--- a/net80211/ieee80211_input.c
+++ b/net80211/ieee80211_input.c
-@@ -1201,6 +1201,7 @@
+@@ -1198,6 +1198,7 @@ ieee80211_deliver_data(struct ieee80211_
}
if (skb1 != NULL) {
struct ieee80211_node *ni_tmp;
skb1->dev = dev;
skb_reset_mac_header(skb1);
skb_set_network_header(skb1, sizeof(struct ether_header));
-@@ -1208,7 +1209,12 @@
+@@ -1205,7 +1206,12 @@ ieee80211_deliver_data(struct ieee80211_
skb1->protocol = __constant_htons(ETH_P_802_2);
/* XXX insert vlan tag before queue it? */
ni_tmp = SKB_CB(skb1)->ni; /* remember node so we can free it */
+ if (ret == NETDEV_TX_BUSY)
+ ieee80211_dev_kfree_skb(&skb1);
+
-+ if (ret != NETDEV_TX_OK) {
++ else if (ret != NETDEV_TX_OK) {
/* If queue dropped the packet because device was
* too busy */
vap->iv_devstats.tx_dropped++;
--- a/net80211/ieee80211_output.c
+++ b/net80211/ieee80211_output.c
-@@ -333,9 +333,10 @@
+@@ -324,9 +324,10 @@ void ieee80211_parent_queue_xmit(struct
/* Dispatch the packet to the parent device */
skb->dev = vap->iv_ic->ic_dev;