From 2d451673c99278b05c67b8252124eb29ccb54f77 Mon Sep 17 00:00:00 2001 From: hselasky Date: Fri, 8 Feb 2013 22:51:09 +0000 Subject: Make sure we don't leak command buffers when a USB command transfer fails. MFC after: 1 week Reported by: Ian FREISLICH --- sys/dev/usb/wlan/if_uath.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'sys/dev/usb/wlan/if_uath.c') diff --git a/sys/dev/usb/wlan/if_uath.c b/sys/dev/usb/wlan/if_uath.c index 37162c0..938e52e 100644 --- a/sys/dev/usb/wlan/if_uath.c +++ b/sys/dev/usb/wlan/if_uath.c @@ -2436,11 +2436,8 @@ uath_intr_tx_callback(struct usb_xfer *xfer, usb_error_t error) UATH_ASSERT_LOCKED(sc); - switch (USB_GET_STATE(xfer)) { - case USB_ST_TRANSFERRED: - cmd = STAILQ_FIRST(&sc->sc_cmd_active); - if (cmd == NULL) - goto setup; + cmd = STAILQ_FIRST(&sc->sc_cmd_active); + if (cmd != NULL && USB_GET_STATE(xfer) != USB_ST_SETUP) { STAILQ_REMOVE_HEAD(&sc->sc_cmd_active, next); UATH_STAT_DEC(sc, st_cmd_active); STAILQ_INSERT_TAIL((cmd->flags & UATH_CMD_FLAG_READ) ? @@ -2449,7 +2446,10 @@ uath_intr_tx_callback(struct usb_xfer *xfer, usb_error_t error) UATH_STAT_INC(sc, st_cmd_waiting); else UATH_STAT_INC(sc, st_cmd_inactive); - /* FALLTHROUGH */ + } + + switch (USB_GET_STATE(xfer)) { + case USB_ST_TRANSFERRED: case USB_ST_SETUP: setup: cmd = STAILQ_FIRST(&sc->sc_cmd_pending); -- cgit v1.1