diff options
| author | Jouni Malinen <j@w1.fi> | 2009-03-16 21:47:33 +0200 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-03-16 18:01:59 -0400 |
| commit | 640c65eae673d2caf6e7bf61c1eb4e9513b88fda (patch) | |
| tree | f7d5fff2fe31dea17393318d0e8deafd65b1ed36 | |
| parent | 055249d20de06c290fe7625be0a7164bef3958f5 (diff) | |
zd1211rw: Do not panic on device eject when associated
zd_op_tx() must not return an arbitrary error value since that can
leave mac80211 trying to retransmit the frame and with the extra data
pushed into the beginning of the skb on every attempt, this will end up
causing a kernel panic (skb_under_panic from skb_push call). This can
happen, e.g., when ejecting the device when associated.
Signed-off-by: Jouni Malinen <j@w1.fi>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/zd1211rw/zd_mac.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/drivers/net/wireless/zd1211rw/zd_mac.c b/drivers/net/wireless/zd1211rw/zd_mac.c index a611ad85798..847057d682b 100644 --- a/drivers/net/wireless/zd1211rw/zd_mac.c +++ b/drivers/net/wireless/zd1211rw/zd_mac.c @@ -575,13 +575,17 @@ static int zd_op_tx(struct ieee80211_hw *hw, struct sk_buff *skb) r = fill_ctrlset(mac, skb); if (r) - return r; + goto fail; info->rate_driver_data[0] = hw; r = zd_usb_tx(&mac->chip.usb, skb); if (r) - return r; + goto fail; + return 0; + +fail: + dev_kfree_skb(skb); return 0; } |