- Fix mbuf/node leakage in drivers' raw_xmit().

- For ural(4):
  o  Fix node leakage in ural_start(), if ural_tx_mgt() fails.
  o  Fix mbuf leakage in ural_tx_{mgt,data}(), if usbd_transfer() fails.
  o  In ural_tx_{mgt,data}(), set ural_tx_data.{m,ni} to NULL, if
     usbd_transfer() fails, so they will not be freed again in ural_stop().

Approved by:	sam (mentor)

1 files changed, 2 insertions, 0 deletions

diff --git a/sys/dev/ath/if_ath.c b/sys/dev/ath/if_ath.c
index f3907b6..1ef2138 100644
--- a/sys/dev/ath/if_ath.c
+++ b/sys/dev/ath/if_ath.c
@@ -5838,6 +5838,7 @@ ath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 	struct ath_buf *bf;
 
 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 || sc->sc_invalid) {
+		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENETDOWN;
 	}
@@ -5854,6 +5855,7 @@ ath_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 			__func__);
 		sc->sc_stats.ast_tx_qstop++;
 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
+		ieee80211_free_node(ni);
 		m_freem(m);
 		return ENOBUFS;
 	}