wifi: mt76: do not free skb on ieee80211_tx_prepare_skb failure

ieee80211_tx_prepare_skb already frees the skb internally when
invoke_tx_handlers fails, so freeing it again in the caller leads to a
double-free / NULL pointer dereference in skb_release_data.

Signed-off-by: Felix Fietkau <nbd@nbd.name>

Author: nbd168

mac80211.c

@@ -2168,10 +2168,8 @@ mt76_offchannel_send_nullfunc(struct mt76_offchannel_cb_data *data,
 
 	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb,
 				      phy->main_chandef.chan->band,
-				      &sta)) {
-		ieee80211_free_txskb(phy->hw, skb);
+				      &sta))
 		return;
-	}
 
 	if (sta)
 		wcid = (struct mt76_wcid *)sta->drv_priv;

scan.c

@@ -69,10 +69,8 @@ mt76_scan_send_probe(struct mt76_dev *dev, struct cfg80211_ssid *ssid)
 
 	rcu_read_lock();
 
-	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL)) {
-		ieee80211_free_txskb(phy->hw, skb);
+	if (!ieee80211_tx_prepare_skb(phy->hw, vif, skb, band, NULL))
 		goto out;
-	}
 
 	info = IEEE80211_SKB_CB(skb);
 	if (req->no_cck)