Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 596ab5ec authored by Felix Fietkau's avatar Felix Fietkau Committed by John W. Linville
Browse files

ath5k: fix tx path skb leaks 



ieee80211_free_txskb() needs to be used instead of dev_kfree_skb_any for
tx packets passed to the driver from mac80211

Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent ab5c4f71

drivers/net/wireless/ath/ath5k/base.c

+2 −2
Original line number Diff line number Diff line
@@ -849,7 +849,7 @@ ath5k_txbuf_free_skb(struct ath5k_hw *ah, struct ath5k_buf *bf) 
		return;

	dma_unmap_single(ah->dev, bf->skbaddr, bf->skb->len,

			DMA_TO_DEVICE);

	dev_kfree_skb_any(bf->skb);

	ieee80211_free_txskb(ah->hw, bf->skb);

	bf->skb = NULL;

	bf->skbaddr = 0;

	bf->desc->ds_data = 0;
@@ -1576,7 +1576,7 @@ ath5k_tx_queue(struct ieee80211_hw *hw, struct sk_buff *skb, 
	return;



drop_packet:

	dev_kfree_skb_any(skb);

	ieee80211_free_txskb(hw, skb);

}



static void

drivers/net/wireless/ath/ath5k/mac80211-ops.c

+1 −1
Original line number Diff line number Diff line
@@ -62,7 +62,7 @@ ath5k_tx(struct ieee80211_hw *hw, struct ieee80211_tx_control *control, 
	u16 qnum = skb_get_queue_mapping(skb);



	if (WARN_ON(qnum >= ah->ah_capabilities.cap_queues.q_tx_num)) {

		dev_kfree_skb_any(skb);

		ieee80211_free_txskb(hw, skb);

		return;

	}