summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2009-03-16 21:47:33 +0200
committerJohn W. Linville <linville@tuxdriver.com>2009-03-16 18:01:59 -0400
commit640c65eae673d2caf6e7bf61c1eb4e9513b88fda (patch)
treef7d5fff2fe31dea17393318d0e8deafd65b1ed36
parent055249d20de06c290fe7625be0a7164bef3958f5 (diff)
downloadlinux-stable-640c65eae673d2caf6e7bf61c1eb4e9513b88fda.tar.gz
linux-stable-640c65eae673d2caf6e7bf61c1eb4e9513b88fda.tar.bz2
linux-stable-640c65eae673d2caf6e7bf61c1eb4e9513b88fda.zip
zd1211rw: Do not panic on device eject when associated
zd_op_tx() must not return an arbitrary error value since that can leave mac80211 trying to retransmit the frame and with the extra data pushed into the beginning of the skb on every attempt, this will end up causing a kernel panic (skb_under_panic from skb_push call). This can happen, e.g., when ejecting the device when associated. Signed-off-by: Jouni Malinen <j@w1.fi> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/zd1211rw/zd_mac.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c
index a611ad857983..847057d682b1 100644
--- a/drivers/net/wireless/zd1211rw/zd_mac.c
+++ b/drivers/net/wireless/zd1211rw/zd_mac.c
@@ -575,13 +575,17 @@ static int zd_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
r = fill_ctrlset(mac, skb);
if (r)
- return r;
+ goto fail;
info->rate_driver_data[0] = hw;
r = zd_usb_tx(&mac->chip.usb, skb);
if (r)
- return r;
+ goto fail;
+ return 0;
+
+fail:
+ dev_kfree_skb(skb);
return 0;
}