Skip to content

Commit

Permalink
ath6kl: Fix htc_packet leak in ath6kl_htc_rx_process_packets()
Browse files Browse the repository at this point in the history
Packet is not reclaimed when ath6kl_htc_rx_process_hdr() fails.
Fix this by deferring the packet deletion from comp_pktq till
ath6kl_htc_rx_process_hdr() returns success. This bug is found
in code review, impact is not easily visible as the leak happens
only in failure cases.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
  • Loading branch information
Vasanthakumar Thiagarajan authored and Kalle Valo committed Nov 11, 2011
1 parent 861dd05 commit 4159cc9
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/net/wireless/ath/ath6kl/htc.c
Original file line number Diff line number Diff line change
Expand Up @@ -1643,7 +1643,6 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target,
int status = 0;

list_for_each_entry_safe(packet, tmp_pkt, comp_pktq, list) {
list_del(&packet->list);
ep = &target->endpoint[packet->endpoint];

/* process header for each of the recv packet */
Expand All @@ -1652,6 +1651,8 @@ static int ath6kl_htc_rx_process_packets(struct htc_target *target,
if (status)
return status;

list_del(&packet->list);

if (list_empty(comp_pktq)) {
/*
* Last packet's more packet flag is set
Expand Down

0 comments on commit 4159cc9

Please sign in to comment.