openwrt/package/madwifi/patches/331-memory_alloc.patch

--- a/ath/if_ath.c
+++ b/ath/if_ath.c
@@ -3320,17 +3320,18 @@ ath_hardstart(struct sk_buff *skb, struc
 	 * without affecting any other bridge ports. */
 	if (skb_cloned(skb)) {
 		/* Remember the original SKB so we can free up our references */
-		struct sk_buff *skb_orig = skb;
-		skb = skb_copy(skb, GFP_ATOMIC);
-		if (skb == NULL) {
+		struct sk_buff *skb_new;
+		skb_new = skb_copy(skb, GFP_ATOMIC);
+		if (skb_new == NULL) {
 			DPRINTF(sc, ATH_DEBUG_XMIT,
 				"Dropping; skb_copy failure.\n");
 			/* No free RAM, do not requeue! */
 			goto hardstart_fail;
 		}
-		ieee80211_skb_copy_noderef(skb_orig, skb);
-		ieee80211_dev_kfree_skb(&skb_orig);
-	} 
+		ieee80211_skb_copy_noderef(skb, skb_new);
+		ieee80211_dev_kfree_skb(&skb);
+		skb = skb_new;
+	}
 	eh = (struct ether_header *)skb->data;
 
 #ifdef ATH_SUPERG_FF
@@ -3601,6 +3602,8 @@ ath_mgtstart(struct ieee80211com *ic, st
 	sc->sc_stats.ast_tx_mgmt++;
 	return 0;
 bad:
+	if (skb)
+		ieee80211_dev_kfree_skb(&skb);
 	ath_return_txbuf(sc, &bf);
 	return error;
 }