---

yaml
---
r: 291457
b: refs/heads/master
c: 5378f24
h: refs/heads/master
i:
  291455: fe49a59
v: v3

[refs]

@@ -1,2 +1,2 @@
 ---
-refs/heads/master: bd5b5ac2873da5a153fa32ff58d2fc4e25f7bc8a
+refs/heads/master: 5378f244b677f6696ca8a9a467cef16cd399b0e2

trunk/drivers/net/wireless/ath/ath6kl/htc.c

@@ -2372,7 +2372,21 @@ void ath6kl_htc_flush_rx_buf(struct htc_target *target)
 				   "htc rx flush pkt 0x%p  len %d  ep %d\n",
 				   packet, packet->buf_len,
 				   packet->endpoint);
-			dev_kfree_skb(packet->pkt_cntxt);
+			/*
+			 * packets in rx_bufq of endpoint 0 have originally
+			 * been queued from target->free_ctrl_rxbuf where
+			 * packet and packet->buf_start are allocated
+			 * separately using kmalloc(). For other endpoint
+			 * rx_bufq, it is allocated as skb where packet is
+			 * skb->head. Take care of this difference while freeing
+			 * the memory.
+			 */
+			if (packet->endpoint == ENDPOINT_0) {
+				kfree(packet->buf_start);
+				kfree(packet);
+			} else {
+				dev_kfree_skb(packet->pkt_cntxt);
+			}
 			spin_lock_bh(&target->rx_lock);
 		}
 		spin_unlock_bh(&target->rx_lock);