mwifex: free rx_cmd skb in suspended state
authorGanapathi Bhat <gbhat@marvell.com>
Tue, 21 Aug 2018 07:53:02 +0000 (13:23 +0530)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 20 Nov 2019 17:45:48 +0000 (18:45 +0100)
commitf05f8607622cf0e378cbb412e2a7d4bea77464f8
treedf60f2cd4488c991bfff65d7f377129af2527497
parent6c27b9267a84a46cbcdf88272aacdb3825ce80bc
mwifex: free rx_cmd skb in suspended state

[ Upstream commit 33a164fa8a4c91408e0b7738f754cb1a7827c5f2 ]

USB suspend handler will kill the presubmitted rx_cmd URB. This
triggers a call to the corresponding URB complete handler, which
will free the rx_cmd skb, associated with rx_cmd URB. Due to a
possible race betwen suspend handler and main thread, depicted in
'commit bfcacac6c84b ("mwifiex: do no submit URB in suspended
state")', it is possible that the rx_cmd skb will fail to get
freed. This causes a memory leak, since the resume handler will
always allocate a new rx_cmd skb.

To fix this, free the rx_cmd skb in mwifiex_usb_submit_rx_urb, if
the device is in suspended state.

Signed-off-by: Vidya Dharmaraju <vidyad@marvell.com>
Signed-off-by: Cathy Luo <cluo@marvell.com>
Signed-off-by: Ganapathi Bhat <gbhat@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/marvell/mwifiex/usb.c