All rollback failures should result in freeing of the sk_buff by calling brcmf_txfinalize(). Reviewed-by: Hante Meuleman <meuleman@xxxxxxxxxxxx> Reviewed-by: Pieter-Paul Giesberts <pieterpg@xxxxxxxxxxxx> Signed-off-by: Arend van Spriel <arend@xxxxxxxxxxxx> --- drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c index 1cfec56..13518ec 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c @@ -1616,7 +1616,6 @@ brcmf_fws_rollback_toq(struct brcmf_fws_info *fws, struct sk_buff *skb) /* free the hanger slot */ brcmf_fws_hanger_poppkt(&fws->hanger, hslot, &pktout, true); - brcmf_txfinalize(fws->drvr, skb, false); rc = -EINVAL; goto fail; } @@ -1650,9 +1649,10 @@ brcmf_fws_rollback_toq(struct brcmf_fws_info *fws, struct sk_buff *skb) fail: - if (rc) + if (rc) { + brcmf_txfinalize(fws->drvr, skb, false); fws->stats.rollback_failed++; - else + } else fws->stats.rollback_success++; return rc; } -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html