diff options
| author | Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> | 2011-10-03 17:28:07 +0530 |
|---|---|---|
| committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2011-11-11 12:50:54 +0200 |
| commit | 4159cc935a7ed119e5f824db06defaa34d992b56 (patch) | |
| tree | 7e5a7bf27f7d7e717173c9636820ac84bd9ecb3d /drivers/net/wireless/ath/ath6kl/htc.c | |
| parent | 861dd058f495973c7ad2a44b8f68f3cc05733eab (diff) | |
ath6kl: Fix htc_packet leak in ath6kl_htc_rx_process_packets()
Packet is not reclaimed when ath6kl_htc_rx_process_hdr() fails.
Fix this by deferring the packet deletion from comp_pktq till
ath6kl_htc_rx_process_hdr() returns success. This bug is found
in code review, impact is not easily visible as the leak happens
only in failure cases.
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath6kl/htc.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath6kl/htc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/htc.c b/drivers/net/wireless/ath/ath6kl/htc.c index f88a7c9e414..7bc988438ea 100644 --- a/drivers/net/wireless/ath/ath6kl/htc.c +++ b/drivers/net/wireless/ath/ath6kl/htc.c @@ -1643,7 +1643,6 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target, int status = 0; list_for_each_entry_safe(packet, tmp_pkt, comp_pktq, list) { - list_del(&packet->list); ep = &target->endpoint[packet->endpoint]; /* process header for each of the recv packet */ @@ -1652,6 +1651,8 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target, if (status) return status; + list_del(&packet->list); + if (list_empty(comp_pktq)) { /* * Last packet's more packet flag is set |