txb = ieee80211_alloc_txb(1, len, GFP_ATOMIC); 
txb = ieee80211_alloc_txb(1, len, ieee->tx_headroom, GFP_ATOMIC); 
int ieee80211_tx_frame(struct ieee80211_device *ieee,		       struct ieee80211_hdr *frame, int len){	struct ieee80211_txb *txb = NULL;	unsigned long flags;	struct net_device_stats *stats = &ieee->stats;	struct sk_buff *skb_frag;	int priority = -1;	spin_lock_irqsave(&ieee->lock, flags);	/* If there is no driver handler to take the TXB, dont' bother	 * creating it... */	if (!ieee->hard_start_xmit) {		printk(KERN_WARNING "%s: No xmit handler.\n", ieee->dev->name);		goto success;	}	if (unlikely(len < 24)) {		printk(KERN_WARNING "%s: skb too small (%d).\n",		       ieee->dev->name, len);		goto success;	}	/* When we allocate the TXB we allocate enough space for the reserve	 * and full fragment bytes (bytes_per_frag doesn't include prefix,	 * postfix, header, FCS, etc.) */	txb = ieee80211_alloc_txb(1, len, GFP_ATOMIC);	if (unlikely(!txb)) {		printk(KERN_WARNING "%s: Could not allocate TXB\n",		       ieee->dev->name);		goto failed;	}	txb->encrypted = 0;	txb->payload_size = len;	skb_frag = txb->fragments[0];	memcpy(skb_put(skb_frag, len), frame, len);	if (ieee->config &	    (CFG_IEEE80211_COMPUTE_FCS | CFG_IEEE80211_RESERVE_FCS))		skb_put(skb_frag, 4);      success:	spin_unlock_irqrestore(&ieee->lock, flags);	if (txb) {		if ((*ieee->hard_start_xmit) (txb, ieee->dev, priority) == 0) {			stats->tx_packets++;			stats->tx_bytes += txb->payload_size;			return 0;		}		ieee80211_txb_free(txb);	}	return 0;      failed:	spin_unlock_irqrestore(&ieee->lock, flags);	stats->tx_errors++;	return 1;}
4520	/local/tlutelli/issta_data/temp/c/2005_temp/2005/4520/077783f87708b24054452e5c07685ead2c28b1eb/ieee80211_tx.c/buggy/net/ieee80211/ieee80211_tx.c