wimax/i2400m: fix erroneous NETDEV_TX_BUSY use

A driver start_xmit() method cannot free skb and return NETDEV_TX_BUSY,
since caller is going to reuse freed skb.

In fact netif_tx_stop_queue() / netif_stop_queue() is needed before
returning NETDEV_TX_BUSY or you can trigger a ksoftirqd fatal loop.

In case of memory allocation error, only safe way is to drop the packet
and return NETDEV_TX_OK

Also increments tx_dropped counter

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Inaky Perez-Gonzalez <inaky.perez-gonzalez@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c
index 64a110604ad3d19213102d13f86a75d2ed2dedba..63e4b709efa956b100626e3fc56bd248f4a7828f 100644 (file)
--- a/drivers/net/wimax/i2400m/netdev.c
+++ b/drivers/net/wimax/i2400m/netdev.c
@@ -367,38 +367,28 @@ netdev_tx_t i2400m_hard_start_xmit(struct sk_buff *skb,
 {
        struct i2400m *i2400m = net_dev_to_i2400m(net_dev);
        struct device *dev = i2400m_dev(i2400m);
-       int result;
+       int result = -1;
 
        d_fnstart(3, dev, "(skb %p net_dev %p)\n", skb, net_dev);
-       if (skb_header_cloned(skb)) {
-               /*
-                * Make tcpdump/wireshark happy -- if they are
-                * running, the skb is cloned and we will overwrite
-                * the mac fields in i2400m_tx_prep_header. Expand
-                * seems to fix this...
-                */
-               result = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
-               if (result) {
-                       result = NETDEV_TX_BUSY;
-                       goto error_expand;
-               }
-       }
+
+       if (skb_header_cloned(skb) && 
+           pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
+               goto drop;
 
        if (i2400m->state == I2400M_SS_IDLE)
                result = i2400m_net_wake_tx(i2400m, net_dev, skb);
        else
                result = i2400m_net_tx(i2400m, net_dev, skb);
-       if (result <  0)
+       if (result <  0) {
+drop:
                net_dev->stats.tx_dropped++;
-       else {
+       } else {
                net_dev->stats.tx_packets++;
                net_dev->stats.tx_bytes += skb->len;
        }
-       result = NETDEV_TX_OK;
-error_expand:
-       kfree_skb(skb);
+       dev_kfree_skb(skb);
        d_fnend(3, dev, "(skb %p net_dev %p) = %d\n", skb, net_dev, result);
-       return result;
+       return NETDEV_TX_OK;
 }