--- a/net80211/ieee80211_input.c
+++ b/net80211/ieee80211_input.c
-@@ -1183,6 +1183,7 @@
+@@ -1197,6 +1197,7 @@ ieee80211_deliver_data(struct ieee80211_
}
if (skb1 != NULL) {
struct ieee80211_node *ni_tmp;
skb1->dev = dev;
skb_reset_mac_header(skb1);
skb_set_network_header(skb1, sizeof(struct ether_header));
-@@ -1190,7 +1191,12 @@
+@@ -1204,7 +1205,12 @@ ieee80211_deliver_data(struct ieee80211_
skb1->protocol = __constant_htons(ETH_P_802_2);
/* XXX insert vlan tag before queue it? */
ni_tmp = SKB_CB(skb1)->ni; /* remember node so we can free it */
+ if (ret == NETDEV_TX_BUSY)
+ ieee80211_dev_kfree_skb(&skb1);
+
-+ if (ret != NETDEV_TX_OK) {
++ else if (ret != NETDEV_TX_OK) {
/* If queue dropped the packet because device was
* too busy */
vap->iv_devstats.tx_dropped++;
--- a/net80211/ieee80211_output.c
+++ b/net80211/ieee80211_output.c
-@@ -329,9 +329,10 @@
+@@ -324,9 +324,10 @@ void ieee80211_parent_queue_xmit(struct
/* Dispatch the packet to the parent device */
skb->dev = vap->iv_ic->ic_dev;