;
                 break;
         }
-
-        return 0;
+        return idle_cnt;
 }
 
 /**
@@ -741,34 +746,44 @@ static int iwlcore_get_rx_chain_counter(struct iwl_priv *priv,
  */
 void iwl_set_rxon_chain(struct iwl_priv *priv)
 {
-        u8 is_single = is_single_rx_stream(priv);
-        u8 idle_state, rx_state;
-
-        priv->staging_rxon.rx_chain = 0;
-        rx_state = idle_state = 3;
+        bool is_single = is_single_rx_stream(priv);
+        bool is_cam = !test_bit(STATUS_POWER_PMI, &priv->status);
+        u8 idle_rx_cnt, active_rx_cnt;
+        u16 rx_chain;
 
         /* Tell uCode which antennas are actually connected.
          * Before first association, we assume all antennas are connected.
          * Just after first association, iwl_chain_noise_calibration()
          *    checks which antennas actually *are* connected. */
-        priv->staging_rxon.rx_chain |=
-                    cpu_to_le16(priv->hw_params.valid_rx_ant <<
-                                                 RXON_RX_CHAIN_VALID_POS);
+        rx_chain = priv->hw_params.valid_rx_ant << RXON_RX_CHAIN_VALID_POS;
 
         /* How many receivers should we use? */
-        iwlcore_get_rx_chain_counter(priv, &idle_state, &rx_state);
-        priv->staging_rxon.rx_chain |=
-                cpu_to_le16(rx_state << RXON_RX_CHAIN_MIMO_CNT_POS);
-        priv->staging_rxon.rx_chain |=
-                cpu_to_le16(idle_state << RXON_RX_CHAIN_CNT_POS);
-
-        if (!is_single && (rx_state >= 2) &&
-            !test_bit(STATUS_POWER_PMI, &priv->status))
+        active_rx_cnt = iwl_get_active_rx_chain_count(priv);
+        idle_rx_cnt = iwl_get_idle_rx_chain_count(priv, active_rx_cnt);
+
+        /* correct rx chain count accoridng hw settings */
+        if (priv->hw_params.rx_chains_num < active_rx_cnt)
+                active_rx_cnt = priv->hw_params.rx_chains_num;
+
+        if (priv->hw_params.rx_chains_num < idle_rx_cnt)
+                idle_rx_cnt = priv->hw_params.rx_chains_num;
+
+        rx_chain |= active_rx_cnt << RXON_RX_CHAIN_MIMO_CNT_POS;
+        rx_chain |= idle_rx_cnt  << RXON_RX_CHAIN_CNT_POS;
+
+        priv->staging_rxon.rx_chain = cpu_to_le16(rx_chain);
+
+        if (!is_single && (active_rx_cnt >= 2) && is_cam)
                 priv->staging_rxon.rx_chain |= RXON_RX_CHAIN_MIMO_FORCE_MSK;
         else
                 priv->staging_rxon.rx_chain &= ~RXON_RX_CHAIN_MIMO_FORCE_MSK;
 
-        IWL_DEBUG_ASSOC("rx chain %X\n", priv->staging_rxon.rx_chain);
+        IWL_DEBUG_ASSOC("rx_chain=0x%Xi active=%d idle=%d\n",
+                        priv->staging_rxon.rx_chain,
+                        active_rx_cnt, idle_rx_cnt);
+
+        WARN_ON(active_rx_cnt == 0 || idle_rx_cnt == 0 ||
+                active_rx_cnt < idle_rx_cnt);
 }
 EXPORT_SYMBOL(iwl_set_rxon_chain);
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index c19db438306c..cdfb343c7ec6 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -412,7 +412,6 @@ struct iwl_ht_info {
         /* self configuration data */
         u8 is_ht;
         u8 supported_chan_width;
-        u16 tx_mimo_ps_mode;
         u8 is_green_field;
         u8 sgf;                 /* HT_SHORT_GI_* short guard interval */
         u8 max_amsdu_size;
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index f3f6ea49fdd2..e81bfc42a7cb 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -1173,7 +1173,10 @@ void iwl_rx_reply_rx(struct iwl_priv *priv,
 
         rx_status.antenna = 0;
         rx_status.flag = 0;
-        rx_status.flag |= RX_FLAG_TSFT;
+
+        /* TSF isn't reliable. In order to allow smooth user experience,
+         * this W/A doesn't propagate it to the mac80211 */
+        /*rx_status.flag |= RX_FLAG_TSFT;*/
 
         if ((unlikely(rx_start->cfg_phy_cnt > 20))) {
                 IWL_DEBUG_DROP("dsp size out of range [0,20]: %d/n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9bb6adb28b73..6c8ac3a87d54 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -421,7 +421,7 @@ static int iwl_get_channels_for_scan(struct iwl_priv *priv,
                 else
                         scan_ch->type = SCAN_CHANNEL_TYPE_ACTIVE;
 
-                if ((scan_ch->type & SCAN_CHANNEL_TYPE_ACTIVE) && n_probes)
+                if (n_probes)
                         scan_ch->type |= IWL_SCAN_PROBE_MASK(n_probes);
 
                 scan_ch->active_dwell = cpu_to_le16(active_dwell);
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index ff879d46624a..78b1a7a4ca40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -402,12 +402,11 @@ static int iwl_hw_tx_queue_init(struct iwl_priv *priv,
 /**
  * iwl_tx_queue_init - Allocate and initialize one tx/cmd queue
  */
-static int iwl_tx_queue_init(struct iwl_priv *priv,
-                             struct iwl_tx_queue *txq,
+static int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                              int slots_num, u32 txq_id)
 {
         int i, len;
-        int rc = 0;
+        int ret;
 
         /*
          * Alloc buffer array for commands (Tx or other types of commands).
@@ -428,17 +427,14 @@ static int iwl_tx_queue_init(struct iwl_priv *priv,
 
                 txq->cmd[i] = kmalloc(len, GFP_KERNEL);
                 if (!txq->cmd[i])
-                        return -ENOMEM;
+                        goto err;
         }
 
         /* Alloc driver data array and TFD circular buffer */
-        rc = iwl_tx_queue_alloc(priv, txq, txq_id);
-        if (rc) {
-                for (i = 0; i < slots_num; i++)
-                        kfree(txq->cmd[i]);
+        ret = iwl_tx_queue_alloc(priv, txq, txq_id);
+        if (ret)
+                goto err;
 
-                return -ENOMEM;
-        }
         txq->need_update = 0;
 
         /* TFD_QUEUE_SIZE_MAX must be power-of-two size, otherwise
@@ -452,6 +448,17 @@ static int iwl_tx_queue_init(struct iwl_priv *priv,
         iwl_hw_tx_queue_init(priv, txq);
 
         return 0;
+err:
+        for (i = 0; i < slots_num; i++) {
+                kfree(txq->cmd[i]);
+                txq->cmd[i] = NULL;
+        }
+
+        if (txq_id == IWL_CMD_QUEUE_NUM) {
+                kfree(txq->cmd[slots_num]);
+                txq->cmd[slots_num] = NULL;
+        }
+        return -ENOMEM;
 }
 /**
  * iwl_hw_txq_ctx_free - Free TXQ Context