From: Dmitry Antipov <dmantipov@yandex.ru>
To: Kalle Valo <kvalo@kernel.org>
Cc: Rakesh Pillai <quic_pillair@quicinc.com>,
linux-wireless@vger.kernel.org,
Dmitry Antipov <dmantipov@yandex.ru>
Subject: [PATCH] wifi: ath10k: fix memory leak in WMI management
Date: Fri, 7 Jul 2023 13:52:26 +0300 [thread overview]
Message-ID: <20230707105243.22824-1-dmantipov@yandex.ru> (raw)
Since 'mgmt_pending_tx' of 'struct ath10k_wmi' contains pointers
to dynamically allocated 'struct ath10k_mgmt_tx_pkt_addr' objects,
these objects should be explicitly freed when removing from idr
or when the whole idr is destroyed.
Fixes: dc405152bb64 ("ath10k: handle mgmt tx completion event")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
---
drivers/net/wireless/ath/ath10k/wmi-tlv.c | 11 +++++++++--
drivers/net/wireless/ath/ath10k/wmi.c | 5 +++--
2 files changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
index 6b6aa3c36744..45a445c5f1df 100644
--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
@@ -3038,11 +3038,18 @@ ath10k_wmi_tlv_op_cleanup_mgmt_tx_send(struct ath10k *ar,
struct sk_buff *msdu)
{
struct ath10k_skb_cb *cb = ATH10K_SKB_CB(msdu);
+ struct ath10k_mgmt_tx_pkt_addr *pkt_addr;
struct ath10k_wmi *wmi = &ar->wmi;
- idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id);
+ pkt_addr = idr_find(&wmi->mgmt_pending_tx, cb->msdu_id);
+ if (pkt_addr) {
+ idr_remove(&wmi->mgmt_pending_tx, cb->msdu_id);
+ kfree(pkt_addr);
+ return 0;
+ }
- return 0;
+ ath10k_warn(ar, "invalid msdu_id: %d\n", cb->msdu_id);
+ return -ENOENT;
}
static int
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 05fa7d4c0e1a..20534a7d6551 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -2433,9 +2433,9 @@ wmi_process_mgmt_tx_comp(struct ath10k *ar, struct mgmt_tx_compl_params *param)
ieee80211_tx_status_irqsafe(ar->hw, msdu);
ret = 0;
-
-out:
idr_remove(&wmi->mgmt_pending_tx, param->desc_id);
+ kfree(pkt_addr);
+out:
spin_unlock_bh(&ar->data_lock);
return ret;
}
@@ -9539,6 +9539,7 @@ static int ath10k_wmi_mgmt_tx_clean_up_pending(int msdu_id, void *ptr,
dma_unmap_single(ar->dev, pkt_addr->paddr,
msdu->len, DMA_TO_DEVICE);
ieee80211_free_txskb(ar->hw, msdu);
+ kfree(pkt_addr);
return 0;
}
--
2.41.0
next reply other threads:[~2023-07-07 10:52 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-07 10:52 Dmitry Antipov [this message]
2023-10-03 14:19 ` [PATCH] wifi: ath10k: fix memory leak in WMI management Kalle Valo
-- strict thread matches above, loose matches on Subject: below --
2023-07-07 10:45 Dmitry Antipov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230707105243.22824-1-dmantipov@yandex.ru \
--to=dmantipov@yandex.ru \
--cc=kvalo@kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=quic_pillair@quicinc.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).