Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88ed2a60 authored by Russ Gorby's avatar Russ Gorby Committed by Greg Kroah-Hartman
Browse files

n_gsm: memory leak in uplink error path 



Uplink (TX) network data will go through gsm_dlci_data_output_framed
there is a bug where if memory allocation fails, the skb which
has already been pulled off the list will be lost.

In addition TX skbs were being processed in LIFO order

Fixed the memory leak, and changed to FIFO order processing

Signed-off-by: default avatarRuss Gorby <russ.gorby@intel.com>
Tested-by: default avatarKappel, LaurentX <laurentx.kappel@intel.com>
Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Cc: Showjumping <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 329e5678

drivers/tty/n_gsm.c

+5 −2
Original line number Diff line number Diff line
@@ -868,7 +868,7 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, 


	/* dlci->skb is locked by tx_lock */

	if (dlci->skb == NULL) {

		dlci->skb = skb_dequeue(&dlci->skb_list);

		dlci->skb = skb_dequeue_tail(&dlci->skb_list);

		if (dlci->skb == NULL)

			return 0;

		first = 1;
@@ -892,8 +892,11 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, 


	/* FIXME: need a timer or something to kick this so it can't

	   get stuck with no work outstanding and no buffer free */

	if (msg == NULL)

	if (msg == NULL) {

		skb_queue_tail(&dlci->skb_list, dlci->skb);

		dlci->skb = NULL;

		return -ENOMEM;

	}

	dp = msg->data;



	if (dlci->adaption == 4) { /* Interruptible framed (Packetised Data) */