hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ath6kl: Fix htc_packet leak in ath6kl_htc_rx_process_packets() 

Packet is not reclaimed when ath6kl_htc_rx_process_hdr() fails.
Fix this by deferring the packet deletion from comp_pktq till
ath6kl_htc_rx_process_hdr() returns success. This bug is found
in code review, impact is not easily visible as the leak happens
only in failure cases.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
This commit is contained in:
Vasanthakumar Thiagarajan 2011-10-03 17:28:07 +05:30 committed by Kalle Valo
parent 861dd058f4
commit 4159cc935a
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/wireless/ath/ath6kl/htc.c
View File

@ -1643,7 +1643,6 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target,
int status = 0; int status = 0;
list_for_each_entry_safe(packet, tmp_pkt, comp_pktq, list) { list_for_each_entry_safe(packet, tmp_pkt, comp_pktq, list) {
list_del(&packet->list);
ep = &target->endpoint[packet->endpoint]; ep = &target->endpoint[packet->endpoint];
/* process header for each of the recv packet */ /* process header for each of the recv packet */
@ -1652,6 +1651,8 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target,
if (status) if (status)
return status; return status;
list_del(&packet->list);
if (list_empty(comp_pktq)) { if (list_empty(comp_pktq)) {
/* /*
* Last packet's more packet flag is set * Last packet's more packet flag is set