Re: [PATCH 2/2] ath6kl: Fix memory leak of rx packets in endpoint 0

[Raja Mani <rmani@qca.qualcomm.com>]

On Friday 10 February 2012 08:40 PM, Vasanthakumar Thiagarajan wrote:
> htc_packet and htc_packet->buf_start are separately allocated
> for endpoint 0. This is different for other endpoints where
> packets are allocated as skb where htc_packet is skb->head
> and they are freed properly. Free htc_packet and htc_packet->buf_start
> separatly for endpoint 0.
>
> Signed-off-by: Vasanthakumar Thiagarajan<vthiagar@qca.qualcomm.com>
> ---
>   drivers/net/wireless/ath/ath6kl/htc.c |   16 +++++++++++++++-
>   1 files changed, 15 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/net/wireless/ath/ath6kl/htc.c b/drivers/net/wireless/ath/ath6kl/htc.c
> index c703ef9..e50cc8e 100644
> --- a/drivers/net/wireless/ath/ath6kl/htc.c
> +++ b/drivers/net/wireless/ath/ath6kl/htc.c
> @@ -2372,7 +2372,21 @@ void ath6kl_htc_flush_rx_buf(struct htc_target *target)
>   				   "htc rx flush pkt 0x%p  len %d  ep %d\n",
>   				   packet, packet->buf_len,
>   				   packet->endpoint);
> -			dev_kfree_skb(packet->pkt_cntxt);
> +			/*
> +			 * packets in rx_bufq of endpoint 0 have originally
> +			 * been queued from target->free_ctrl_rxbuf where
> +			 * packet and packet->buf_start are allocated
> +			 * separately using kmalloc(). For other endpoint
> +			 * rx_bufq, it is allocated as skb where packet is
> +			 * skb->head. Take care of this difference while freeing
> +			 * the memory.
> +			 */
> +			if (packet->endpoint == ENDPOINT_0) {
> +				kfree(packet->buf_start);
> +				kfree(packet);
> +			} else {
> +				dev_kfree_skb(packet->pkt_cntxt);
> +			}

Vasanth,

My system is freezing with this patch when i tried to unload
ath6kl_sdio.ko. Could you double check this change once again?

>   			spin_lock_bh(&target->rx_lock);
>   		}
>   		spin_unlock_bh(&target->rx_lock);