diff options
| author | hselasky <hselasky@FreeBSD.org> | 2013-02-08 22:51:09 +0000 |
|---|---|---|
| committer | hselasky <hselasky@FreeBSD.org> | 2013-02-08 22:51:09 +0000 |
| commit | 2d451673c99278b05c67b8252124eb29ccb54f77 (patch) | |
| tree | c17a7e6d3ff8e2b17992b888fa536381674f503a | |
| parent | 0437940fa9d5570cd420aa7195f0e4cba9c43fb3 (diff) | |
| download | FreeBSD-src-2d451673c99278b05c67b8252124eb29ccb54f77.zip FreeBSD-src-2d451673c99278b05c67b8252124eb29ccb54f77.tar.gz | |
Make sure we don't leak command buffers when a USB
command transfer fails.
MFC after: 1 week
Reported by: Ian FREISLICH
| -rw-r--r-- | sys/dev/usb/wlan/if_uath.c | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/sys/dev/usb/wlan/if_uath.c b/sys/dev/usb/wlan/if_uath.c index 37162c0..938e52e 100644 --- a/sys/dev/usb/wlan/if_uath.c +++ b/sys/dev/usb/wlan/if_uath.c @@ -2436,11 +2436,8 @@ uath_intr_tx_callback(struct usb_xfer *xfer, usb_error_t error) UATH_ASSERT_LOCKED(sc); - switch (USB_GET_STATE(xfer)) { - case USB_ST_TRANSFERRED: - cmd = STAILQ_FIRST(&sc->sc_cmd_active); - if (cmd == NULL) - goto setup; + cmd = STAILQ_FIRST(&sc->sc_cmd_active); + if (cmd != NULL && USB_GET_STATE(xfer) != USB_ST_SETUP) { STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next); UATH_STAT_DEC(sc, st_cmd_active); STAILQ_INSERT_TAIL((cmd->flags & UATH_CMD_FLAG_READ) ? @@ -2449,7 +2446,10 @@ uath_intr_tx_callback(struct usb_xfer *xfer, usb_error_t error) UATH_STAT_INC(sc, st_cmd_waiting); else UATH_STAT_INC(sc, st_cmd_inactive); - /* FALLTHROUGH */ + } + + switch (USB_GET_STATE(xfer)) { + case USB_ST_TRANSFERRED: case USB_ST_SETUP: setup: cmd = STAILQ_FIRST(&sc->sc_cmd_pending); |
