aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorStefan Richter <stefanr@s5r6.in-berlin.de>2010-11-06 16:57:28 +0100
committerStefan Richter <stefanr@s5r6.in-berlin.de>2010-11-17 00:08:48 +0100
commit7ee11fa8d0a84b05cefe12b0bebc05ab0ea89cd6 (patch)
treeed0f67e8b3687aef93acd50db1f635d43c8073f5 /drivers
parent902bca00dc6e3b3ff5fbb1e32e5dbb45d5f30579 (diff)
downloadmrst-s0i3-test-7ee11fa8d0a84b05cefe12b0bebc05ab0ea89cd6.tar.gz
mrst-s0i3-test-7ee11fa8d0a84b05cefe12b0bebc05ab0ea89cd6.tar.xz
mrst-s0i3-test-7ee11fa8d0a84b05cefe12b0bebc05ab0ea89cd6.zip
firewire: net: fix memory leaks
a) fwnet_transmit_packet_done used to poison ptask->pt_link by list_del. If fwnet_send_packet checked later whether it was responsible to clean up (in the border case that the TX soft IRQ was outpaced by the AT-req tasklet on another CPU), it missed this because ptask->pt_link was no longer shown as empty. b) If fwnet_write_complete got an rcode other than RCODE_COMPLETE, we missed to free the skb and ptask entirely. Also, count stats.tx_dropped and stats.tx_errors when rcode != 0. Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/firewire/net.c35
1 files changed, 31 insertions, 4 deletions
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index e2e968e732b..3a27cee5bf2 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -916,9 +916,10 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
/* Check whether we or the networking TX soft-IRQ is last user. */
free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));
+ if (free)
+ list_del(&ptask->pt_link);
if (ptask->outstanding_pkts == 0) {
- list_del(&ptask->pt_link);
dev->netdev->stats.tx_packets++;
dev->netdev->stats.tx_bytes += skb->len;
}
@@ -973,6 +974,31 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
fwnet_free_ptask(ptask);
}
+static void fwnet_transmit_packet_failed(struct fwnet_packet_task *ptask)
+{
+ struct fwnet_device *dev = ptask->dev;
+ unsigned long flags;
+ bool free;
+
+ spin_lock_irqsave(&dev->lock, flags);
+
+ /* One fragment failed; don't try to send remaining fragments. */
+ ptask->outstanding_pkts = 0;
+
+ /* Check whether we or the networking TX soft-IRQ is last user. */
+ free = !list_empty(&ptask->pt_link);
+ if (free)
+ list_del(&ptask->pt_link);
+
+ dev->netdev->stats.tx_dropped++;
+ dev->netdev->stats.tx_errors++;
+
+ spin_unlock_irqrestore(&dev->lock, flags);
+
+ if (free)
+ fwnet_free_ptask(ptask);
+}
+
static void fwnet_write_complete(struct fw_card *card, int rcode,
void *payload, size_t length, void *data)
{
@@ -980,11 +1006,12 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
ptask = data;
- if (rcode == RCODE_COMPLETE)
+ if (rcode == RCODE_COMPLETE) {
fwnet_transmit_packet_done(ptask);
- else
+ } else {
fw_error("fwnet_write_complete: failed: %x\n", rcode);
- /* ??? error recovery */
+ fwnet_transmit_packet_failed(ptask);
+ }
}
static int fwnet_send_packet(struct fwnet_packet_task *ptask)