netdev: bfin_mac: fix memory leak when freeing dma descriptors
authorSonic Zhang <sonic.zhang@analog.com>
Thu, 16 Jun 2011 12:31:58 +0000 (12:31 +0000)
committerDavid S. Miller <davem@conan.davemloft.net>
Fri, 17 Jun 2011 04:19:09 +0000 (00:19 -0400)
The size of the desc array is not the size of the desc structure, so
when we try to free up things, we leak some parts.

Reported-by: Regis Dargent <rdargent@edevice.com>
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: David S. Miller <davem@conan.davemloft.net>
drivers/net/bfin_mac.c

index 68d45ba..6c019e1 100644 (file)
@@ -52,13 +52,13 @@ MODULE_DESCRIPTION(DRV_DESC);
 MODULE_ALIAS("platform:bfin_mac");
 
 #if defined(CONFIG_BFIN_MAC_USE_L1)
-# define bfin_mac_alloc(dma_handle, size)  l1_data_sram_zalloc(size)
-# define bfin_mac_free(dma_handle, ptr)    l1_data_sram_free(ptr)
+# define bfin_mac_alloc(dma_handle, size, num)  l1_data_sram_zalloc(size*num)
+# define bfin_mac_free(dma_handle, ptr, num)    l1_data_sram_free(ptr)
 #else
-# define bfin_mac_alloc(dma_handle, size) \
-       dma_alloc_coherent(NULL, size, dma_handle, GFP_KERNEL)
-# define bfin_mac_free(dma_handle, ptr) \
-       dma_free_coherent(NULL, sizeof(*ptr), ptr, dma_handle)
+# define bfin_mac_alloc(dma_handle, size, num) \
+       dma_alloc_coherent(NULL, size*num, dma_handle, GFP_KERNEL)
+# define bfin_mac_free(dma_handle, ptr, num) \
+       dma_free_coherent(NULL, sizeof(*ptr)*num, ptr, dma_handle)
 #endif
 
 #define PKT_BUF_SZ 1580
@@ -95,7 +95,7 @@ static void desc_list_free(void)
                                t = t->next;
                        }
                }
-               bfin_mac_free(dma_handle, tx_desc);
+               bfin_mac_free(dma_handle, tx_desc, CONFIG_BFIN_TX_DESC_NUM);
        }
 
        if (rx_desc) {
@@ -109,7 +109,7 @@ static void desc_list_free(void)
                                r = r->next;
                        }
                }
-               bfin_mac_free(dma_handle, rx_desc);
+               bfin_mac_free(dma_handle, rx_desc, CONFIG_BFIN_RX_DESC_NUM);
        }
 }
 
@@ -126,13 +126,13 @@ static int desc_list_init(void)
 #endif
 
        tx_desc = bfin_mac_alloc(&dma_handle,
-                               sizeof(struct net_dma_desc_tx) *
+                               sizeof(struct net_dma_desc_tx),
                                CONFIG_BFIN_TX_DESC_NUM);
        if (tx_desc == NULL)
                goto init_error;
 
        rx_desc = bfin_mac_alloc(&dma_handle,
-                               sizeof(struct net_dma_desc_rx) *
+                               sizeof(struct net_dma_desc_rx),
                                CONFIG_BFIN_RX_DESC_NUM);
        if (rx_desc == NULL)
                goto init_error;