On Mon, 2011-03-07 at 06:40 -0800, Doug Kehn wrote:
> Hi Inaky/All,
>
> i2400mu_rxd calls i2400m_rx with the received SKB. i2400m_rx does not
> free the SKB on error; i2400mu_rxd would still own the SKB.
> i2400mu_rxd does not free the SKB if i2400m_rx returns an error; the
> SKB is leaked. Is this analysis correct?
Yep, it is correct. Good spotting! Not only there, that is also a
problem in sdio-rx.c:i2400ms_rx(); exactly the same problem.
i2400m_rx() should have been declared with a warn_unused_result
attribute (__must_check)
> I believe the following would prevent the leak. If everyone agrees,
> I'll submit a formal patch.
It does.
Please do; extra points if you fix the SDIO one and add the __must_check
to i2400m_rx()'s declaration :)
Thank you!
> Regards,
> ...doug
>
>
> diff --git a/drivers/net/wimax/i2400m/usb-rx.c
> b/drivers/net/wimax/i2400m/usb-rx
> index a26483a..c84e671 100644
> --- a/drivers/net/wimax/i2400m/usb-rx.c
> +++ b/drivers/net/wimax/i2400m/usb-rx.c
> @@ -383,6 +383,8 @@ int i2400mu_rxd(void *_i2400mu)
> i2400mu->rx_size_cnt++;
> i2400mu->rx_size_acc += rx_skb->len;
> result = i2400m_rx(i2400m, rx_skb);
> + if (result)
> + kfree_skb(rx_skb);
> if (result == -EIO
> && edc_inc(&i2400mu->urb_edc,
> EDC_MAX_ERRORS, EDC_ERROR_TIMEFRAME)) {
>
>
>
>
> _______________________________________________
> wimax mailing list
> [email protected]
> http://lists.linuxwimax.org/listinfo/wimax
_______________________________________________
wimax mailing list
[email protected]
http://lists.linuxwimax.org/listinfo/wimax
