Author: avos Date: Sat Oct 24 19:59:15 2015 New Revision: 289891 URL: https://svnweb.freebsd.org/changeset/base/289891
Log: urtwn(4): fix mbuf leak in the TX path Reviewed by: kevlo Approved by: adrian (mentor) Differential Revision: https://reviews.freebsd.org/D3988 Modified: head/sys/dev/usb/wlan/if_urtwn.c Modified: head/sys/dev/usb/wlan/if_urtwn.c ============================================================================== --- head/sys/dev/usb/wlan/if_urtwn.c Sat Oct 24 19:47:54 2015 (r289890) +++ head/sys/dev/usb/wlan/if_urtwn.c Sat Oct 24 19:59:15 2015 (r289891) @@ -183,7 +183,8 @@ static struct mbuf * urtwn_rx_frame(stru int *); static struct mbuf * urtwn_rxeof(struct usb_xfer *, struct urtwn_data *, int *, int8_t *); -static void urtwn_txeof(struct usb_xfer *, struct urtwn_data *); +static void urtwn_txeof(struct urtwn_softc *, struct urtwn_data *, + int); static int urtwn_alloc_list(struct urtwn_softc *, struct urtwn_data[], int, int); static int urtwn_alloc_rx_list(struct urtwn_softc *); @@ -815,16 +816,19 @@ tr_setup: } static void -urtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data) +urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status) { - struct urtwn_softc *sc = usbd_xfer_softc(xfer); URTWN_ASSERT_LOCKED(sc); - /* XXX status? */ - ieee80211_tx_complete(data->ni, data->m, 0); + + ieee80211_tx_complete(data->ni, data->m, status); + data->ni = NULL; data->m = NULL; + sc->sc_txtimer = 0; + + STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next); } static int @@ -937,8 +941,7 @@ urtwn_bulk_tx_callback(struct usb_xfer * if (data == NULL) goto tr_setup; STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next); - urtwn_txeof(xfer, data); - STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next); + urtwn_txeof(sc, data, 0); /* FALLTHROUGH */ case USB_ST_SETUP: tr_setup: @@ -956,12 +959,8 @@ tr_setup: data = STAILQ_FIRST(&sc->sc_tx_active); if (data == NULL) goto tr_setup; - if (data->ni != NULL) { - if_inc_counter(data->ni->ni_vap->iv_ifp, - IFCOUNTER_OERRORS, 1); - ieee80211_free_node(data->ni); - data->ni = NULL; - } + STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next); + urtwn_txeof(sc, data, 1); if (error != USB_ERR_CANCELLED) { usbd_xfer_set_stall(xfer); goto tr_setup; _______________________________________________ svn-src-all@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-all To unsubscribe, send any mail to "svn-src-all-unsubscr...@freebsd.org"
