Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (108 commits)
  bridge: ensure to unlock in error path in br_multicast_query().
  drivers/net/tulip/eeprom.c: fix bogus "(null)" in tulip init messages
  sky2: Avoid rtnl_unlock without rtnl_lock
  ipv6: Send netlink notification when DAD fails
  drivers/net/tg3.c: change the field used with the TG3_FLAG_10_100_ONLY constant
  ipconfig: Handle devices which take some time to come up.
  mac80211: Fix memory leak in ieee80211_if_write()
  mac80211: Fix (dynamic) power save entry
  ipw2200: use kmalloc for large local variables
  ath5k: read eeprom IQ calibration values correctly for G mode
  ath5k: fix I/Q calibration (for real)
  ath5k: fix TSF reset
  ath5k: use fixed antenna for tx descriptors
  libipw: split ieee->networks into small pieces
  mac80211: Fix sta_mtx unlocking on insert STA failure path
  rt2x00: remove KSEG1ADDR define from rt2x00soc.h
  net: add ColdFire support to the smc91x driver
  asix: fix setting mac address for AX88772
  ipv6 ip6_tunnel: eliminate unused recursion field from ip6_tnl{}.
  net: Fix dev_mc_add()
  ...

1 files changed, 7 insertions, 3 deletions

diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 9affe2cd185f..b4ddb2f83914 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -48,20 +48,24 @@ static ssize_t ieee80211_if_write(
         ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int))
 {
         u8 *buf;
-        ssize_t ret = -ENODEV;
+        ssize_t ret;
 
-        buf = kzalloc(count, GFP_KERNEL);
+        buf = kmalloc(count, GFP_KERNEL);
         if (!buf)
                 return -ENOMEM;
 
+        ret = -EFAULT;
         if (copy_from_user(buf, userbuf, count))
-                return -EFAULT;
+                goto freebuf;
 
+        ret = -ENODEV;
         rtnl_lock();
         if (sdata->dev->reg_state == NETREG_REGISTERED)
                 ret = (*write)(sdata, buf, count);
         rtnl_unlock();
 
+freebuf:
+        kfree(buf);
         return ret;
 }