iwlwifi: fix canceling monitor_recover timer

To make del_timer_sync() works we have to assure that timer function does not rearm the timer. To achieve that we cancel timer with STATUS_EXIT_PENDING bit set in __iwl{3945,}_down function.

Patch also fix priv->txq memory usage after free for iwl3945, because it move timer cancellation before iwl3945_hw_txq_ctx_free(priv) is called.

Signed-off-by Stanislaw Gruszka <[email protected]>

---
 drivers/net/wireless/iwlwifi/iwl-agn.c      |    7 +++++--
 drivers/net/wireless/iwlwifi/iwl3945-base.c |    7 +++++--
 2 files changed, 10 insertions(+), 4 deletions(-)

drivers/net/wireless/iwlwifi/iwl-agn.c +5 -2

index 3ced9ea..26bc048 100644
@@ -2764,6 +2764,11 @@ static void __iwl_down(struct iwl_priv *priv)
 	if (!exit_pending)
 		set_bit(STATUS_EXIT_PENDING, &priv->status);
 
+	/* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
+	 * to prevent rearm timer */
+	if (priv->cfg->ops->lib->recover_from_tx_stall)
+		del_timer_sync(&priv->monitor_recover);
+
 	iwl_clear_ucode_stations(priv);
 	iwl_dealloc_bcast_station(priv);
 	iwl_clear_driver_stations(priv);

@@ -3870,8 +3875,6 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
 	cancel_work_sync(&priv->beacon_update);
 	del_timer_sync(&priv->statistics_periodic);
 	del_timer_sync(&priv->ucode_trace);
-	if (priv->cfg->ops->lib->recover_from_tx_stall)
-		del_timer_sync(&priv->monitor_recover);
 }
 
 static void iwl_init_hw_rates(struct iwl_priv *priv,

drivers/net/wireless/iwlwifi/iwl3945-base.c +5 -0

index 94d7e6e..53e6cbb 100644
@@ -2571,6 +2571,11 @@ static void __iwl3945_down(struct iwl_priv *priv)
 	if (!exit_pending)
 		set_bit(STATUS_EXIT_PENDING, &priv->status);
 
+	/* Stop TX queues watchdog. We need to have STATUS_EXIT_PENDING bit set
+	 * to prevent rearm timer */
+	if (priv->cfg->ops->lib->recover_from_tx_stall)
+		del_timer_sync(&priv->monitor_recover);
+
 	/* Station information will now be cleared in device */
 	iwl_clear_ucode_stations(priv);
 	iwl_dealloc_bcast_station(priv);