Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7ee11fa8 authored by Stefan Richter's avatar Stefan Richter
Browse files

firewire: net: fix memory leaks 



a) fwnet_transmit_packet_done used to poison ptask->pt_link by list_del.
If fwnet_send_packet checked later whether it was responsible to clean
up (in the border case that the TX soft IRQ was outpaced by the AT-req
tasklet on another CPU), it missed this because ptask->pt_link was no
longer shown as empty.

b) If fwnet_write_complete got an rcode other than RCODE_COMPLETE, we
missed to free the skb and ptask entirely.

Also, count stats.tx_dropped and stats.tx_errors when rcode != 0.

Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
parent 902bca00

drivers/firewire/net.c

+31 −4
Original line number Diff line number Diff line
@@ -916,9 +916,10 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask) 


	/* Check whether we or the networking TX soft-IRQ is last user. */

	free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));

	if (free)

		list_del(&ptask->pt_link);



	if (ptask->outstanding_pkts == 0) {

		list_del(&ptask->pt_link);

		dev->netdev->stats.tx_packets++;

		dev->netdev->stats.tx_bytes += skb->len;

	}
@@ -973,6 +974,31 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask) 
		fwnet_free_ptask(ptask);

}



static void fwnet_transmit_packet_failed(struct fwnet_packet_task *ptask)

{

	struct fwnet_device *dev = ptask->dev;

	unsigned long flags;

	bool free;



	spin_lock_irqsave(&dev->lock, flags);



	/* One fragment failed; don't try to send remaining fragments. */

	ptask->outstanding_pkts = 0;



	/* Check whether we or the networking TX soft-IRQ is last user. */

	free = !list_empty(&ptask->pt_link);

	if (free)

		list_del(&ptask->pt_link);



	dev->netdev->stats.tx_dropped++;

	dev->netdev->stats.tx_errors++;



	spin_unlock_irqrestore(&dev->lock, flags);



	if (free)

		fwnet_free_ptask(ptask);

}



static void fwnet_write_complete(struct fw_card *card, int rcode,

				 void *payload, size_t length, void *data)

{
@@ -980,11 +1006,12 @@ static void fwnet_write_complete(struct fw_card *card, int rcode, 


	ptask = data;



	if (rcode == RCODE_COMPLETE)

	if (rcode == RCODE_COMPLETE) {

		fwnet_transmit_packet_done(ptask);

	else

	} else {

		fw_error("fwnet_write_complete: failed: %x\n", rcode);

		/* ??? error recovery */

		fwnet_transmit_packet_failed(ptask);

	}

}



static int fwnet_send_packet(struct fwnet_packet_task *ptask)