rendered paste body--- ath/if_ath.c (revision 4136)+++ ath/if_ath.c (working copy)@@ -3277,6 +3277,7 @@ int (*ath_ff_flushdonetest)(struct ath_txq *txq, struct ath_buf *bf)) { struct ath_buf *bf_ff = NULL;+ struct sk_buff *bf_skb_encap = NULL; unsigned int pktlen; int framecnt; @@ -3297,14 +3298,15 @@ ATH_TXQ_UNLOCK_IRQ(txq); /* encap and xmit */- bf_ff->bf_skb = ieee80211_encap(ATH_BUF_NI(bf_ff), bf_ff->bf_skb, + bf_skb_encap = ieee80211_encap(ATH_BUF_NI(bf_ff), bf_ff->bf_skb, &framecnt);- if (bf_ff->bf_skb == NULL) {+ if (bf_skb_encap == NULL) { DPRINTF(sc, ATH_DEBUG_XMIT | ATH_DEBUG_FF, "Dropping; encapsulation failure\n"); sc->sc_stats.ast_tx_encap++; goto bad; }+ bf_ff->bf_skb = bf_skb_encap; pktlen = bf_ff->bf_skb->len; /* NB: don't reference skb below */ if (ath_tx_start(sc->sc_dev, ATH_BUF_NI(bf_ff), bf_ff, bf_ff->bf_skb, 0) == 0)@@ -3475,6 +3477,7 @@ struct sk_buff *original_skb = __skb; /* ALWAYS FREE THIS ONE!!! */ struct ath_node *an; struct sk_buff *skb = NULL;+ struct sk_buff *bf_skb_encap = NULL; /* We will use the requeue flag to denote when to stuff a skb back into * the OS queues. This should NOT be done under low memory conditions, * such as skb allocation failure. However, it should be done for the@@ -3655,14 +3658,15 @@ ATH_TXQ_UNLOCK_IRQ_EARLY(txq); /* Encap. and transmit */- bf_ff->bf_skb = ieee80211_encap(ni, bf_ff->bf_skb, + bf_skb_encap = ieee80211_encap(ni, bf_ff->bf_skb, &framecnt);- if (bf_ff->bf_skb == NULL) {+ if (bf_skb_encap == NULL) { DPRINTF(sc, ATH_DEBUG_XMIT, "Dropping; fast-frame flush encap. " "failure\n"); sc->sc_stats.ast_tx_encap++; } else {+ bf_ff->bf_skb = bf_skb_encap; pktlen = bf_ff->bf_skb->len; /* NB: don't reference skb below */ if (!ath_tx_start(dev, ni, bf_ff, bf_ff->bf_skb, 0))@@ -12471,12 +12475,14 @@ return bf; if (bf->bf_skbaddr) {- bus_unmap_single(- sc->sc_bdev,- bf->bf_skbaddr, - (direction == BUS_DMA_FROMDEVICE ? - sc->sc_rxbufsize : bf->bf_skb->len),- direction);+ if (bf->bf_skb) {+ bus_unmap_single(+ sc->sc_bdev,+ bf->bf_skbaddr, + (direction == BUS_DMA_FROMDEVICE ? + sc->sc_rxbufsize : bf->bf_skb->len),+ direction);+ } bf->bf_skbaddr = 0; bf->bf_desc->ds_link = 0; bf->bf_desc->ds_data = 0;