From fca764003209ec2c18abff2cea1e9a151d2a0645 Mon Sep 17 00:00:00 2001 From: Lin Bai Date: Mon, 11 Dec 2017 15:03:49 +0800 Subject: [PATCH] qcacmn: Fix memory leak when failing to delete RX TID During RX TID deletion, if FLUSH_CACHE REO cmd fail to be sent, the required callback function won't be invoked, hence local allocated REO desc and related TID queue desc will leak. Do clean up when REO cmd failed to be sent. CRs-Fixed: 2155929 Change-Id: I02ff4a2340ad32986c30b935a376924bb75edb67 --- dp/wifi3.0/dp_peer.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/dp/wifi3.0/dp_peer.c b/dp/wifi3.0/dp_peer.c index 98f0b5fc7ba4..e74b893951b8 100644 --- a/dp/wifi3.0/dp_peer.c +++ b/dp/wifi3.0/dp_peer.c @@ -1197,6 +1197,7 @@ static int dp_rx_tid_delete_wifi3(struct dp_peer *peer, int tid) struct hal_reo_cmd_params params; struct reo_desc_list_node *freedesc = qdf_mem_malloc(sizeof(*freedesc)); + if (!freedesc) { QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, "%s: malloc failed for freedesc: tid %d\n", @@ -1222,14 +1223,31 @@ static int dp_rx_tid_delete_wifi3(struct dp_peer *peer, int tid) params.std.addr_lo = rx_tid->hw_qdesc_paddr & 0xffffffff; params.std.addr_hi = (uint64_t)(rx_tid->hw_qdesc_paddr) >> 32; - dp_reo_send_cmd(soc, CMD_FLUSH_CACHE, ¶ms, dp_rx_tid_delete_cb, - (void *)freedesc); - rx_tid->hw_qdesc_vaddr_unaligned = NULL; rx_tid->hw_qdesc_alloc_size = 0; rx_tid->hw_qdesc_paddr = 0; - return 0; + if (QDF_STATUS_SUCCESS != dp_reo_send_cmd(soc, + CMD_FLUSH_CACHE, + ¶ms, + dp_rx_tid_delete_cb, + (void *)freedesc)) { + /* + * If dp_reo_send_cmd return failure, related TID queue desc + * should be unmapped. Also locally reo_desc, together with + * TID queue desc also need to be freed accordingly. + * + * Here invoke desc_free function directly to do clean up. + */ + QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, + "%s: fail to send REO cmd to flush cache: tid %d\n", + __func__, tid); + dp_reo_desc_free(soc, freedesc); + + return -EBUSY; + } else { + return 0; + } } #ifdef DP_LFR