ath6kl: Fix memory leak of rx packets in endpoint 0

htc_packet and htc_packet->buf_start are separately allocated
for endpoint 0. This is different for other endpoints where
packets are allocated as skb where htc_packet is skb->head
and they are freed properly. Free htc_packet and htc_packet->buf_start
separatly for endpoint 0.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>

1 files changed, 15 insertions, 1 deletions

diff --git a/drivers/net/wireless/ath/ath6kl/htc.c b/drivers/net/wireless/ath/ath6kl/htc.c
index 920e7c07fd4f..c6f45a744d52 100644
--- a/drivers/net/wireless/ath/ath6kl/htc.c
+++ b/drivers/net/wireless/ath/ath6kl/htc.c
@@ -2372,7 +2372,21 @@ void ath6kl_htc_flush_rx_buf(struct htc_target *target)
                                    "htc rx flush pkt 0x%p  len %d  ep %d\n",
                                    packet, packet->buf_len,
                                    packet->endpoint);
-                        dev_kfree_skb(packet->pkt_cntxt);
+                        /*
+                         * packets in rx_bufq of endpoint 0 have originally
+                         * been queued from target->free_ctrl_rxbuf where
+                         * packet and packet->buf_start are allocated
+                         * separately using kmalloc(). For other endpoint
+                         * rx_bufq, it is allocated as skb where packet is
+                         * skb->head. Take care of this difference while freeing
+                         * the memory.
+                         */
+                        if (packet->endpoint == ENDPOINT_0) {
+                                kfree(packet->buf_start);
+                                kfree(packet);
+                        } else {
+                                dev_kfree_skb(packet->pkt_cntxt);
+                        }
                         spin_lock_bh(&target->rx_lock);
                 }
                 spin_unlock_bh(&target->rx_lock);