4.19-stable review patch.  If anyone has any objections, please let me know.

------------------

[ Upstream commit 664497400c89a4d40aee51bcf48bbd2e4dc71104 ]

A successful call to wil_tx_ring takes skb reference so
it will only be freed in wil_tx_complete. Consume the skb
in wil_find_tx_bcast_2 to prevent memory leak.

Signed-off-by: Lior David <li...@codeaurora.org>
Signed-off-by: Maya Erez <me...@codeaurora.org>
Signed-off-by: Kalle Valo <kv...@codeaurora.org>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/net/wireless/ath/wil6210/txrx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/net/wireless/ath/wil6210/txrx.c 
b/drivers/net/wireless/ath/wil6210/txrx.c
index 6a7943e487fb..75c8aa297107 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -1313,6 +1313,8 @@ found:
                        wil_dbg_txrx(wil, "BCAST DUP -> ring %d\n", i);
                        wil_set_da_for_vring(wil, skb2, i);
                        wil_tx_ring(wil, vif, v2, skb2);
+                       /* successful call to wil_tx_ring takes skb2 ref */
+                       dev_kfree_skb_any(skb2);
                } else {
                        wil_err(wil, "skb_copy failed\n");
                }
-- 
2.19.1



Reply via email to