From ddb81a7c8387e834c176ca0640a67cd7aafa83fe Mon Sep 17 00:00:00 2001
From: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Date: Mon, 19 Jan 2009 13:19:30 +0000
Subject: [PATCH] --- yaml --- r: 130143 b: refs/heads/master c:
 f4895b8bc83a22a36446c4aee277e1750fcc6a18 h: refs/heads/master i:   130141:
 af26bbfd9dd04a4edfde63c1a5d5d02eb1bfedcf   130139:
 3f587ce39ac5708a97e3b097e6034f470e40c348   130135:
 7bac7995f5cdfc5dd34ab6fabe03ee7ff8c41424   130127:
 819327dc2f0ce0baf3219f313ba38eeca90ea23c   130111:
 809068d987f6ae5054811660b3dd20aef2588557 v: v3

---
 [refs]                                   | 2 +-
 trunk/drivers/net/wimax/i2400m/control.c | 2 +-
 trunk/drivers/net/wimax/i2400m/usb-rx.c  | 9 ++++++---
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/[refs] b/[refs]
index 81df35ccf738..a7940c2fa8d1 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: fe65e704534de5d0661ebc3466a2b9018945f694
+refs/heads/master: f4895b8bc83a22a36446c4aee277e1750fcc6a18
diff --git a/trunk/drivers/net/wimax/i2400m/control.c b/trunk/drivers/net/wimax/i2400m/control.c
index d3d37fed6893..15d9f51b292c 100644
--- a/trunk/drivers/net/wimax/i2400m/control.c
+++ b/trunk/drivers/net/wimax/i2400m/control.c
@@ -609,7 +609,7 @@ void i2400m_msg_to_dev_cancel_wait(struct i2400m *i2400m, int code)
 	spin_lock_irqsave(&i2400m->rx_lock, flags);
 	ack_skb = i2400m->ack_skb;
 	if (ack_skb && !IS_ERR(ack_skb))
-		kfree(ack_skb);
+		kfree_skb(ack_skb);
 	i2400m->ack_skb = ERR_PTR(code);
 	spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 }
diff --git a/trunk/drivers/net/wimax/i2400m/usb-rx.c b/trunk/drivers/net/wimax/i2400m/usb-rx.c
index 074cc1f89853..a314799967cf 100644
--- a/trunk/drivers/net/wimax/i2400m/usb-rx.c
+++ b/trunk/drivers/net/wimax/i2400m/usb-rx.c
@@ -184,6 +184,8 @@ void i2400mu_rx_size_maybe_shrink(struct i2400mu *i2400mu)
  *   NOTE: this function might realloc the skb (if it is too small),
  *   so always update with the one returned.
  *   ERR_PTR() is < 0 on error.
+ *   Will return NULL if it cannot reallocate -- this can be
+ *   considered a transient retryable error.
  */
 static
 struct sk_buff *i2400mu_rx(struct i2400mu *i2400mu, struct sk_buff *rx_skb)
@@ -243,8 +245,8 @@ struct sk_buff *i2400mu_rx(struct i2400mu *i2400mu, struct sk_buff *rx_skb)
 			if (printk_ratelimit())
 				dev_err(dev, "RX: Can't reallocate skb to %d; "
 					"RX dropped\n", rx_size);
-			kfree(rx_skb);
-			result = 0;
+			kfree_skb(rx_skb);
+			rx_skb = NULL;
 			goto out;	/* drop it...*/
 		}
 		kfree_skb(rx_skb);
@@ -344,7 +346,8 @@ int i2400mu_rxd(void *_i2400mu)
 		if (IS_ERR(rx_skb))
 			goto out;
 		atomic_dec(&i2400mu->rx_pending_count);
-		if (rx_skb->len == 0) {	/* some ignorable condition */
+		if (rx_skb == NULL || rx_skb->len == 0) {
+			/* some "ignorable" condition */
 			kfree_skb(rx_skb);
 			continue;
 		}