From 76ac7280c351ca0616f61ae40a838e30155408da Mon Sep 17 00:00:00 2001 From: "Poddar, Siddarth" Date: Mon, 27 Mar 2017 15:59:42 +0530 Subject: [PATCH] qcacld-3.0: Fix memory leak in htt_rx_attach Rx buffer hash table memory is not freed in htt_rx_attach when target index allocation fails. Fix is to free memory in failure case. CRs-Fixed: 2025050 Change-Id: Ibbe238dc7d2f6dc2c31fe94569c9aa744714e930 --- core/dp/htt/htt_rx.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/core/dp/htt/htt_rx.c b/core/dp/htt/htt_rx.c index 4177359e29..8e3577bc77 100644 --- a/core/dp/htt/htt_rx.c +++ b/core/dp/htt/htt_rx.c @@ -3173,7 +3173,7 @@ int htt_rx_attach(struct htt_pdev_t *pdev) &paddr); if (!pdev->rx_ring.target_idx.vaddr) - goto fail1; + goto fail2; pdev->rx_ring.target_idx.paddr = paddr; *pdev->rx_ring.target_idx.vaddr = 0; @@ -3193,7 +3193,7 @@ int htt_rx_attach(struct htt_pdev_t *pdev) pdev->rx_ring.size * ring_elem_size, &paddr); if (!pdev->rx_ring.buf.paddrs_ring) - goto fail2; + goto fail3; pdev->rx_ring.base_paddr = paddr; pdev->rx_ring.alloc_idx.vaddr = @@ -3202,7 +3202,7 @@ int htt_rx_attach(struct htt_pdev_t *pdev) sizeof(uint32_t), &paddr); if (!pdev->rx_ring.alloc_idx.vaddr) - goto fail3; + goto fail4; pdev->rx_ring.alloc_idx.paddr = paddr; *pdev->rx_ring.alloc_idx.vaddr = 0; @@ -3266,7 +3266,7 @@ int htt_rx_attach(struct htt_pdev_t *pdev) return 0; /* success */ -fail3: +fail4: qdf_mem_free_consistent(pdev->osdev, pdev->osdev->dev, pdev->rx_ring.size * sizeof(qdf_dma_addr_t), pdev->rx_ring.buf.paddrs_ring, @@ -3274,8 +3274,8 @@ fail3: qdf_get_dma_mem_context((&pdev->rx_ring.buf), memctx)); -fail2: - if (pdev->cfg.is_full_reorder_offload) { +fail3: + if (pdev->cfg.is_full_reorder_offload) qdf_mem_free_consistent(pdev->osdev, pdev->osdev->dev, sizeof(uint32_t), pdev->rx_ring.target_idx.vaddr, @@ -3284,10 +3284,12 @@ fail2: rx_ring. target_idx), memctx)); - htt_rx_hash_deinit(pdev); - } else { + else qdf_mem_free(pdev->rx_ring.buf.netbufs_ring); - } + +fail2: + if (pdev->cfg.is_full_reorder_offload) + htt_rx_hash_deinit(pdev); fail1: return 1; /* failure */