2011-07-28 16:03:16

by Mohammed Shafi Shajakhan

[permalink] [raw]
Subject: [RFC] ath9k_htc: Fix memory leaks

From: Mohammed Shafi Shajakhan <[email protected]>

need to do more review and rigorous testing. Raj pointed out that there
are several places we are not freeing skb's when there is timeout

Signed-off-by: Mohammed Shafi Shajakhan <[email protected]>
---
drivers/net/wireless/ath/ath9k/htc_hst.c | 13 ++++++++-----
drivers/net/wireless/ath/ath9k/wmi.c | 3 ++-
2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 1b90ed8..e435c9b 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -169,13 +169,14 @@ static int htc_config_pipe_credits(struct htc_target *target)
time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
if (!time_left) {
dev_err(target->dev, "HTC credit config timeout\n");
- return -ETIMEDOUT;
+ ret = -ETIMEDOUT;
+ goto err;
}

return 0;
err:
kfree_skb(skb);
- return -EINVAL;
+ return ret;
}

static int htc_setup_complete(struct htc_target *target)
@@ -204,14 +205,15 @@ static int htc_setup_complete(struct htc_target *target)
time_left = wait_for_completion_timeout(&target->cmd_wait, HZ);
if (!time_left) {
dev_err(target->dev, "HTC start timeout\n");
- return -ETIMEDOUT;
+ ret = -ETIMEDOUT;
+ goto err;
}

return 0;

err:
kfree_skb(skb);
- return -EINVAL;
+ return ret;
}

/* HTC APIs */
@@ -276,7 +278,8 @@ int htc_connect_service(struct htc_target *target,
if (!time_left) {
dev_err(target->dev, "Service connection timeout for: %d\n",
service_connreq->service_id);
- return -ETIMEDOUT;
+ ret = -ETIMEDOUT;
+ goto err;
}

*conn_rsp_epid = target->conn_rsp_epid;
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 35422fc..50d901d 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -334,7 +334,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
"Timeout waiting for WMI command: %s\n",
wmi_cmd_to_name(cmd_id));
mutex_unlock(&wmi->op_mutex);
- return -ETIMEDOUT;
+ ret = -ETIMEDOUT;
+ goto out;
}

mutex_unlock(&wmi->op_mutex);
--
1.7.0.4