diff options
| author | sephe <sephe@FreeBSD.org> | 2007-04-19 13:09:57 +0000 |
|---|---|---|
| committer | sephe <sephe@FreeBSD.org> | 2007-04-19 13:09:57 +0000 |
| commit | f9d2951cadf7da6eb5345a1c593b6389e5abe53b (patch) | |
| tree | fc56ac28bfefae2cf5891d951a7412389926f895 /sys/dev/ral | |
| parent | e8a77bd9270dfbfa30aa44607f5f3ecb4e70ee3e (diff) | |
| download | FreeBSD-src-f9d2951cadf7da6eb5345a1c593b6389e5abe53b.zip FreeBSD-src-f9d2951cadf7da6eb5345a1c593b6389e5abe53b.tar.gz | |
- Fix mbuf/node leakage in drivers' raw_xmit().
- For ural(4):
o Fix node leakage in ural_start(), if ural_tx_mgt() fails.
o Fix mbuf leakage in ural_tx_{mgt,data}(), if usbd_transfer() fails.
o In ural_tx_{mgt,data}(), set ural_tx_data.{m,ni} to NULL, if
usbd_transfer() fails, so they will not be freed again in ural_stop().
Approved by: sam (mentor)
Diffstat (limited to 'sys/dev/ral')
| -rw-r--r-- | sys/dev/ral/rt2560.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/sys/dev/ral/rt2560.c b/sys/dev/ral/rt2560.c index 0e3e8e5..36a849d 100644 --- a/sys/dev/ral/rt2560.c +++ b/sys/dev/ral/rt2560.c @@ -1716,8 +1716,10 @@ rt2560_tx_raw(struct rt2560_softc *sc, struct mbuf *m0, rate = params->ibp_rate0 & IEEE80211_RATE_VAL; /* XXX validate */ - if (rate == 0) + if (rate == 0) { + m_freem(m0); return EINVAL; + } error = bus_dmamap_load_mbuf_sg(sc->prioq.data_dmat, data->map, m0, segs, &nsegs, 0); @@ -2782,11 +2784,15 @@ rt2560_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, /* prevent management frames from being sent if we're not ready */ if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) { RAL_UNLOCK(sc); + m_freem(m); + ieee80211_free_node(ni); return ENETDOWN; } if (sc->prioq.queued >= RT2560_PRIO_RING_COUNT) { ifp->if_drv_flags |= IFF_DRV_OACTIVE; RAL_UNLOCK(sc); + m_freem(m); + ieee80211_free_node(ni); return ENOBUFS; /* XXX */ } |
