Commit 33a164fa authored by Ganapathi Bhat's avatar Ganapathi Bhat Committed by Kalle Valo

mwifex: free rx_cmd skb in suspended state

USB suspend handler will kill the presubmitted rx_cmd URB. This
triggers a call to the corresponding URB complete handler, which
will free the rx_cmd skb, associated with rx_cmd URB. Due to a
possible race betwen suspend handler and main thread, depicted in
'commit bfcacac6c84b ("mwifiex: do no submit URB in suspended
state")', it is possible that the rx_cmd skb will fail to get
freed. This causes a memory leak, since the resume handler will
always allocate a new rx_cmd skb.

To fix this, free the rx_cmd skb in mwifiex_usb_submit_rx_urb, if
the device is in suspended state.
Signed-off-by: default avatarVidya Dharmaraju <vidyad@marvell.com>
Signed-off-by: default avatarCathy Luo <cluo@marvell.com>
Signed-off-by: default avatarGanapathi Bhat <gbhat@marvell.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent 7bd4628c
...@@ -299,6 +299,12 @@ static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size) ...@@ -299,6 +299,12 @@ static int mwifiex_usb_submit_rx_urb(struct urb_context *ctx, int size)
struct usb_card_rec *card = (struct usb_card_rec *)adapter->card; struct usb_card_rec *card = (struct usb_card_rec *)adapter->card;
if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) { if (test_bit(MWIFIEX_IS_SUSPENDED, &adapter->work_flags)) {
if (card->rx_cmd_ep == ctx->ep) {
mwifiex_dbg(adapter, INFO, "%s: free rx_cmd skb\n",
__func__);
dev_kfree_skb_any(ctx->skb);
ctx->skb = NULL;
}
mwifiex_dbg(adapter, ERROR, mwifiex_dbg(adapter, ERROR,
"%s: card removed/suspended, EP %d rx_cmd URB submit skipped\n", "%s: card removed/suspended, EP %d rx_cmd URB submit skipped\n",
__func__, ctx->ep); __func__, ctx->ep);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment