Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78f18df4 authored by Felix Fietkau's avatar Felix Fietkau Committed by John W. Linville
Browse files

b43: fix tx path skb leaks 



ieee80211_free_txskb() needs to be used instead of dev_kfree_skb_any for
tx packets passed to the driver from mac80211

Signed-off-by: default avatarFelix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 596ab5ec

drivers/net/wireless/b43/dma.c

+5 −2
Original line number Diff line number Diff line
@@ -409,6 +409,9 @@ static inline 
				struct b43_dmadesc_meta *meta)

{

	if (meta->skb) {

		if (ring->tx)

			ieee80211_free_txskb(ring->dev->wl->hw, meta->skb);

		else

			dev_kfree_skb_any(meta->skb);

		meta->skb = NULL;

	}
@@ -1454,7 +1457,7 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb) 
	if (unlikely(err == -ENOKEY)) {

		/* Drop this packet, as we don't have the encryption key

		 * anymore and must not transmit it unencrypted. */

		dev_kfree_skb_any(skb);

		ieee80211_free_txskb(dev->wl->hw, skb);

		err = 0;

		goto out;

	}

drivers/net/wireless/b43/main.c

+8 −4
Original line number Diff line number Diff line
@@ -3397,7 +3397,7 @@ static void b43_tx_work(struct work_struct *work) 
				break;

			}

			if (unlikely(err))

				dev_kfree_skb(skb); /* Drop it */

				ieee80211_free_txskb(wl->hw, skb);

			err = 0;

		}
@@ -3419,7 +3419,7 @@ static void b43_op_tx(struct ieee80211_hw *hw, 


	if (unlikely(skb->len < 2 + 2 + 6)) {

		/* Too short, this can't be a valid frame. */

		dev_kfree_skb_any(skb);

		ieee80211_free_txskb(hw, skb);

		return;

	}

	B43_WARN_ON(skb_shinfo(skb)->nr_frags);
@@ -4229,8 +4229,12 @@ redo: 


	/* Drain all TX queues. */

	for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {

		while (skb_queue_len(&wl->tx_queue[queue_num]))

			dev_kfree_skb(skb_dequeue(&wl->tx_queue[queue_num]));

		while (skb_queue_len(&wl->tx_queue[queue_num])) {

			struct sk_buff *skb;



			skb = skb_dequeue(&wl->tx_queue[queue_num]);

			ieee80211_free_txskb(wl->hw, skb);

		}

	}



	b43_mac_suspend(dev);

drivers/net/wireless/b43/pio.c

+2 −2
Original line number Diff line number Diff line
@@ -196,7 +196,7 @@ static void b43_pio_cancel_tx_packets(struct b43_pio_txqueue *q) 
	for (i = 0; i < ARRAY_SIZE(q->packets); i++) {

		pack = &(q->packets[i]);

		if (pack->skb) {

			dev_kfree_skb_any(pack->skb);

			ieee80211_free_txskb(q->dev->wl->hw, pack->skb);

			pack->skb = NULL;

		}

	}
@@ -552,7 +552,7 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb) 
	if (unlikely(err == -ENOKEY)) {

		/* Drop this packet, as we don't have the encryption key

		 * anymore and must not transmit it unencrypted. */

		dev_kfree_skb_any(skb);

		ieee80211_free_txskb(dev->wl->hw, skb);

		err = 0;

		goto out;

	}