leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

b43: fix tx path skb leaks

Browse Source 
ieee80211_free_txskb() needs to be used instead of dev_kfree_skb_any for
tx packets passed to the driver from mac80211

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Cc: stable@vger.kernel.org
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Felix Fietkau 2012-12-10 17:40:21 +01:00 committed by John W. Linville
parent 596ab5ec3b
commit 78f18df4b3
3 changed files with 15 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/net/wireless/b43/dma.c
View File

@ -409,7 +409,10 @@ static inline
struct b43_dmadesc_meta *meta) struct b43_dmadesc_meta *meta)
{ {
if (meta->skb) { if (meta->skb) {
dev_kfree_skb_any(meta->skb); if (ring->tx)
ieee80211_free_txskb(ring->dev->wl->hw, meta->skb);
else
dev_kfree_skb_any(meta->skb);
meta->skb = NULL; meta->skb = NULL;
} }
} }
@ -1454,7 +1457,7 @@ int b43_dma_tx(struct b43_wldev *dev, struct sk_buff *skb)
if (unlikely(err == -ENOKEY)) { if (unlikely(err == -ENOKEY)) {
/* Drop this packet, as we don't have the encryption key /* Drop this packet, as we don't have the encryption key
* anymore and must not transmit it unencrypted. */ * anymore and must not transmit it unencrypted. */
dev_kfree_skb_any(skb); ieee80211_free_txskb(dev->wl->hw, skb);
err = 0; err = 0;
goto out; goto out;
} }

12
drivers/net/wireless/b43/main.c
View File

@ -3397,7 +3397,7 @@ static void b43_tx_work(struct work_struct *work)
break; break;
} }
if (unlikely(err)) if (unlikely(err))
dev_kfree_skb(skb); /* Drop it */ ieee80211_free_txskb(wl->hw, skb);
err = 0; err = 0;
} }
@ -3419,7 +3419,7 @@ static void b43_op_tx(struct ieee80211_hw *hw,
if (unlikely(skb->len < 2 + 2 + 6)) { if (unlikely(skb->len < 2 + 2 + 6)) {
/* Too short, this can't be a valid frame. */ /* Too short, this can't be a valid frame. */
dev_kfree_skb_any(skb); ieee80211_free_txskb(hw, skb);
return; return;
} }
B43_WARN_ON(skb_shinfo(skb)->nr_frags); B43_WARN_ON(skb_shinfo(skb)->nr_frags);
@ -4229,8 +4229,12 @@ redo:
/* Drain all TX queues. */ /* Drain all TX queues. */
for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) { for (queue_num = 0; queue_num < B43_QOS_QUEUE_NUM; queue_num++) {
while (skb_queue_len(&wl->tx_queue[queue_num])) while (skb_queue_len(&wl->tx_queue[queue_num])) {
dev_kfree_skb(skb_dequeue(&wl->tx_queue[queue_num])); struct sk_buff *skb;
skb = skb_dequeue(&wl->tx_queue[queue_num]);
ieee80211_free_txskb(wl->hw, skb);
}
} }
b43_mac_suspend(dev); b43_mac_suspend(dev);

4
drivers/net/wireless/b43/pio.c
View File

@ -196,7 +196,7 @@ static void b43_pio_cancel_tx_packets(struct b43_pio_txqueue *q)
for (i = 0; i < ARRAY_SIZE(q->packets); i++) { for (i = 0; i < ARRAY_SIZE(q->packets); i++) {
pack = &(q->packets[i]); pack = &(q->packets[i]);
if (pack->skb) { if (pack->skb) {
dev_kfree_skb_any(pack->skb); ieee80211_free_txskb(q->dev->wl->hw, pack->skb);
pack->skb = NULL; pack->skb = NULL;
} }
} }
@ -552,7 +552,7 @@ int b43_pio_tx(struct b43_wldev *dev, struct sk_buff *skb)
if (unlikely(err == -ENOKEY)) { if (unlikely(err == -ENOKEY)) {
/* Drop this packet, as we don't have the encryption key /* Drop this packet, as we don't have the encryption key
* anymore and must not transmit it unencrypted. */ * anymore and must not transmit it unencrypted. */
dev_kfree_skb_any(skb); ieee80211_free_txskb(dev->wl->hw, skb);
err = 0; err = 0;
goto out; goto out;
} }