Currently, trans::conf is cleared in opmode_leave(), which means that in the rest of the remove() it will be zeroed. But some of the freeing code still needs some data from it, for example the cmd_queue id. For older devices that their cmd_queue id is not 0, it can cause us to free queue 0 as it was a command queue. A command queue is different from a regular queue, the first has its cmd as regular kmalloc'ed memory while a regular queue has it from a kmem_cache, so the two should be freed differently. To avoid that, don't clear the trans::conf, there won't be a new opmode anyway in the device's lifecycle. Fixes: 432a41232ca9 ("wifi: iwlwifi: dvm: restore n_no_reclaim_cmds setting") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit --- drivers/net/wireless/intel/iwlwifi/iwl-trans.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c index 73aae1125042..486752d4da75 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-trans.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-trans.c @@ -421,7 +421,6 @@ void iwl_trans_op_mode_leave(struct iwl_trans *trans) cancel_delayed_work_sync(&trans->restart.wk); trans->op_mode = NULL; - memset(&trans->conf, 0, sizeof(trans->conf)); trans->state = IWL_TRANS_NO_FW; } -- 2.34.1