Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5378f244 authored by Vasanthakumar Thiagarajan's avatar Vasanthakumar Thiagarajan Committed by Kalle Valo
Browse files

ath6kl: Fix memory leak of rx packets in endpoint 0 



htc_packet and htc_packet->buf_start are separately allocated
for endpoint 0. This is different for other endpoints where
packets are allocated as skb where htc_packet is skb->head
and they are freed properly. Free htc_packet and htc_packet->buf_start
separatly for endpoint 0.

Signed-off-by: default avatarVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent bd5b5ac2

drivers/net/wireless/ath/ath6kl/htc.c

+15 −1
Original line number Diff line number Diff line
@@ -2372,7 +2372,21 @@ void ath6kl_htc_flush_rx_buf(struct htc_target *target) 
				   "htc rx flush pkt 0x%p  len %d  ep %d\n",

				   packet, packet->buf_len,

				   packet->endpoint);

			/*

			 * packets in rx_bufq of endpoint 0 have originally

			 * been queued from target->free_ctrl_rxbuf where

			 * packet and packet->buf_start are allocated

			 * separately using kmalloc(). For other endpoint

			 * rx_bufq, it is allocated as skb where packet is

			 * skb->head. Take care of this difference while freeing

			 * the memory.

			 */

			if (packet->endpoint == ENDPOINT_0) {

				kfree(packet->buf_start);

				kfree(packet);

			} else {

				dev_kfree_skb(packet->pkt_cntxt);

			}

			spin_lock_bh(&target->rx_lock);

		}

		spin_unlock_bh(&target->rx_lock);