From: Jia-Ju Bai <baijiaju1990@xxxxxxx> When dev_alloc_skb or pci_dma_mapping_error in rtl8180_init_rx_ring fails, the memory allocated by pci_zalloc_consistent is not freed. This patch fixes the bug by adding pci_free_consistent in error handling code. Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxx> Signed-off-by: Julian Calaby <julian.calaby@xxxxxxxxx> --- Could someone else please review this? In particular, immediately after the call to pci_zalloc_coherent(), it fails if the result is null or if '(unsigned long)result & 0xFF'. Is the second arm of the or statement possible, and if so, should we be pci_free_coherent()ing the result there too? I've had a quick scout around and this check seems to be particular to realtek drivers. Thanks, Julian Calaby --- drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c index c76af5d..a8a23d5 100644 --- a/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c +++ b/drivers/net/wireless/realtek/rtl818x/rtl8180/dev.c @@ -1018,6 +1018,8 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev) dma_addr_t *mapping; entry = priv->rx_ring + priv->rx_ring_sz*i; if (!skb) { + pci_free_consistent(priv->pdev, priv->rx_ring_sz * 32, + priv->rx_ring, priv->rx_ring_dma); wiphy_err(dev->wiphy, "Cannot allocate RX skb\n"); return -ENOMEM; } @@ -1028,6 +1030,8 @@ static int rtl8180_init_rx_ring(struct ieee80211_hw *dev) if (pci_dma_mapping_error(priv->pdev, *mapping)) { kfree_skb(skb); + pci_free_consistent(priv->pdev, priv->rx_ring_sz * 32, + priv->rx_ring, priv->rx_ring_dma); wiphy_err(dev->wiphy, "Cannot map DMA for RX skb\n"); return -ENOMEM; } -- 2.7.0 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html