---

yaml
---
r: 194177
b: refs/heads/master
c: 6aac74b
h: refs/heads/master
i:
  194175: 0d310f0
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bed2263feb10ea29b2696030cdec2eea611caf14
+refs/heads/master: 6aac74b40d5828c6f6b24974580aa43d7bee905c

trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c

@@ -403,6 +403,9 @@ void iwlagn_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
 		list_add_tail(&rxq->pool[i].list, &rxq->rx_used);
 	}
 
+	for (i = 0; i < RX_QUEUE_SIZE; i++)
+		rxq->queue[i] = NULL;
+
 	/* Set us so that we have processed and used all buffers, but have
 	 * not restocked the Rx queue with fresh buffers */
 	rxq->read = rxq->write = 0;
@@ -538,11 +541,13 @@ void iwlagn_rx_queue_restock(struct iwl_priv *priv)
 	struct list_head *element;
 	struct iwl_rx_mem_buffer *rxb;
 	unsigned long flags;
-	int write;
 
 	spin_lock_irqsave(&rxq->lock, flags);
-	write = rxq->write & ~0x7;
 	while ((iwl_rx_queue_space(rxq) > 0) && (rxq->free_count)) {
+		/* The overwritten rxb must be a used one */
+		rxb = rxq->queue[rxq->write];
+		BUG_ON(rxb && rxb->page);
+
 		/* Get next free Rx buffer, remove from free list */
 		element = rxq->rx_free.next;
 		rxb = list_entry(element, struct iwl_rx_mem_buffer, list);
@@ -635,6 +640,7 @@ void iwlagn_rx_allocate(struct iwl_priv *priv, gfp_t priority)
 
 		spin_unlock_irqrestore(&rxq->lock, flags);
 
+		BUG_ON(rxb->page);
 		rxb->page = page;
 		/* Get physical address of the RB */
 		rxb->page_dma = pci_map_page(priv->pci_dev, page, 0,