Fix a bug where bf->bf_skb needs to be set to NULL because the skbuff have already...

ath_tx_capture, for each frame in the list we have already freed the skb but the original pointer to
the list of skbs is still in bf->bf_skb.  So when bf is returned with ath_return_txbuf it tries to
double-free, resuilting a spew of backtraces/warnings when reference debugging is enabled.

Not to mention the fact that the skb is double-freed.

git-svn-id: http://madwifi-project.org/svn/madwifi/trunk@3220 0192ed92-7a03-0410-a25b-9323aeb14dbd

diff --git a/ath/if_ath.c b/ath/if_ath.c
index f00dbaa8d862d63cd459e976d289e8d91e0d636d..31a7df301967f257de3130325c8e7aee0d99ab00 100644 (file)
--- a/ath/if_ath.c
+++ b/ath/if_ath.c
@@ -8071,6 +8071,7 @@ ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq)
 #endif
                }
 
+               bf->bf_skb = NULL;
                ni = NULL;
                ath_return_txbuf(sc, &bf);
        }